Active Directory UDF - Help & Support

[jazzyjeff]

So I just tried specifying my user account in the AD_Open parameters, but that doesn't make a difference.

[water]

Returncode 4 by _AD_Open means:

"Creation of the RootDSE object failed. @extended returns the error code received by the COM error handler.

Generated when connection to the domain isn't successful. @extended returns -2147023541 (0x8007054B)"

Could you please test on another machine? Maybe an installation problem?

[jazzyjeff]

I have tried this on multiple machines and receive the same error. I have also used 32bit Windows 7 and 64bit Windows 7.

I saw that error message in the description, which is why I then though about trying to Open the AD connection with my admin account, because it works with my account. That didn't make a difference though.

[jazzyjeff]

Local firewall! Let me check that... I just realised that it may be the outbound firewall on Windows 7 that has suddenly stopped this working for these users (they had XP previously, so only an inbound firewall).

As an admin I am exempt from those policies with the firewall. I see port 636 is used in the documentation. I'll check that out now.

[water]

So your account is the only one who doesn't return an error?

[jazzyjeff]

Correct. I am a Domain/Enterprise Admin. The other users who I am trying to get this to work for are Domain Users and members of other groups with no admin rights.

[jazzyjeff]

Adding 636 to the firewall exemption list didn't make a difference.

[water]

Would have suprised me if that was the problem. Because how would the OS check the users file permissions setc.

Is there anything else unusual in the firewall logs? Can you deactivate the firewall and test?

[jazzyjeff]

So I have tried looking at this from a different angle and I am trying to use some different functions to achieve the same result.

I am not getting any error messages now with the _AD_Open command, but I do get a variable array error. This is the new code I am using. It works for my admin account, but again for a standard user it does not.

Global $grpMembers, $ADGroupMember
_AD_Open()
MsgBox(0, "_AD_Open", @error)
MsgBox(0, "_AD_Open", @extended)
;Check to make sure the user running the script has permissions to reset passwords.
$grpMembers = _AD_GetGroupMembers("PasswordReset")
MsgBox(0, "Get Group Members", @error)
If _AD_IsMemberOf("PasswordReset", @UserName, 1) Then
MsgBox(0, "Student Password Reset Utility", @UserName & ", you have the appropriate security group access to use this utility.", 4)
Else
MsgBox(0, "Number of Groups", $grpMembers[0])
For $i = 1 To $grpMembers[0]
  If _AD_IsMemberOf($grpMembers[$i], @UserName, 1) Then
   $ADGroupMember = 1
  EndIf
Next
If $ADGroupMember = 1 Then
  MsgBox(0, "Student Password Reset Utility", @UserName & ", you have the appropriate security group access to use this utility.", 4)
Else
  MsgBox(0, "Student Password Reset Utility", @UserName & ", you do not have the appropriate security group access to use this utility.", 4)
  Exit
EndIf
EndIf

This is the error I receive.

[water]

What linenumber do you get if you run the script from SciTE? The linenumber in your screenshot doesn't show us where the error occurres because it referres to the source with all comments stripped off.

[jazzyjeff]

Running from Scite ( I copied scite files to a flash drive and ran it from there) worked on the users laptop. When I compile the same script on my PC it does not work. I then compile it on the users laptop and it worked fine!

Time to rebuild my machine!

Sorry for any time wasting.

Thanks for your quick responses.

[water]

Glad to be of service

[kor]

I am experienceing a very intermittent issue with autoit crashing sometimes.

Event log 1000 "application error" is logged.

faulting application autoit3.exe version 3.3.6.1

failting module autoit3.exe version 3.3.6.1

fault address 0x00010f2a

I am not sure if it has something to do with the AD functions, or if this is some kind of other problem since the faulting module doesn't give much info away. Doesn't list a line number or anything.

Through my own debugging I've noticed that the fault seems to occur when trying to add a computer object to AD. Here is the code where the problem might be occuring.

; Check if workstation already exists in AD
    If _AD_ObjectExists(@ComputerName & "$", "sAMAccountName") Then ; if workstation exists
        _EventLog("Duplicate name found in Active Directory. Deleting.")
        Local $iSet = _AD_DeleteObject(@ComputerName & "$", "computer") ; delete workstation
        If $iSet = 0 Then
            $bError = True
            $sJoinErrors &= "Unable to delete workstation from AD" & @CR
            _EventLog("ERROR : Unable to delete workstation from AD.", "Warn")
        EndIf
        Sleep(5000)
    EndIf

    ; Create workstation
    If Not _AD_ObjectExists(@ComputerName & "$", "sAMAccountName") Then ; if workstation does not exist
        _EventLog(@ComputerName & " not found in Active Directory. Creating.")
        $n = 0
        Do
            _AD_CreateComputer($sOU, @ComputerName, "Information Technology") ; create computer as an IT Technician
            $n += 1
            Sleep(5000)
        Until _AD_ObjectExists(@ComputerName & "$", "sAMAccountName") Or $n >= 5
        If Not _AD_ObjectExists(@ComputerName & "$", "sAMAccountName") Or $n >= 5 Then
            $bError = True
            $sJoinErrors &= "Failed to create workstation" & @CR
            _EventLog("ERROR : Failed to create workstation.", "Warn")
        EndIf
    EndIf

I see EventLog "computername not found in AD, creating" logged to the event log, then about 8-10 seconds later I see the autoit crash event.

This problem is very random and sometimes happens on some machines, then try re-running and it runs fine.

Any help to troubleshoot?

[water]

Just a few questions:

• Why do you delete an already existing computer account and then recreate it?
• Why do you create the computer in a loop?
• What are the Sleep statemetns for?
• Could you update AutoIt to the most current version 3.3.8.1?
• What version of the AD UDF do you use?

Edited June 8, 2012 by water

[water]

I stripped the code down a bit and added @error and @extended to the error messages so you can see what happened:

; Check if workstation already exists in AD
If _AD_ObjectExists(@ComputerName & "$", "sAMAccountName") Then ; if workstation exists
    _EventLog("Duplicate name found in Active Directory. Deleting.")
    _AD_DeleteObject(@ComputerName & "$", "computer") ; delete workstation
    If @error Then
        $bError = True
        $sJoinErrors &= "Unable to delete workstation from AD. @error = " & @error & ", @extended = " & @extended & @CR
        _EventLog("ERROR : Unable to delete workstation from AD. @error = " & @error & ", @extended = " & @extended, "Warn")
    EndIf
    Sleep(5000)
EndIf

; Create workstation
If Not _AD_ObjectExists(@ComputerName & "$", "sAMAccountName") Then ; if workstation does not exist
    _EventLog(@ComputerName & " not found in Active Directory. Creating.")
    _AD_CreateComputer($sOU, @ComputerName, "Information Technology") ; create computer as an IT Technician
    If @error Then
        $bError = True
        $sJoinErrors &= "Failed to create workstation. @error = " & @error & ", @extended = " & @extended & @CR
        _EventLog("ERROR : Failed to create workstation. @error = " & @error & ", @extended = " & @extended, "Warn")
    EndIf
EndIf

Edited June 8, 2012 by water

[kor]

Just a few questions:

• Why do you delete an already existing computer account and then recreate it?
• Why do you create the computer in a loop?
• What are the Sleep statemetns for?
• Could you update AutoIt to the most current version 3.3.8.1?
• What version of the AD UDF do you use?

I delete the computer object first because this is for a re-imaging script. After sysprep a new SID is generated. You cannot add a new machine with a new SID to an existing computer object. You must delete it first then re-create it, or pre-stage it in AD manually.

I create the computer in a loop because I'm paranoid it won't stick the first time

The sleep statements were an attempt to fix the issue since I though the delete object and create object might be happening too quickly for AD replication, etc and wanted to make sure there was ample time for the delete process to finish before trying to create a new object with the same name.

I could update AutoIt to the newest version, but I don't think that's the actual problem.

I am running AD UDF version 0.43

[water]

The version of the UDF you use is quite old. I would suggest to upgrade to version 1.2.0 (not 1.2.1.0, that's a beta version).

Add @error and @extended to your error messages as I suggested in post and then wait till the problem occures again.

Edited June 8, 2012 by water

[BrewManNH]

I delete the computer object first because this is for a re-imaging script. After sysprep a new SID is generated. You cannot add a new machine with a new SID to an existing computer object. You must delete it first then re-create it, or pre-stage it in AD manually.

Actually, yes you can I do it all of the time.

[kor]

I'm also having another problem with the _AD_SetPassword

My code is

$iSet = _AD_SetPassword($sUsername, Random(000001, 999998, 1)) ; set random password
    If @error Then _Message("ERROR - Error setting random password - " & @error, True)

The error I get for @error is -2147352567

The error is random and does not happen every time I try and reset a password. But I would say it happens about 1 out of every 3 times my scripts tries to reset their password. The @error code is the same every time.

EDIT: this is also after I've already upgraded to the newest AD script version and newest Autoit and Scite versions.

Edited June 10, 2012 by kor

[water]

Unfortunately this is 0x80020009 (DISP_E_EXCEPTION) Exception occurred. A general error.

Could you please set variable "$iAD_Debug = 2" (write the COM error to a MsgBox) or "$iAD_Debug = 3" to write detailed error messages to file @ScriptDir & "AD_Debug.txt"?