Active Directory UDF - Help & Support

[jazzyjeff]

I just looked at the security permission for the user account I am testing with and SELF has Allow checked for all the "read" permissions, so I am thinking it should be able to obtain the Properties.

[jazzyjeff]

Here are screenshots of the errors returned.

[water]

Are you sure that _AD_Open is executed before calling _AD_GetObjectProperties?

[jazzyjeff]

I promise I am using the _AD_Open() function before.

So as shown below, I added the @error macro after the _AD_Open and I receive an error 4, which is a RootDSE error. Any ideas what this is?

Thanks,

#include<AD.au3>
#include<Crypt.au3>

Local $sPW, $sid
_DecryptPW1()
_AD_Open("username", $sPW, "DC=domain,DC=com", "server.domain.com", "CN=Configuration,DC=domain,DC=com")
If @error Then
 MsgBox(0,"",@error)
EndIf$iAD_Debug = 2
$sid = _AD_GetObjectProperties(@UserName, "")
MsgBox(0,"","Error: " & @error & ", IsArray: " & IsArray($sid) & @CRLF & @CR & @UserName)
;If IsArray($sid) Then
For $i = 1 To $sid[0][0]
If $sid[$i][0] = "objectSID" Then
$objectSID = $sid[$i][1]
EndIf
Next
RegWrite("HKLMSoftwareApplication", "SID", "REG_SZ", $objectSID)
;EndIf
_ArrayDisplay($sid)
MsgBox(0,"",$objectSID)
ConsoleWrite("Error: " & @error & ", IsArray: " & IsArray($sid) & @CRLF)
_AD_Close()

[water]

Could you pass the username as "Domainusername" and try again?

[jazzyjeff]

Still no luck.

Ok so I am logged in as myself onto my machine. I run scite as a different user(my test user account), and it runs fine.

I compile the script to an exe and run it on my test machine logged in as my test user and then I get the error 4 and those com errors in the screenshots above.

[water]

Do you have another machine where you can test the compiled script running as your test user? IIRC we had a similar situation and the user had to rebuild the machine and then everything was fine again.

Edit: Just searched the and noticed it was you

Edited July 12, 2012 by water

[jazzyjeff]

Just tried another machine and I get the same error. These are Windows 7 boxes (I've tried 64bit and 32bit).

I'll report back with XP status.

[water]

I'm running Windows 7 SP 1 64 bit and my test script just runs fine here

[jazzyjeff]

That's just marvellous! It works on XP , which is good.

I don't get why it won't work on Windows 7 though.

[jazzyjeff]

Ok, so we're narrowing this down to possibly the Windows 7 installation on my machines?

[water]

I'm not sure anymore. I just created a 32 and a 64 bit executable and got the same errors on Windows 7

Will have to investigate.

[jazzyjeff]

Do you think if I removed RootDSE from the UDF that this would be bad?

This topic talks about omitting it.

http://forums.techarena.in/active-directory/811087.htm

I think the code on your UDF is in line 391-415. Would I cause more problems by removing this?

[water]

Could you try this: Copy your exe to c:temp and execute it from there. Does it work?

[jazzyjeff]

:-) It works... So the issue is running the exe from a network share. I wonder where XP and Windows 7 differ from running files over a network.

[water]

It's not all network shares here. It returns an error when started from my HomeDrive but works when copied to C:temp or another network share.

I think it's a problem with the new security features implemented in W7. I'm not familiar with those client security settings but I think it's something like "trusted sites" for the IE. For Excel macro execution security you can define drives/directories as "trusted". For all other drives/directories execution of macros can be inhibited.

I think it's best to ask the guy responsible for group policies.

[jazzyjeff]

Thanks for your help Water. You've been a big help. I can work with this from here.

[water]

[xterix]

Hello Water, I've another question for you. My apologices if you've explained/clarified before.

I'm using this code to discover to what Ad-groups belongs a computername.

#include <ad.au3>
#include <array.au3>
$computer="M107XXXX.xx.xx.xxx"
$computers1="CN=M107xxxx,ou=Computers,ou=Belgium,dc=xx,dc=xxx,dc=xxx"
$Path = "dc=xx, dc="xxx",dc=xxx"    
$sAD_HostServerParam = "xx.xxx.xxx"
$sAD_UserIdParam=""
$sAD_PasswordParam=""
$OpenAD=_AD_Open($sAD_UserIdParam, $sAD_PasswordParam, $path, $sAD_HostServerParam, $path)
ConsoleWrite("Ad Open status: "&$OpenAD&@CRLF)
$members=_AD_RecursiveGetMemberOf($computers1)
_ArrayDisplay($members)

Script returns an array with all the groups that the computer belongs, that's ok, but these groups are at the same time members of the same group name in other domain.

How I could create the query to return the groups from both domains?.

Thanks a lot.

Edited July 12, 2012 by xterix

[xterix]

Hello Water, I've another question for you. My apologices if you've explained/clarified before.

I'm using this code to discover to what Ad-groups belongs a computername.

#include <ad.au3>
#include <array.au3>
$computer="M107XXXX.xx.xx.xxx"
$computers1="CN=M107xxxx,ou=Computers,ou=Belgium,dc=xx,dc=xxx,dc=xxx"
$Path = "dc=xx, dc="xxx",dc=xxx"    
$sAD_HostServerParam = "xx.xxx.xxx"
$sAD_UserIdParam=""
$sAD_PasswordParam=""
$OpenAD=_AD_Open($sAD_UserIdParam, $sAD_PasswordParam, $path, $sAD_HostServerParam, $path)
ConsoleWrite("Ad Open status: "&$OpenAD&@CRLF)
$members=_AD_RecursiveGetMemberOf($computers1)
_ArrayDisplay($members)

Script returns an array with all the groups that the computer belongs, that's ok, but these groups are at the same time members of the same group name in other domain.

How I could create the query to return the groups from both domains?.

Thanks a lot.

Looking for the global catalog