Active Directory: Error moving more than 124 objects (_AD_MoveObject)

[CheWalter]

Water,

First of all thank you for your AD functions, they are OUTSTANDING!!.

Now my question: I'm running a simple script that move users from one OU (DisabledUsers) to another OU (ToBeDeleted). It works fine for the first 124 objects, then it gives me errors. I'm including the script, but I think the "124" is the key.

I moved the first 124, then I did it with the following 124 and it works, but I can not process more the 124 at the time. I have thousands to move, so moving 124 at the time it will be painful.

Is anything obvious that I don't see?

Thank you for your time.

Walter

[BrewManNH]

I don't see your script.

[CheWalter]

Mmm, I attached it but it is not there. Here it is:

; ============================================================================

; Move all users in a file from one OU to another one

; By Walter 7/11/12

; ============================================================================

#include <AD.au3>

#include<File.au3>

; ----------------------------------------------------------------------------

; Ask the user to select the input file (must exist, can not be created at this time)

$InputFile = FileOpenDialog("File with users to be deleted", @ScriptDir, "Text files (*.txt)", 1 + 2)

; Check for ESC or cancel button

If @error Then Exit

; check if file exist (redundant, fileopendialog alredy have the 1+2

If FileExists($InputFile) Then

$file = FileOpen($InputFile, 0)

Else

MsgBox(0, "Error", "File " & $InputFile & " doesn't exist")

Exit

EndIf

; ----------------------------------------------------------------------------

$OutputPath = @ScriptDir & "DeletedUsers"

$SleepTime = 200

$DeletedUsersOU = "OU=Deleted,OU=Disabled,DC=ThisDomain,DC=ORG"

; ----------------------------------------------------------------------------

; No need to modify anything after this line

; ----------------------------------------------------------------------------

; ----------------------------------------------------------------------------

; Open Connection to the Active Directory

_AD_Open()

; ----------------------------------------------------------------------------

While 1

; $file should be separated by tabs with 3 columns; something like this:

; User ID FQDN lastLogonTimestamp

; Administrator "CN=Administrator,CN=Users,DC=ThisDomain,DC=ORG" 08/16/2012 11:40

$line = FileReadLine($file)

If @error = -1 Then

; Found EOF

ExitLoop

EndIf

; ----------------------------------------------------------------------------

$MyArray = StringSplit($line, @TAB)

; If something is wrong, exit

If @error Then Exit

$MyUserID = $MyArray[1]

$MyUserFQDN = StringReplace($MyArray[2], Chr(34), "")

; Not in use right now: $MyLastLogon = $MyArray[3]

; ----------------------------------------------------------------------------

If _AD_ObjectExists($MyUserFQDN) Then

; Get Full/Display name

$DispName = _AD_FQDNToDisplayname($MyUserFQDN)

If _AD_MoveObject($DeletedUsersOU, $MyUserFQDN) Then

; Show a message

ToolTip($MyUserFQDN, 0, 0, "Moved: ")

; Get info to include in the output file

$UserAllGroups = _AD_GetUserGroups($MyUserID)

$UserAllGroups[0] = $DispName

; Create a file with the UserID as the name

$OutputFile = FileOpen($OutputPath & $MyUserID & ".txt", 10)

; Include the user name and all the group membership in the file

_FileWriteFromArray($OutputFile, $UserAllGroups, 0)

FileClose($OutputFile)

; Just in case, wait for the file to be written on the disk

Sleep($SleepTime)

Else

; Something went wrong. Show a message

MsgBox(0, "Error moving", $MyUserFQDN & ": " & @error)

ToolTip($MyUserFQDN, 0, 0, "Error: ")

; Add user id to error file

$cmd = @ComSpec & " /c echo " & $MyUserID & " >>ErrorDeleting.txt"

RunWait($cmd)

EndIf

EndIf

WEnd

; ----------------------------------------------------------------------------

FileClose($file)

_AD_Close()

Exit

; ============================================================================

; ============================================================================

[BrewManNH]

What errors are you getting after the 124th username? And where in your script is the error being thrown from?

[CheWalter]

It shows the message here:

; Something went wrong. Show a message

MsgBox(0, "Error moving", $MyUserFQDN & ": " & @error)

The message shows the Fully Qualified Domain Name of the user #125 and the error -2147352567.

Just in case, I'm using an XP machine and a 2003 AD

Thank you,

Walter

[water]

-2147352567 (decimal) is 0x80020009 (hex) and means: DISP_E_EXCEPTION

This can be anything.

Which version of the UDF do you run (see the header lines at the top of the UDF).

[CheWalter]

#include-once

#include <Array.au3>

#include <Date.au3>

#Tidy_Parameters= /gd 1 /gds 1 /nsdp

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6

#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y

; #INDEX# =======================================================================================================================

; Title .........: Active Directory Function Library

; AutoIt Version : 3.3.6.0 (because of _Date_Time_SystemTimeToDateTimeStr)

; UDF Version ...: 1.1.0

; Language ......: English

; Description ...: A collection of functions for accessing and manipulating Microsoft Active Directory

;

[water]

Could you please insert

Global $iAD_Debug = 2

after _AD_Open so we get detailed COM error information?

[CheWalter]

I updated to the latest version (UDF Version ...: 1.2.2.0) and now the script crashes in the same place but with this error:

C:\Program Files\AutoIt3\Include\AD.au3 (912) : ==> The requested action with this object has failed.:

Local $aAD_Groups = $oAD_Object.GetEx("memberof")

Local $aAD_Groups = $oAD_Object.GetEx("memberof")^ ERROR

->15:56:11 AutoIT3.exe ended.rc:1

Edited September 4, 2012 by CheWalter

[water]

With version 1.2.2.0 you need to use the latest AutoIt beta version.

[CheWalter]

I'm going user by user and seems to be I found a rare coincidence: user 125 and 250 belong only to "Domain Users" group.

Do you think the function _AD_GetUserGroups may fail when this happens?

I installed the latest autoit beta.

Thank you

[CheWalter]

I'm answering myself :-)

Yes, the problem was the function _AD_GetUserGroups. If the user ONLY belongs to "Domain Users", then it crashes.

The idea for the solution came from http://www.autoitscript.com/autoit3/docs/functions/ObjEvent.htm

I added at the beginning of the function an "event trap", so function looks like this:

Func _AD_GetUserGroups($sAD_User = @UserName, $bAD_IncludePrimaryGroup = False)
    ; Added by Walter
$oErrorHandler = ObjEvent("AutoIt.Error", "_ErrFunc")
;
If _AD_ObjectExists($sAD_User) = 0 Then Return SetError(1, 0, "")
Local $sAD_Property = "sAMAccountName"
If StringMid($sAD_User, 3, 1) = "=" Then $sAD_Property = "distinguishedName" ; FQDN provided
$__oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sAD_DNSDomain & ">;(" & $sAD_Property & "=" & $sAD_User & ");ADsPath;subtree"
Local $oAD_RecordSet = $__oAD_Command.Execute ; Retrieve the FQDN for the logged on user
Local $sAD_LDAPEntry = $oAD_RecordSet.fields(0).value
Local $oAD_Object = __AD_ObjGet($sAD_LDAPEntry) ; Retrieve the COM Object for the logged on user
Local $aAD_Groups = $oAD_Object.GetEx("memberof")If IsArray($aAD_Groups) Then
If $bAD_IncludePrimaryGroup Then _ArrayAdd($aAD_Groups, _AD_GetUserPrimaryGroup($sAD_User))
_ArrayInsert($aAD_Groups, 0, UBound($aAD_Groups))
Else
Local $aAD_Groups[1] = [0]
If $bAD_IncludePrimaryGroup Then _ArrayAdd($aAD_Groups, _AD_GetUserPrimaryGroup($sAD_User))
$aAD_Groups[0] = UBound($aAD_Groups) - 1
EndIf
Return $aAD_Groups
; Added by Walter
#forceref $oErrorHandler
EndFunc   ;==>_AD_GetUserGroups

Then I added the function in AD.au3

Func _ErrFunc($oError)
Local $msg
    $msg = "err.number is: " & @TAB & $oError.number & @CRLF
$msg = $msg & "err.windescription:" & @TAB & $oError.windescription & @CRLF
    $msg = $msg & "err.description is: " & @TAB & $oError.description & @CRLF
$msg = $msg & "err.source is: " & @TAB & $oError.source & @CRLF
$msg = $msg & "err.helpfile is: " & @TAB & $oError.helpfile & @CRLF
    $msg = $msg & "err.helpcontext is: " & @TAB & $oError.helpcontext & @CRLF
    $msg = $msg & "err.lastdllerror is: " & @TAB & $oError.lastdllerror & @CRLF
$msg = $msg & "err.scriptline is: " & @TAB & $oError.scriptline & @CRLF
$msg = $msg & "err.retcode is: " & @TAB & $oError.retcode & @CRLF
MsgBox(0, "Error trap", $msg)
EndFunc   ;==>_ErrFunc

It works now.

Thank you all for spending time helping me.

Walter

[Bowmore]

Thanks for posting the solution to a problem you managed to solve yourself thus enabling others to benefit from your experience.

[water]

The COM error handler is not needed if you run version 1.2.2.0 of the UDF AND the latest beta version of AutoIt.

If you run version 1.2.2.0 of the UDF AND one of the production versions of AutoIt you need to enable the COM error handler by calling

_AD_ErrorNotify(1)

at the top of your script (this combination is not recommended).

Version 1.2.0 of the UDF goes well with AutoIt 3.3.8.1

Version 1.2.2.0 of the UDF goes well with AutoIt 3.3.9.2 beta or later

Edited September 5, 2012 by water