Active Directory UDF - Help & Support (II)

[gcue]

is there a way to get an accounts expiration date?

i see how you can SET an expiration date but cant see how to get expiration date.

thanks again for this wonderful udf =)

[water]

Sure, query property "accountExpires".

[gcue]

perfect. thanks!!!

[water]

[Iceman682]

Hi Water

Is there a way to prefix (prepend) some text to the already inserted description of an AD Object such as a Computer description?

i.e ??????? - My Test Machine

Many thanks in advance

[water]

Sure.

Use _AD_GetObjectAttribute to retrieve the current value of the property, prepend the text and update the property with _AD_ModifyAttribute.

[Iceman682]

Sorted, Thanks Water

[water]

This one was easy to solve

[water]

How about

$aAltSecurityIdentities[3] = ["String1", "String2", "String3"]
_AD_ModifyAttribute($strUsername, "altsecurityidentities", $aAltSecurityIdentities, 2)

[Speleologist]

Hi Water,

I'm having issues with unjoining and joining a domain.

I have two scripts (just short tests at the moment), One to take a Windows XP PC out of a domain into a workgroup and another to put it into a different domain. In between I run another script to set the Domain and Search List in the TCP IP parameters to be correct for the new domain.

Leaving the domain consistently returns an error of 5. This does not appear to be a rights issue as we have made the account we use a domain admin, with no result. The authentication is OK. Code is below with variable declarations removed for security.

#include <ad.au3>

HighwaysADAuthenticate()
UnJoinHighwaysDomain ()
_AD_Close()

Func HighwaysADAuthenticate()
If _AD_Open($ADUser, $ADPassword) Then
  MsgBox(64, "Authenticate to Highways AD", "Logon was succcessful!")
ElseIf @error <= 8 Then
  MsgBox(16, "Authenticate to Highways AD", "The logon was not succcessful!" & @CRLF & @CRLF & "@error: " & @error & ", @extended: " & @extended)
Else
  MsgBox(16, "Authenticate to Highways AD", "The logon was not succcessful!" & @CRLF & @CRLF & "@error: " & @error & ", @extended: " & @extended & _
    @CRLF & @CRLF & "Extended error information will be displayed")
EndIf
EndFunc   ;==>HighwaysADAuthenticate

Func UnJoinHighwaysDomain()
If _AD_UnJoinDomain(@ComputerName, $Workgroup) Then
  MsgBox(64, 'UnJoin Domain', ' Successfully removed ' & @ComputerName & ' from the Highways Domain')
Else
  MsgBox(16, 'UnJoin Domain', 'Error removing ' & @ComputerName & ' from the Highways Domain' & @CRLF & @CRLF & @error & @CRLF & @CRLF & @extended)
EndIf
EndFunc   ;==>UnJoinHighwaysDomain

Joining the Domain, the issue appears to be with _AD_OPEN (Code below)

#include <ad.au3>
HCCADAuthenticate()
If Not _AD_ObjectExists('HCC039662&') Then
HCCCreateComputer()
Else
MsgBox(0, "Computer Check", "Computer already exists")
EndIf
JoinHCCDomain()
_AD_Close()
Func HCCADAuthenticate()
If _AD_Open($ADUser, $ADPassword, $HCCDNSDomain , $HCCDC , $HCCConfigurationNamingContext ) Then
  MsgBox(64, "Authenticate to HCC AD", "Logon was succcessful!")
ElseIf @error <= 8 Then
  MsgBox(16, "Authenticate to HCC AD", "The logon was not succcessful!" & @CRLF & @CRLF & "@error: " & @error & ", @extended: " & @extended)
Else
  MsgBox(16, "Authenticate to HCC AD", "The logon was not succcessful!" & @CRLF & @CRLF & "@error: " & @error & ", @extended: " & @extended & _
    @CRLF & @CRLF & "Extended error information will be displayed")
  Global $aError = _AD_GetLastADSIError()
  _ArrayDisplay($aError)
EndIf
EndFunc   ;==>HCCADAuthenticate

Func HCCCreateComputer()
If _AD_CreateComputer("OU=Unmanaged,DC=hertscc,DC=gov,DC=uk", @ComputerName, $ADUser) Then
  MsgBox(64, 'Computer Object Creation', 'Computer account for ' & @ComputerName & ' was successfully created')
Else
  MsgBox(16, 'Computer Object Creation', 'Failed to create computer account for ' & @ComputerName & @CRLF & @CRLF & @error)
EndIf
EndFunc   ;==>HCCCreateComputer
Func JoinHCCDomain()
If _AD_JoinDomain('HCC039662') Then
  MsgBox(64, 'JoinDomain', 'Successfully joined ' & @ComputerName & ' to the HCC Domain')
Else
  MsgBox(16, 'JoinDomain', 'Failed to join ' & @ComputerName & ' to the HCC Domain' & @CRLF & @CRLF & @error)
EndIf
EndFunc   ;==>JoinHCCDomain

If I run from a computer in the domain and just use $sAD_UserIdParam and $sAD_PasswordParam I can run the process as far as creating the Computer Object. Howver, when I run from the computer that is joining the domain and I add in the additional parameters, I login successfully, but can do no more. I also as a test have tried running an _AD_GetObjectsInOU. This again only works if I have authenticated from a workstatio that is in the domain.

Any suggestions?

Speleologist

[water]

What's the value of @extended when unjoining the domain?

[Speleologist]

Unjoining the domain @error is 5 and @extended is 5

Creating the Computer in the new domain@error is 1 and @extended is 0

Joining the domain @error is 1 and @extended is o

[water]

Can you please post the code you use to UnJoin the computer from the domain?

[water]

When unjoining the computer @error = 5 means: ERROR_ACCESS_DENIED

[Speleologist]

Hi Water,Script is below:

#include "Variable values left out for security"HighwaysADAuthenticate()HighwaysGetObjects()UnJoinHighwaysDomain ()_AD_Close()Func HighwaysADAuthenticate()If _AD_Open($ADUser, $ADPassword) ThenMsgBox(64, "Authenticate to Highways AD", "Logon was succcessful!")ElseIf @error <= 8 ThenMsgBox(16, "Authenticate to Highways AD", "The logon was not succcessful!" & @CRLF & @CRLF & "@error: " & @error & ", @extended: " & @extended)ElseMsgBox(16, "Authenticate to Highways AD", "The logon was not succcessful!" & @CRLF & @CRLF & "@error: " & @error & ", @extended: " & @extended & _@CRLF & @CRLF & "Extended error information will be displayed")EndIfEndFunc ;==>HighwaysADAuthenticateFunc HighwaysGetObjects()$aObjects = _AD_GetObjectsInOU("OU=Workstations,DC=hertshighways,DC=org,DC=uk", "(objectCategory=computer)", 2, "distinguishedName")If @error > 0 ThenMsgBox(64, "Highways Workstations", "No computers could be found")Else_ArrayDisplay($aObjects, "Highways Active Directory - Computers in container 'Workstations'")EndIfEndFunc ;==>HighwaysGetObjectsFunc UnJoinHighwaysDomain()If _AD_UnJoinDomain(@ComputerName, $Workgroup) ThenMsgBox(64, 'UnJoin Domain', ' Successfully removed ' & @ComputerName & ' from the Highways Domain')ElseMsgBox(16, 'UnJoin Domain', 'Error removing ' & @ComputerName & ' from the Highways Domain' & @CRLF & @CRLF & @error & @CRLF & @CRLF & @extended)EndIfEndFunc ;==>UnJoinHighwaysDomain

Edited April 15, 2013 by Speleologist

[water]

As $ADUser and $ADPassword are blank the credentials of the currently logged in user are used by _AD_Open and _AD_UnJoinDomain.

So it looks like the currently logged in user doesn't have the necessary permissions to unjoin the computer from the domain.

[Speleologist]

Hi Water,

They are not blank. I just have deleted them before posting on an open forum for security. The values for $ADUser and $ADPassword are for an account that has the required rights. I have also tested by making the account Domain Admin and still get the same problem.

[water]

Another try. Can you pass $ADUser and $ADPassword to _AD_UnJoinDomain?

Edit: The UserId has to be a NetBIOS Login Name e.g. "<DOMAIN>DJ"

Edited April 15, 2013 by water

[Speleologist]

I'll give that a try now.

[Speleologist]

That fails with a "Variable must be of type "Object" (see below).

I should add that I'm running it compiled as I don't have Autoit on the machines I will be moving.