Active Directory UDF - Help & Support

[Prophet]

Hee water,

Been reading trough the source last few days, looking good!.

Did find one typo

line 371

$sAD_Temp2 = "LDAPSEARCH.EXE could not be found. No extended ebugging possible!"

This should ofcourse be debugging

[water]

Hi Prophet,

thanks for scanning and proof reading the source!

Hope this is the one and only bug you find

Have a nice weekend

Water

[mrwb]

I had not looked for AD functions here for a while. I am very glad to see that the work is being done to make this an official UDF. I am delegating authority to some of my supervisors so they can reset passwords and unlock accounts. I am using the _AD_GetObjectsInOU(), _AD_UnlockObject(), and _AD_SetPassword() in a quick util to manage this for them. I am using version 0.39 for AD.udf and AutoIT version 3.3.6.0

I am having a problem with _AD_UnlockObject(). It runs fine for me as a Domain Admin but when I run it as a supervisor with delegated rights, it fails. I get error code -2147352567 returned from the function. I see that it modifies UAC. If I delegate rights to UAC then that would include rights for changing other properties as well such as password never expires. I have created a custom MMC console for these users and using that console does allow them to process the unlock change for the user account. They can also use "net user <name> /domain /active:yes" from a DOS prompt to unlock an account. This indicates that there should be another way to change the lockout status instead of changing UAC.

Also, the _AD_IsObjectLocked() function does work correctly for these users and does return the proper number of minutes remaining for the lockout.

Here is the specific code I am using to unlock:

Func UnlockUser()
    $SUserID1 = GUICtrlRead($lst_User)
    If _AD_UnlockObject($SUserID1) Then
        GUICtrlSetData($Edit_User, "User " & $SUserID1 & " unlocked." & @CRLF,1)
    Else
        GUICtrlSetData($Edit_User, "An error occurred unlocking user " & $SUserID1 & " : error code " & @error & @CRLF,1)
    EndIf
EndFunc

-update... I knew I had seen some other code on this. A previous example script on active dir that I found used this code. I just tested it and it works for my supervisor user with delegated rights.

$UserObj = ObjGet("LDAP://" & $strUserDN)
If $UserObj.IsAccountLocked Then
                $UserObj.IsAccountLocked = False
                $UserObj.SetInfo
                MsgBox(0, 'INFO', "User Account was Unlocked. It will take approximately 5 mins to reflect this change.")

Edited July 14, 2010 by mrwb

[water]

Thanks for posting your findings!

I will have a look at it and change it in the upcoming version 0.40.

[water]

I am having a problem with _AD_UnlockObject(). It runs fine for me as a Domain Admin but when I run it as a supervisor with delegated rights, it fails. I get error code -2147352567 returned from the function. I see that it modifies UAC. If I delegate rights to UAC then that would include rights for changing other properties as well such as password never expires. I have created a custom MMC console for these users and using that console does allow them to process the unlock change for the user account. They can also use "net user <name> /domain /active:yes" from a DOS prompt to unlock an account. This indicates that there should be another way to change the lockout status instead of changing UAC.

-update... I knew I had seen some other code on this. A previous example script on active dir that I found used this code. I just tested it and it works for my supervisor user with delegated rights.

$UserObj = ObjGet("LDAP://" & $strUserDN)
If $UserObj.IsAccountLocked Then
 $UserObj.IsAccountLocked = False
 $UserObj.SetInfo
 MsgBox(0, 'INFO', "User Account was Unlocked. It will take approximately 5 mins to reflect this change.")

I changed the function as you suggested:

; #FUNCTION# ====================================================================================================================
; Name...........: _AD_UnlockObject
; Description ...: Unlocks an AD object (user account, computer account).
; Syntax.........: _AD_UnlockObject($sAD_Object)
; Parameters ....: $sAD_Object - User account or computer account to unlock (sAMAccountName or FQDN)
; Return values .: Success - 1
;   Failure - 0, sets @error to:
;   |1 - $sAD_Object does not exist
;   |x - Error returned by SetInfo function (Missing permission etc.)
; Author ........: Thomas Rupp
; Modified.......:
; Remarks .......:
; Related .......: _AD_IsObjectLocked, _AD_LockObject, _AD_GetObjectsLocked
; Link ..........: http://www.rlmueller.net/Programs/IsUserLocked.txt
; Example .......: Yes
; ===============================================================================================================================
Func _AD_UnlockObject($sAD_Object)

    If Not _AD_ObjectExists($sAD_Object) Then Return SetError(1, 0, 0)
    If StringMid($sAD_Object, 3, 1) <> "=" Then $sAD_Object = _AD_SamAccountNameToFQDN($sAD_Object) ; sAMAccountName provided
    Local $oAD_Object = _AD_ObjGet("LDAP://" & $sAD_HostServer & "/" & $sAD_Object)
    $oAD_Object.IsAccountLocked = False
    $oAD_Object.SetInfo
    If @error <> 0 Then Return SetError(@error, 0, 0)
    Return 1

EndFunc ;==>_AD_UnlockObject

Does this work for you?

[water]

Version 0.40 has been released.

For download please see signature.

[water]

Version 0.41 has been released.

For download please see signature.

[water]

Hello,

Ive been trying to get a scipt working today (http://www2.truman.edu/~whowd/blog/files/JoinDomain.au3) but I just cant seem to understand why it wont work. The first part works fine when it ask for the domain user name and password (i have edited the varibles in the script to match my domain) but then it just gives me the error: variable used without being declared. Below is the troublesome line:

$joinDomainGUI = GUICreate($guiWindowTitle,$guiWidth,$guiHeight,-1,-1,BitOr($WS_MINIMIZEBOX,$WS_MAXIMIZEBOX,$WS_GROUP,$WS_CAPTION,$WS_POPUP,$WS_SYSMENU))

Can anyone point me in the right direction?

I did at first think it was the BitOr that should have been BitOR but that didnt make a difference...........

Can anyone point me in the right direction?

Many Thanks

I think it's easier to create your own script then to modify a script that has been written for a certain environment.

Use the Active Directory UDF (for download please see my signature), create a GUI and there you are.

Function _AD_JoinDomain is (nearly) all you need.

Edited November 16, 2010 by water

[lordrobe]

Hi there,

i try programming a script to add Users into the Active Directory from an Excel Sheet.

My problem is, when i add the "SAMAccountName manually, the script works fine. But when i read the SAM Name from the array, i get the error

"Com Error"

Scriptline: 2056

Numberhex: 80004005

Number: -2147467259

Here is my Code

expandcollapse popup

; Liest aus einer Excel Tabelle Daten AD Accounts herraus

#include <Array.au3>
#include <Excel.au3>
#include <AD.au3>


;;;Datei Öffnen
;soll die Datei unsichtbar geöffnet werden?
$sichtbar = 0
;Dateipfad; wird noch verscriptet
$exceldatei = "D:\Meldung_1kp.xls"
;Handler der geöffneten Datei
$dateivariable = _ExcelBookOpen($exceldatei,$sichtbar)
;zuerst wollen wir die Nutzer auslesen, das Worksheet heißt "Nutzer"
$worksheet = "Nutzer"

;Worksheet aktivieren, falls jemand das falsche Offen hatte und Gespeichert hat
_ExcelSheetActivate($dateivariable, $worksheet)

;Spalten in Array lesen
$anutzer = _ExcelReadSheetToArray($dateivariable,2,1,0,0,False) ;Direction is Vertical


;schliessen
_ExcelBookClose($dateivariable)

;debug infos
_ArrayDisplay($anutzer,"Nutzer")

 

 #comments-start
 Der 1. Teil ist abgearbeitet, wir haben nun alle Nutzer mit Daten als Array, jetzt kommt die Erstellung im ActiveDirectory
 
 #comments-End
 
 ;AD Variablen
$sAD_UserIdParam = "domain\ad"
$sAD_PasswordParam = "password"
$sAD_HostServerParam = "donau.domain.skb"
$sAD_DNSDomainParam = "DC=domain,DC=skb"
$sAD_ConfigurationParam = "DC=donau,DC=domain,DC=skb"
;ou wo der Nutzer angelegt werden soll
$ou = "OU=test,OU=Nutzer,OU=secret,DC=domain,DC=skb"
;AD Verbindung Öffnen
_AD_Open($sAD_UserIdParam, $sAD_PasswordParam, $sAD_DNSDomainParam, $sAD_HostServerParam, $sAD_ConfigurationParam)

 

;Alle Nutzer aus der Excel Tabelle ins AD eintragen

For $i = 0 To UBound($anutzer) -1   ; $i = Element 1 (Index=0) bis Zeilen (Index= Zeilen -1)
 
 $zeiger = $i+1
 $personalnummer = $anutzer[$zeiger][1]
 $nachname = $anutzer[$zeiger][2]
 $vorname = $anutzer[$zeiger][3]


;Beispiel einer AD Nutzererstellung in der OU Test
;_AD_CreateUser("OU=test,OU=Nutzer,OU=secret,DC=domain,DC=skb", 11033496, "Hans Maulwurf")
;SCHARF

_AD_CreateUser($ou, $personalnummer, $vorname & " " & $nachname)


ConsoleWrite(@error & @CRLF)

;Msgbox(0,"",$vorname &  " " & $nachname & $personalnummer)
 Next
;_AD_ModifyAttribute(11033496, "Common-Name","10101010")

 

 

; MUSS IMMER SEIN!!!!
_AD_Close()

The users are created in the AD, and the Attributes are Correct, but under the "Pre Win 2000 Logonname" is something wrong and the field is filled with random stuff like : $8270000-CP003VQUE4E2 instead "Personalnummer"

The Excel file is build like

Personalnummer | Name | Vorname (Surname)

1111111 | Autoit | Mike

Edited November 24, 2010 by lordrobe

[water]

That's not easy 0x80004005 means "Unbekannter Fehler" (unknown error). That could be everything!

The line raising the error is

$oAD_User.sAMAccountName = $sAD_User

so it seems to be related to the SamAccountName.

Could you please insert the following line before your call to _AD_CreateUser and post the result?

ConsoleWrite("OU: *" & $ou & "*, SAM: *" & $personalnummer & "*, Vorname: *" & $vorname & "*, Nachname: *" &  $nachname & "*" & @CRLF)

NB: _AD_CreateUser only sets sAMAccountName (= $sAD_User) and userPrincipalName (e.g. $sAD_User@microsoft.com). All other attributes have to be set using function _AD_ModifyAttribute

Edited November 24, 2010 by water

[lordrobe]

That's not easy 0x80004005 means "Unbekannter Fehler" (unknown error). That could be everything!

The line raising the error is

$oAD_User.sAMAccountName = $sAD_User

so it seems to be related to the SamAccountName.

Could you please insert the following line before your call to _AD_CreateUser and post the result?

ConsoleWrite("OU: *" & $ou & "*, SAM: *" & $personalnummer & "*, Vorname: *" & $vorname & "*, Nachname: *" &  $nachname & "*" & @CRLF)

NB: _AD_CreateUser only sets sAMAccountName (= $sAD_User) and userPrincipalName (e.g. $sAD_User@microsoft.com). All other attributes have to be set using function _AD_ModifyAttribute

Hi, thank you for the fast reply, here is the console output you requested

>"D:\autoit\install\SciTe\..\autoit3.exe" /ErrorStdOut "D:\excel-ad.au3"    
OU: *OU=test,OU=Nutzer,OU=secret,DC=domain,DC=skb*, SAM: *11033496*, Vorname: *Hans*, Nachname: *Maulwurf*

Edited November 24, 2010 by lordrobe

[water]

I think the problem is related to the SamAccountName consisting of numbers only. AutoIT stores it as Int32 but _AD_CreateUser requires the SamAccountName to be a string.

Please change

_AD_CreateUser($ou, $personalnummer, $vorname & " " & $nachname)

to

_AD_CreateUser($ou, String($personalnummer), $vorname & " " & $nachname)

Edited November 24, 2010 by water

[lordrobe]

That was exactly the problem! Now it work's fine.Thank you for your fast reply

[water]

[water]

Hi Friends,

Once again i struck with AD Functionalities. Here now i am facing problem that i am unable to find the owner name for the specific ID. i tried to use most of the relevent functions which ever mentioned in AD.au3. but i am unable to find the exact funtion. Could you please some one help me on this?

#include <AD.au3>

; Open Connection to the Active Directory

_AD_Open()

; Get the Fully Qualified Domain Name (FQDN) for the current user

$sFQDN_User = _AD_SamAccountNameToFQDN(@UserName)

$cp = _AD_FQDNToDisplayname($sFQDN_User)

MsgBox(0,"",$cp)

_AD_Close()

What do you mean by "owner name"? Do you want the Manager (attribute "managedBy") of a user, computer or group? Edited November 25, 2010 by water

[Syed23]

What do you mean by "owner name"? Do you want the Manager (attribute "managedBy") of a user, computer or group?

I am sorry for the mis communication!. For example i have ID(F12345) in a domain. so the owner name or display name of the Id will be my name (Syed Ibrahim). i want to get this information. Am i making sense?

[water]

I am sorry for the mis communication!. For example i have ID(F12345) in a domain. so the owner name or display name of the Id will be my name (Syed Ibrahim). i want to get this information. Am i making sense?

Yes, that makes sense.

I tried your code for my userid and it works great. The "displayName" is just an attribute of an user account. As it is not mandatory it might be missing in your case.

Could you please download Sysinternals (now M$) "Active Directory Explorer" and check the attributes set for your account?

The Active Directory Explorer doesn't have to be installed, just run it.

Search -> Search Container. Set Class to "user", Attribute to "samaccountname", Relation to "is" and Value to "F12345", click "Add" and then "Search".

Doubleclick on the search result at the bottom of the window.

Check the displayed attributes of your user account. Is "Displayname" empty?

EDIT: Even easier. Run the _AD_GetObjectProperties.au3 example script. The first output will display all properties of the currently logged in user. Are the attributes "name" and "displayname" set?

Edited November 25, 2010 by water

[Syed23]

Yes, that makes sense.

I tried your code for my userid and it works great. The "displayName" is just an attribute of an user account. As it is not mandatory it might be missing in your case.

Could you please download Sysinternals (now M$) "Active Directory Explorer" and check the attributes set for your account?

The Active Directory Explorer doesn't have to be installed, just run it.

Search -> Search Container. Set Class to "user", Attribute to "samaccountname", Relation to "is" and Value to "F12345", click "Add" and then "Search".

Doubleclick on the search result at the bottom of the window.

Check the displayed attributes of your user account. Is "Displayname" empty?

EDIT: Even easier. Run the _AD_GetObjectProperties.au3 example script. The first output will display all properties of the currently logged in user. Are the attributes "name" and "displayname" set?

Thanks ! it works for me but i am facing a problem now. the below script works fine for me but i am unable to display or write in a text file except using _Arraydisplay

#include <AD.au3>

#include <File.au3>

; Open Connection to the Active Directory

_AD_Open()

Global $aProperties,$username

$username = InputBox("","","")

; *****************************************************************************

; Example 1

; Displays properties for the current user

; *****************************************************************************

$aProperties = _AD_GetObjectProperties($username, "displayName")

_ArrayDisplay($file,$aProperties,0)

_AD_Close()

[water]

Your _ArrayDisplay line is wrong. Please use:

_ArrayDisplay($aProperties)

[Syed23]

Your _ArrayDisplay line is wrong. Please use:

_ArrayDisplay($aProperties)

I understand. But that is the problem. only i am able to dislpay those details as array not as a msgbox ? is there any other way to display in message box or can we save that data in a variable? Edited November 30, 2010 by Syed23