Active Directory UDF - Help & Support

[AdamUL]

Try Using _ArrayToString to put it in a Message Box.

$sProperties = _ArrayToString($aProperties, @CRLF)
MsgBox(0, "Current User Properties", $sProperties)

Adam

[SpinningCone]

Hey i needs ome help. i'm runnign a simple script using the AD udf but it keeps crashing

the script just runs through and checks the description field on a list of IDs i have in a text file. the meat of the code is here:

;get the description field of the current ID
                        $description = _AD_GetObjectProperties($currentID,"description")
            ;check to see if it contains #resc# and that the ID is enabled. 
            if not _AD_IsObjectDisabled($description) and StringInStr ($description, "#resc#",0) = 0 Then
                
                                ConsoleWrite($currentPID &" - Bad" &  @crlf)
                                ;write the bad users to a file
                FileWriteLine($baduserlog,$currentID )
                Else
                ConsoleWrite($currentPID &" - good" &  @crlf)
            endif

it runes. and works but will hang then crash with this error

C:\Program Files (x86)\AutoIt3\Include\AD.au3 (1902) : ==> Object referenced outside a "With" statement.:

Local $sAD_LDAPEntry = $oAD_RecordSet.fields(0).value

Local $sAD_LDAPEntry = $oAD_RecordSet.fields(0)^ ERROR

cant seem to figure out why.

Edited December 7, 2010 by SpinningCone

[BrewManNH]

The function _AD_GetObjectProperties returns a 2D array, the way you're checking it won't work. You'd need to check the second dimension of $description for what you're looking for.

if not _AD_IsObjectDisabled($description[0][0]) and StringInStr ($description[0][0], "#resc#",0) = 0 Then

This may not be accurate as I haven't tested the AD functions and what the return array looks like. You can see what the return value would be, like this.

$description = _AD_GetObjectProperties($currentID,"description")
_ArrayDisplay($description)

This will show you what is contained in the array $description and then you can change the If statement accordingly. You'll need to add #Include <Array.au3> at the top of your script to get _ArrayDisplay to be available.

[SpinningCone]

The function _AD_GetObjectProperties returns a 2D array, the way you're checking it won't work. You'd need to check the second dimension of $description for what you're looking for.

if not _AD_IsObjectDisabled($description[0][0]) and StringInStr ($description[0][0], "#resc#",0) = 0 Then

This may not be accurate as I haven't tested the AD functions and what the return array looks like. You can see what the return value would be, like this.

$description = _AD_GetObjectProperties($currentID,"description")
_ArrayDisplay($description)

This will show you what is contained in the array $description and then you can change the If statement accordingly. You'll need to add #Include <Array.au3> at the top of your script to get _ArrayDisplay to be available.

the array is one dimensional. if it werent it would always fail. plus iv'e checked the array with _ArrayDisplay. i do have #Include <Array.au3> in the script.

previously it seemed to be failing randomly now it seems to fail on specific IDs, though interesting if i remove the ID the script still slows down around the same line in the ID file.

[water]

Shouldn't

if not _AD_IsObjectDisabled($description) and StringInStr ($description, "#resc#",0) = 0 Then

be

if not _AD_IsObjectDisabled($currentID) and StringInStr ($description, "#resc#",0) = 0 Then

because you want to check the userid being disabled or not.

[SpinningCone]

Shouldn't

if not _AD_IsObjectDisabled($description) and StringInStr ($description, "#resc#",0) = 0 Then

be

if not _AD_IsObjectDisabled($currentID) and StringInStr ($description, "#resc#",0) = 0 Then

because you want to check the userid being disabled or not.

lol indeed. though it appears that part of the IF was just being skipped since it was still pulling out the accounts who didn't match the description field. still fails when i change it (or remove the disable check entirely)

the failure point is definitely $description = _AD_GetObjectProperties($currentPID,"description")

i'm wondering if this is a network issue. when the script runs it sometimes hangs. when it hangs my browsers won't connect

[water]

the failure point is definitely $description = _AD_GetObjectProperties($currentPID,"description")

But in your example code the "P" of "$currentPID" is missing.

Could you please insert the line

ConsoleWrite(@error & @CRLF)

after _AD_GetObjectProperties and post the result?

[BrewManNH]

The return from _AD_GetObjectProperties($currentPID,"description") is an array (whether it's 1D or 2D is unimportant), so if you check it with if not _AD_IsObjectDisabled($description) won't the test always result in it being equal to 0 so the test will always test as True?

[water]

True, but the line number of 1902 shows that the error occurres in function _AD_GetObjectProperties.

I assume that you're using the latest version.

[SpinningCone]

True, but the line number of 1902 shows that the error occurres in function _AD_GetObjectProperties.

I assume that you're using the latest version.

sorry for some descrepancies i was changing my variables a bit to make them more readable.

i have modified the function to the code below. this causes the same error. i also tried adding a sleep(400) in front of the get properties and it still crashes.

#include <array.au3>
#include <AD.au3>
#include <File.au3>

_AD_Open()
$file = FileOpen("users.txt",0)
$baduserlog = FileOpen("bad users.txt",10)

While 1
        $currentID = FileReadLine($file)
        If @error = -1 Then
            consoleWrite("OH noes bad read!!!!" &  @crlf)
            Exitloop
            endif

                $description = _AD_GetObjectProperties($currentID,"description[1][1]")

            if StringInStr ($description[1][1], "#resc#",0) = 0 Then
            ConsoleWrite($currentPID &" - Good" &  @crlf)
            
        Else
            ConsoleWrite($currentPID &" - Bad" &  @crlf)
                        FileWriteLine($baduserlog,$currentPID )
        endif
        

wend

_AD_Close()

EDIT: 2 things

1 - OK im an idiot it *IS* a 2d array. i fixed that

2 - it doesnt matter. the thing still breaks.. so i added an error line after _AD_GetObjectProperties , no help since it crashes inside the AD UDF. so i added an error line inside the UDF right before line 1902.. the error code is -2147352567

and frack if i know what that means.

Edited December 7, 2010 by SpinningCone

[water]

I've rearranged the script a bit. Could you please run the script from within SciTE and post the results?

#include <AD.au3>
#include <array.au3>
#include <File.au3>

_AD_Open()
$file = FileOpen("users.txt", 0)
$baduserlog = FileOpen("bad users.txt", 10)
While 1
    $currentID = FileReadLine($file)
    ConsoleWrite("$currentID: " & $currentID & "<" & @CRLF)
    If @error = -1 Then
        ConsoleWrite("OH noes bad read!!!!" & @CRLF)
        ExitLoop
    EndIf
    $description = _AD_GetObjectProperties($currentID, "description")
    ConsoleWrite("Error: " & @error & ", IsArray: " & IsArray($description) & @CRLF)
    If StringInStr($description, "#resc#", 0) = 0 Then
        ConsoleWrite($currentID & " - Good" & @CRLF)
    Else
        ConsoleWrite($currentID & " - Bad" & @CRLF)
        FileWriteLine($baduserlog, $currentID)
    EndIf
WEnd
_AD_Close()

Edit: -2147352567 is decimal for 80020009 hex. This means ... general error

Could you please insert line

$iAD_Debug = 2

after the _AD_Open call. So you get a message box for every COM error. Edited December 7, 2010 by water

[SpinningCone]

Edit: -2147352567 is decimal for 80020009 hex. This means ... general error

Could you please insert line

$iAD_Debug = 2

after the _AD_Open call. So you get a message box for every COM error.

COM Error Encountered test.au3

scriptline = 1901

NumberHex = 80020009

Number = -2147352567

WinDescription =

Description = The server is not operational

Source = Active Directory

HelpFile = 0

Help COntect = 0

LastDllError = 0

ok thanks. this confirms what i was beginning to suspect. for some reason the AD calls are causing a network issue this causes the $oAD_Connection.Execute($sAD_Query) to fail and $oAD_RecordSet.fields(0).value to be empty

not sure what it is about the AD connection over my other DB connections but it bogs down then fails

Guess I'll have to go back to powershell which doesn't have the same problem. thanks for the help everyone.

[water]

• How many records do you have in your input file?
• How many users do you have in your AD?
• On which record number does the script fail?

Most of the time if you insert a sleep(100) or sleep(200) in your loop the problem goes away.

What I would do is:

• read all records from the AD into an array and then compare against your file

So you don't put too much load onto your domain controller.

[SpinningCone]

• How many records do you have in your input file?
• How many users do you have in your AD?
• On which record number does the script fail?

Most of the time if you insert a sleep(100) or sleep(200) in your loop the problem goes away.

What I would do is:

• read all records from the AD into an array and then compare against your file

So you don't put too much load onto your domain controller.

7000 but it fails between 100 and 800

sleep(400) didnt help. i could try slower but then it takes to long to run the rocordset.

I was just messing with that. $aProperties = _AD_GetObjectsInOU("","(description=#resc#*)",2,"sAMAccountName") works pretty well in giving me a good array. though i'm not sure how to tell if an account is disabled without running _AD_IsObjectDisabled($ID) on each line, i have found this to be very slow.

my first response is to use _AD_GetObjectsDisabled() and then do an comparison between getOBjects and the getobjectsDisabled arrays but looks like _AD_GetObjectsDisabled() is broken:

_AD_Open()
$aProperties = _AD_GetObjectsDisabled()
_ArrayDisplay($aProperties)
_AD_Close()

that code returns this error

C:\Program Files (x86)\AutoIt3\Include\AD.au3 (1699) : ==> Array variable has incorrect number of subscripts or subscript dimension range exceeded.:

$aAD_FQDN[$iCount1] = $oAD_RecordSet.Fields(0).Value

ive looked at he code and cant figure out why its borked out of the box.

Edited December 7, 2010 by SpinningCone

[water]

_AD_GetObjectsDisabled works fine here. Did you try the example script?

What should work for you is the following.

_AD_Open()
$array = _AD_GetObjectsInOU("", "(&(objectcategory=user)(description=#resc#*)(userAccountControl:1.2.840.113556.1.4.803:=" & $ADS_UF_ACCOUNTDISABLE & "))", 2, "distinguishedname,description")
_ArrayDisplay($array)
_AD_Close()

The script returns all disabled users with a description starting with #resc#

Edited December 7, 2010 by water

[SpinningCone]

_AD_GetObjectsDisabled works fine here. Did you try the example script?

What should work for you is the following.

_AD_Open()
$array = _AD_GetObjectsInOU("", "(&(objectcategory=user)(description=#resc#*)(userAccountControl:1.2.840.113556.1.4.803:=" & $ADS_UF_ACCOUNTDISABLE & "))", 2, "distinguishedname,description")
_ArrayDisplay($array)
_AD_Close()

The script returns all disabled users with a description starting with #resc#

ok that works fine.

copy paste from the example

; Open Connection to the Active Directory
_AD_Open()

Global $aDisabled[1]
; *****************************************************************************
; Example 1
; Get a list of disabled accounts
; *****************************************************************************
$aDisabled = _AD_GetObjectsDisabled()
If @error > 0 Then
    MsgBox(64, "Active Directory Functions - Example 1", "No disabled user accounts could be found")
Else
    _ArrayDisplay($aDisabled, "Active Directory Functions - Example 1 - Disabled User Accounts")
EndIf

i get the same error as before. i think it might be because we have too many objects in AD though the array should be able to take millions. i will modify what you posted to determine disabled status.

[water]

C:\Program Files (x86)\AutoIt3\Include\AD.au3 (1699) : ==> Array variable has incorrect number of subscripts or subscript dimension range exceeded.:

$aAD_FQDN[$iCount1] = $oAD_RecordSet.Fields(0).Value

What version of the AD UDF do you use (please see line 11 in the UDF)? In version 0.41 (the latest) the line number is off by 1. Edited December 7, 2010 by water

[water]

Could you please run this modified version of _AD_GetObjectsdisabled and post the results?

#include <AD.au3>

_AD_Open()
Global $aDisabled[1]
$aDisabled = _AD_GetObjectsDisabledEX()
If @error > 0 Then
    MsgBox(64, "Active Directory Functions - Example 1", "No disabled user accounts could be found")
Else
    _ArrayDisplay($aDisabled, "Active Directory Functions - Example 1 - Disabled User Accounts")
EndIf
_AD_Close()

Func _AD_GetObjectsDisabledEX($sAD_Class = "user")

    If $sAD_Class <> "user" And $sAD_Class <> "computer" Then Return SetError(1, 0, "")
    Local $sAD_Query = "<LDAP://" & $sAD_HostServer & "/" & $sAD_DNSDomain & ">;(&(objectcategory=" & $sAD_Class & ")(userAccountControl:1.2.840.113556.1.4.803:=" & _
            $ADS_UF_ACCOUNTDISABLE & "));distinguishedName;subtree"
    Local $oAD_RecordSet = $oAD_Connection.Execute($sAD_Query)
    ConsoleWrite("Execute: " & @error & "-" & IsObj($oAD_RecordSet) & @CRLF)
    ConsoleWrite("RecordCount: " & $oAD_RecordSet.RecordCount & @CRLF)
    Local $aAD_FQDN[$oAD_RecordSet.RecordCount + 1]
    $aAD_FQDN[0] = $oAD_RecordSet.RecordCount
    Local $iCount1 = 1
    While Not $oAD_RecordSet.EOF
        $aAD_FQDN[$iCount1] = $oAD_RecordSet.Fields(0).Value
        $iCount1 += 1
        $oAD_RecordSet.MoveNext
    WEnd
    Return $aAD_FQDN

EndFunc   ;==>_AD_GetObjectsDisabledEX

[SpinningCone]

Could you please run this modified version of _AD_GetObjectsdisabled and post the results?

#include <AD.au3>

_AD_Open()
Global $aDisabled[1]
$aDisabled = _AD_GetObjectsDisabledEX()
If @error > 0 Then
    MsgBox(64, "Active Directory Functions - Example 1", "No disabled user accounts could be found")
Else
    _ArrayDisplay($aDisabled, "Active Directory Functions - Example 1 - Disabled User Accounts")
EndIf
_AD_Close()

Func _AD_GetObjectsDisabledEX($sAD_Class = "user")

    If $sAD_Class <> "user" And $sAD_Class <> "computer" Then Return SetError(1, 0, "")
    Local $sAD_Query = "<LDAP://" & $sAD_HostServer & "/" & $sAD_DNSDomain & ">;(&(objectcategory=" & $sAD_Class & ")(userAccountControl:1.2.840.113556.1.4.803:=" & _
            $ADS_UF_ACCOUNTDISABLE & "));distinguishedName;subtree"
    Local $oAD_RecordSet = $oAD_Connection.Execute($sAD_Query)
    ConsoleWrite("Execute: " & @error & "-" & IsObj($oAD_RecordSet) & @CRLF)
    ConsoleWrite("RecordCount: " & $oAD_RecordSet.RecordCount & @CRLF)
    Local $aAD_FQDN[$oAD_RecordSet.RecordCount + 1]
    $aAD_FQDN[0] = $oAD_RecordSet.RecordCount
    Local $iCount1 = 1
    While Not $oAD_RecordSet.EOF
        $aAD_FQDN[$iCount1] = $oAD_RecordSet.Fields(0).Value
        $iCount1 += 1
        $oAD_RecordSet.MoveNext
    WEnd
    Return $aAD_FQDN

EndFunc   ;==>_AD_GetObjectsDisabledEX

i'm using 0.41 the line number might be off because iw as already trying to trouble shoot the problem. i added this line to the UDF ConsoleWrite($oAD_RecordSet.RecordCount & @CRLF & @CRLF& @CRLF ) i put it at 1695 to try and see how many records where in there since it looks like an out of range error. looks like we had similar ideas.

running your snippet i get

Execute: 0-1

RecordCount: 960

C:\Program Files (x86)\AutoIt3\Include\AD tests.au3 (105) : ==> Array variable has incorrect number of subscripts or subscript dimension range exceeded.:

$aAD_FQDN[$iCount1] = $oAD_RecordSet.Fields(0).Value

^ ERROR

[water]

Looks quite good so far. There must be a discrepancy between the number of records returned and $oAD_RecordSet.RecordCount.

Could you please run this modified version? It writes a line for every record (in your case 960) and will show us the record number and the record content where it fails:

#include <AD.au3>

_AD_Open()
Global $aDisabled[1]
$aDisabled = _AD_GetObjectsDisabledEX()
If @error > 0 Then
    MsgBox(64, "Active Directory Functions - Example 1", "No disabled user accounts could be found")
Else
    _ArrayDisplay($aDisabled, "Active Directory Functions - Example 1 - Disabled User Accounts")
EndIf
_AD_Close()

Func _AD_GetObjectsDisabledEX($sAD_Class = "user")

    If $sAD_Class <> "user" And $sAD_Class <> "computer" Then Return SetError(1, 0, "")
    Local $sAD_Query = "<LDAP://" & $sAD_HostServer & "/" & $sAD_DNSDomain & ">;(&(objectcategory=" & $sAD_Class & ")(!userAccountControl:1.2.840.113556.1.4.803:=" & _
            $ADS_UF_ACCOUNTDISABLE & "));distinguishedName;subtree"
    Local $oAD_RecordSet = $oAD_Connection.Execute($sAD_Query)
    ConsoleWrite("Execute: " & @error & "-" & IsObj($oAD_RecordSet) & @CRLF)
    ConsoleWrite("RecordCount: " & $oAD_RecordSet.RecordCount & @CRLF)
    Local $aAD_FQDN[$oAD_RecordSet.RecordCount + 1]
    $aAD_FQDN[0] = $oAD_RecordSet.RecordCount
    Local $iCount1 = 1
    While Not $oAD_RecordSet.EOF
        ConsoleWrite($iCount1 & ":" & $oAD_RecordSet.Fields(0).Value & @CRLF)
        $aAD_FQDN[$iCount1] = $oAD_RecordSet.Fields(0).Value
        $iCount1 += 1
        $oAD_RecordSet.MoveNext
    WEnd
    Return $aAD_FQDN

EndFunc   ;==>_AD_GetObjectsDisabledEX

I've noticed a problem with the way the query is executed. It only returns a max of 1000 records.

I might have to change the way the function works

Edited December 7, 2010 by water