Active Directory UDF - Help & Support

[Iceman682]

Hi Water

Apologies for the delayed reply - The value of @extended = 0

Just to confirm, I am able to join the machine manually with the exact same credentials.

Edited December 15, 2012 by Iceman682

[water]

If you get @error = 5 then @extended has to be <> 0 because you only get @error = 5 when @extended <> 0:

If $iAD_Result <> 0 Then Return SetError(5, $iAD_Result, 0)

Can you post the script you use to join the computer?

[Iceman682]

expandcollapse popup

Func _DomainJoin()
Local $JOIN_DOMAIN = 1
Local $ACCT_CREATE = 2
Local $strAdminPass = GUICtrlRead($Password)
Local $strAdminAccount = GUICtrlRead($AdminUserName)
Local $strComputer = @ComputerName
Local $strDomainName = GUICtrlRead($Domain)
Local $objWMIService = ObjGet("winmgmts:" & "{impersonationLevel=impersonate}!" & $strComputer & "rootcimv2")
Local $colCompSystems = $objWMIService.ExecQuery("SELECT * FROM Win32_ComputerSystem")
For $objCompSystem In $colCompSystems
;-------------------------------------
; Change Computer Description
;--------------------------------------
Local $sDescription = GUICtrlRead($Description)
RegWrite("HKLMSYSTEMCurrentControlSetServicesLanmanserverparameters", "srvcomment", "REG_SZ", $sDescription)
MsgBox(8192, "Domain Joining", "Attempting to join " & $strComputer & " to the " & $strDomainName & " Domain", 5)
$intJoinDomain = $objCompSystem.JoinDomainOrWorkgroup($strDomainName, $strAdminPass, $strDomainName & '' & $strAdminAccount, '', $JOIN_DOMAIN + $ACCT_CREATE)
If $intJoinDomain = 0 Then
GUIDelete($JoinGUI)
_ResourcePlaySound("Sound_WAV_5")
MsgBox(8192, "Success", "You have successfully joined the " & $strDomainName & " Domain.", 5)
MsgBox(8192, "Add To Groups", "You can now add users to the Local Administrators and Power user groups.", 5)
_Add_Usr2Grp()
ElseIf $intJoinDomain = 1 Then
MsgBox(64, "Failure", "Unable to Join Computer to " & $strDomainName & " Domain." & @CRLF & _GetExitCode($intJoinDomain))
Else
MsgBox(64, "Failure", "Unable to Join Computer to " & $strDomainName & " Domain." & @CRLF & _GetExitCode($intJoinDomain))
EndIf
Next
EndFunc ;==>_DomainJoin
Func _GetExitCode($iExitCode)
Local $sLine = ''
Local $Pid = Run(@ComSpec & " /c net helpmsg " & $iExitCode, @SystemDir, @SW_HIDE, 2)
While 1
$sLine &= StdoutRead($Pid)
If @error Then ExitLoop
WEnd
Local $strErrorMessage = "ErrorCode: " & $iExitCode & " " & StringStripWS(StringStripCR($sLine), 3)
Return ($strErrorMessage)
EndFunc ;==>_GetExitCode

My Script in my opinion is working fine, all the testing I've done I had no failures on Windows 7 or XP, but our AD team are getting this error when they try. They tell me it work once on one machine and then they tested it on another few machines and got the error on all but one. I find this really strange myself. To try and reproduce their error I tried it on Windows 8 Pro and the same error appears (didn't expect it to work anyway on Windows 8 Pro so wasn't surprised to be honest).

It looks like they tested on Window 7 which was fine during all of my many tests.

Many thanks

Edited December 15, 2012 by Iceman682

[water]

Looks like your script doesn't use my AD UDF. So it's hard for me to tell you what might cause the problems.

You use different flags than I do and you have no COM error checking in your code.

Looks like error code 5 has a different meaning in your script.

I can only point you to MSDN.

[Iceman682]

Hi Water

It does use your AD UDF, it's an #include

[water]

To be more precise: You don't use function _AD_JoinDomain.

[Iceman682]

That is correct, Oh well never mind, I'll just have to give it up, Many thanks

Edited December 16, 2012 by Iceman682

[water]

Error code 5 returned by your script seems to be the following Windows Error Code: "ERROR_ACCESS_DENIED - Access is denied"

So it seems to be a permission problem.

[water]

As your script creates the computer account and then joins the computer to the domain you should:

• Check that the computer account hasn't already been created before calling your function
• Check if the computer account has been created when the error occurress
• Check if the user that joins the computer to the domain has the proper permissions
• Make sure that the computer isn't already a member of another domain (in this case you would need to set another flag)

[tarankov]

Hi Water!

Yet I haven't test the script you've shared but I have an idea that possibly will give an understanding.

Function crashes on line 2430 at module AD.au3

This is it: $oAD_Computer.Put("ntSecurityDescriptor", $oAD_SD)

But I cannot get values of this object and its properties because of lack of experience working with objects.

If I could derive object content I woluld compare values with values of proper example on donain computer.

Do you know how to do it?

Edited December 17, 2012 by tarankov

[water]

On line 2351:

Local $oAD_Computer = $oAD_Container.Create("Computer", "cn=" & $sAD_Computer)

the computer account is created - seems to work

On line 2354:

$oAD_Computer.SetInfo

two properties of the computer account (sAMAccountName and userAccountControl) are set - seems to work

On line 2430:

$oAD_Computer.SetInfo

the ntSecurityDescriptor is set - crashes

If you run the script I posted in you will get a list of permissions for all users/groups for the computer account.

Just modify this line so the script can access the computer account:

strDistinguishedName = "CN=Computername,OU=???,DC=???,DC=???"

The result will be stored in file C:\temp\Report.txt

So we can check that the user who creates the computer account has the proper permissions.

[sonicgt]

sonicgt,

can you post your _AD_Open statement or even the whole script?

I am just using the test script that comes with the UDF currently for attempting to create a computer object.

Here is my AD Open statemen (I've changed some sections to not disclose some corp info)

Using this AD Open statement I am able to move a computer object and query the domain just fine

Global $SUserID = "devusmyuser"

Global $SPassword = "mypass"

Global $SUSDNSDomain = "DC=devus,DC=mycompany,DC=com"

Global $SUSHostServer = "server1.devus.mycompany.com"

Global $SConfiguration = "CN=Configuration,DC=devus,DC=mycompany,DC=com"

; Open Connection to the Active Directory

_AD_Open($SUserId, $SPassword, $SUSDNSDomain, $SUSHostServer, $SConfiguration)

[water]

Doesn't look bad.

I'm discussing a similar problem with user tarankov right now.

Do you run your script from the PC which needs to be joined to the domain and which is not a domain member right now?

If yes, can you run the script from a PC which is already a domain member?

Which result do you get?

[sonicgt]

Doesn't look bad.

I'm discussing a similar problem with user tarankov right now.

Do you run your script from the PC which needs to be joined to the domain and which is not a domain member right now?

If yes, can you run the script from a PC which is already a domain member?

Which result do you get?

Yes I received the error when running from a PC that is not on the domain currently. I'll try from a machine that is to see what I get.

Essentially my script will be a script that is going to run on a new pc and join it to the domain. Here is some basic pseudo code

check to see if pc exists (in case of reimage of same pc)

if yes

is it in the proper OU

if yes join domain

if no move computer object and then join domain

if no

create computer in proper OU

join domain.

I know I can call powershell or netdom or something else to join the domain, which is how we are doing it today, but I'd rather keep everything in autoit and have the ability to easily call out to the same domain controller every time.

[water]

I'm very interested to see if you can create a new computer account when the script is being run from another computer in the domain.

If needed I will create a small test script to get rid of all unnecessary code.

[tarankov]

Hi Water!

I'm surely come close to understanding this problem.

I compared your scripts reports on the created by the domain computer mashine and so on created by non-domain computer. It turned out that they differ only in 9(!) records of access rights.

The very records that must be entered through AccessControlEntry in script.

I've started researching this problem.

I've commented 8 right designations to localize the problem and I think that it is localized to the lilmit.

On domain mashine during the creation the AccessControlEntry object one of properties is value of domain or something else, I'm not sure. And on non-domain mashine it not happens. Regretfully I didn't managed to list all properties of created object to compare because of lack of experience working with COM objects.

Possibly we can do it with your knowledge.

Here's the function:

expandcollapse popup

Func _AD_CreateComputer($sAD_OU, $sAD_Computer, $sAD_User)

If Not _AD_ObjectExists($sAD_OU) Then Return SetError(1, 0, 0)
If _AD_ObjectExists("CN=" & $sAD_Computer & "," & $sAD_OU) Then Return SetError(2, 0, 0)
;If Not _AD_ObjectExists($sAD_User) Then Return SetError(3, 0, 0)

If StringMid($sAD_OU, 3, 1) <> "=" Then $sAD_OU = _AD_SamAccountNameToFQDN($sAD_OU) ; sAMACccountName provided
If StringMid($sAD_User, 3, 1) = "=" Then $sAD_User = _AD_FQDNToSamAccountName($sAD_User) ; FQDN provided

ConsoleWrite('$sAD_User: ' & $sAD_User & @CRLF)

Local $oAD_Container = __AD_ObjGet("LDAP://" & $sAD_HostServer & "/" & $sAD_OU)
Local $oAD_Computer = $oAD_Container.Create("Computer", "cn=" & $sAD_Computer)

$oAD_Computer.Put("sAMAccountName", $sAD_Computer & "$")
$oAD_Computer.Put("userAccountControl", BitOR($ADS_UF_PASSWD_NOTREQD, $ADS_UF_WORKSTATION_TRUST_ACCOUNT))
$oAD_Computer.SetInfo

If @error <> 0 Then Return SetError(@error, 0, 0)

Local $oAD_SD = $oAD_Computer.Get("ntSecurityDescriptor")
Local $oAD_DACL = $oAD_SD.DiscretionaryAcl

Local $oAD_ACE1 = ObjCreate("AccessControlEntry")
$oAD_ACE1.Trustee = $sAD_User
$oAD_ACE1.AccessMask = $ADS_RIGHT_GENERIC_READ
$oAD_ACE1.AceFlags = 0
$oAD_ACE1.AceType = $ADS_ACETYPE_ACCESS_ALLOWED

Local $oAD_ACE2 = ObjCreate("AccessControlEntry")
$oAD_ACE2.Trustee = $sAD_User
$oAD_ACE2.AccessMask = $ADS_RIGHT_DS_CONTROL_ACCESS
$oAD_ACE2.AceFlags = 0
$oAD_ACE2.AceType = $ADS_ACETYPE_ACCESS_ALLOWED_OBJECT
$oAD_ACE2.Flags = $ADS_FLAG_OBJECT_TYPE_PRESENT
$oAD_ACE2.ObjectType = $ALLOWED_TO_AUTHENTICATE

Local $oAD_ACE3 = ObjCreate("AccessControlEntry")
$oAD_ACE3.Trustee = $sAD_User
$oAD_ACE3.AccessMask = $ADS_RIGHT_DS_CONTROL_ACCESS
$oAD_ACE3.AceFlags = 0
$oAD_ACE3.AceType = $ADS_ACETYPE_ACCESS_ALLOWED_OBJECT
$oAD_ACE3.Flags = $ADS_FLAG_OBJECT_TYPE_PRESENT
$oAD_ACE3.ObjectType = $RECEIVE_AS

;$oAD_ACE3.Trustee.Domain = "ad.pu.ru"
;$oAD_ACE3.SID = 'S-1-5-21-1625984058-1322545667-1880170995-25467'
;ConsoleWrite('Trustee: ' & $oAD_ACE3.Trustee.Domain & @CRLF)

Local $oAD_ACE4 = ObjCreate("AccessControlEntry")
$oAD_ACE4.Trustee = $sAD_User
$oAD_ACE4.AccessMask = $ADS_RIGHT_DS_CONTROL_ACCESS
$oAD_ACE4.AceFlags = 0
$oAD_ACE4.AceType = $ADS_ACETYPE_ACCESS_ALLOWED_OBJECT
$oAD_ACE4.Flags = $ADS_FLAG_OBJECT_TYPE_PRESENT
$oAD_ACE4.ObjectType = $SEND_AS

Local $oAD_ACE5 = ObjCreate("AccessControlEntry")
$oAD_ACE5.Trustee = $sAD_User
$oAD_ACE5.AccessMask = $ADS_RIGHT_DS_CONTROL_ACCESS
$oAD_ACE5.AceFlags = 0
$oAD_ACE5.AceType = $ADS_ACETYPE_ACCESS_ALLOWED_OBJECT
$oAD_ACE5.Flags = $ADS_FLAG_OBJECT_TYPE_PRESENT
$oAD_ACE5.ObjectType = $USER_CHANGE_PASSWORD

Local $oAD_ACE6 = ObjCreate("AccessControlEntry")
$oAD_ACE6.Trustee = $sAD_User
$oAD_ACE6.AccessMask = $ADS_RIGHT_DS_CONTROL_ACCESS
$oAD_ACE6.AceFlags = 0
$oAD_ACE6.AceType = $ADS_ACETYPE_ACCESS_ALLOWED_OBJECT
$oAD_ACE6.Flags = $ADS_FLAG_OBJECT_TYPE_PRESENT
$oAD_ACE6.ObjectType = $USER_FORCE_CHANGE_PASSWORD

Local $oAD_ACE7 = ObjCreate("AccessControlEntry")
$oAD_ACE7.Trustee = $sAD_User
$oAD_ACE7.AccessMask = $ADS_RIGHT_DS_WRITE_PROP
$oAD_ACE7.AceFlags = 0
$oAD_ACE7.AceType = $ADS_ACETYPE_ACCESS_ALLOWED_OBJECT
$oAD_ACE7.Flags = $ADS_FLAG_OBJECT_TYPE_PRESENT
$oAD_ACE7.ObjectType = $USER_ACCOUNT_RESTRICTIONS

Local $oAD_ACE8 = ObjCreate("AccessControlEntry")
$oAD_ACE8.Trustee = $sAD_User
$oAD_ACE8.AccessMask = $ADS_RIGHT_DS_SELF
$oAD_ACE8.AceFlags = 0
$oAD_ACE8.AceType = $ADS_ACETYPE_ACCESS_ALLOWED_OBJECT
$oAD_ACE8.Flags = $ADS_FLAG_OBJECT_TYPE_PRESENT
$oAD_ACE8.ObjectType = $VALIDATED_DNS_HOST_NAME

Local $oAD_ACE9 = ObjCreate("AccessControlEntry")
$oAD_ACE9.Trustee = $sAD_User
$oAD_ACE9.AccessMask = $ADS_RIGHT_DS_SELF
$oAD_ACE9.AceFlags = 0
$oAD_ACE9.AceType = $ADS_ACETYPE_ACCESS_ALLOWED_OBJECT
$oAD_ACE9.Flags = $ADS_FLAG_OBJECT_TYPE_PRESENT
$oAD_ACE9.ObjectType = $VALIDATED_SPN

;$oAD_DACL.AddAce($oAD_ACE1)
;$oAD_DACL.AddAce($oAD_ACE2)
$oAD_DACL.AddAce($oAD_ACE3)
;$oAD_DACL.AddAce($oAD_ACE4)
;$oAD_DACL.AddAce($oAD_ACE5)
;$oAD_DACL.AddAce($oAD_ACE6)
;$oAD_DACL.AddAce($oAD_ACE7)
;$oAD_DACL.AddAce($oAD_ACE8)
;$oAD_DACL.AddAce($oAD_ACE9)

$oAD_SD.DiscretionaryAcl = $oAD_DACL

$oAD_Computer.Put("ntSecurityDescriptor", $oAD_SD)
$oAD_Computer.SetInfo

If @error <> 0 Then Return SetError(@error, 0, 0)
Return 1

EndFunc ;==>_AD_CreateComputer

Also in support of my version here is description of Trustee property:

http://msdn.microsoft.com/en-us/library/system.messaging.accesscontrolentry.trustee(v=vs.90).aspx

which said the domain can be specified.

Furthermore I have an additional version. I found many errors "Security identifier has wrong structure" when it was about wrong SID declaring. In this case we do not declare it at all.

[bartekd]

One other thing I am getting is when I try to Delete User, it shows that Active Directory returned error code 0. These are the lines from the console at the same time, let me know if you can help with this.

--> COM Error Encountered in Suite_tray.au3
----> $IEComErrorScriptline = 639
----> $IEComErrorNumberHex = 80020009
----> $IEComErrorNumber = -2147352567
----> $IEComErrorWinDescription =
----> $IEComErrorDescription = The directory property cannot be found in the cache.
----> $IEComErrorSource = Active Directory
----> $IEComErrorHelpFile =
----> $IEComErrorHelpContext = 0
----> $IEComErrorLastDllError = 0

--> COM Error Encountered in Suite_tray.au3
----> $IEComErrorScriptline = 2589
----> $IEComErrorNumberHex = 80020009
----> $IEComErrorNumber = -2147352567
----> $IEComErrorWinDescription = An invalid dn syntax has been specified.
----> $IEComErrorDescription =
----> $IEComErrorSource =
----> $IEComErrorHelpFile =
----> $IEComErrorHelpContext = 0
----> $IEComErrorLastDllError = 0

[water]

I wonder why you use the IE COM error handler. The AD UDF has it's own handler which returns a lot of additional useful information.

[water]

Which version of the AD UDF do you use?

Lines 639 and 2589 are comments or empty lines in the latest version.

[ICANSEEYOU7687]

When you open a connection to AD, is the information sent in plain text?