Active Directory UDF - Help & Support (II)

[Speleologist]

Screenshot won't go through our firewall!

[water]

Sorry, my bad.

You don't need to pass the userid as domainuser. user is enough. The full NetBiosName is calculated by the function.

[Speleologist]

Using just the NETBIOS name gives exactly the same result. Incidentally, using the same $ADUser account manually from System Properties and there is no issue with either unjoining or joining the domain.

[water]

Sorry, don't get it. Need a cup of coffee first

Can you post the formats that didn't work and then those that worked?

Let's assume @UserName returns "DJ" (Doe, John). What did you try and what worked?

[Speleologist]

Hi Water,

None of them work. I have tried $ADUSer = <DOMAIN><USERNAME> and $ADUSER = <USERNAME>. This is not the logged in user as the logged in user will have no rights to Unjoin the domain. (This script will be running for several hundred different users to move the workstaions from one domain to another).

Whichever format I use it appears to fail when run from the script.The _AD_OPEN returns a success and I can run _AD_GetObjectsINOu and the laptop I am trying to unjoin is in the array, but I get the error 5 when I do the unjoin. However from System properties I have no issues unjoining using the same user account.

[Jochem]

Hi,

I get an error while appending atribute values to the AD

_AD_ModifyAttribute("some_object", "atribute_name", "some_value", 3)

I get an com error:

NumberHex = 80020009

Number = -2147352567

with:

AD UDF version = 1.3.0

@AutoItVersion = 3.3.8.1

I am shure that I have full access to the AD, because this is the only functie that gives an error. I also can update the atributes, but not appending.

Is there something I am probably doing wrong?

Edited April 15, 2013 by Jochem

[water]

@Speleologist

I'm not very firm with all those permission things.

What comes to my mind is that it might not be a problem with unjoining the computer from the AD but with adding it to a local group.

Does the user have permissions to add the computer to the specified local group?

[water]

@Jochem,

Can you please post the full COM error description you receive? 80020009 is a general error that doesn't tell where the problem is.

[Speleologist]

Hi Water,

One of the tests I did was to make the usera Domain Admin, and I still get exactly the same problem, so I don't think it can be a permission issue.

[water]

Ok, a few more questions:

• The workgroup ($Workgroup) where the computer will be moved to does already exist?
• Which operating system do you run (Windows XP, Windows 7 ...)?
• Which version of AutoIt do you run?
• Which version of the AD UDF do you run?

Edited April 16, 2013 by water

[Speleologist]

Hi Water,

The WorkGroup - It does not exist in my test. When we go live it may or may not. There are no workgroups in the environment normally, I only need one for the time between the unjoin and join, so it may exist if others are runing the script at the same time. When completed the script to unjoin the domain will force a reboot with an auto admin logon and a runonce to run the script to join the new domain, so the workstations will only be in the workgroup for a few minutes.

Operating System - XP SP3

AutoIt Version - 3.3.8.1

AD UDF - 1.3.0.0

[water]

Unfortunately I can't test here. I have just readonly access to our AD.

Will try at home (Windows 7 in a VirtualBox and Resara as AD).

Does the workgroup exist after the UnJoin failed? So we know if it is a permission problem to create the workgroup or to add the computer to the workgroup.

[Speleologist]

When the unjoin fails, the workstation is still in the domain. At this point there are no computers in the workgroup so the workgroup does not exist. I will try to get hold of another test machine and put it into the workgroup to see if that makes a difference.

UPDATE: It didn't make a difference!

Edited April 16, 2013 by Speleologist

[Jochem]

I don`t get much info actually from the com error:

Scriptline = 2476

NumberHex = 80020009

Number = -2147352567

WinDescription = Unspecified error

Description = Unspecified error

Source = Active Directory

Edited April 16, 2013 by Jochem

[water]

Can you please provide the name of the property you try to append to?

[Jochem]

yes, but it isn`t a default attribute:

kerio-Mail-Authorization.

I try to append 2 values in total to a value that I updated just before in the scipt:

if $sPendinginternemail = 1 then
_AD_ModifyAttribute($sUser, "kerio-Mail-Authorization", "kms.own.domain.only")
_AD_ModifyAttribute($sUser, "kerio-Mail-Authorization", "kms.autodelete.deleteditems.days=30", 3)
_AD_ModifyAttribute($sUser, "kerio-Mail-Authorization", "kms.autodelete.junkemail.days=30", 3)
else
_AD_ModifyAttribute($sUser, "kerio-Mail-Authorization", "kms.autodelete.deleteditems.days=30")
_AD_ModifyAttribute($sUser, "kerio-Mail-Authorization", "kms.autodelete.junkemail.days=30", 3)
endif

[water]

Looks like it is a multi value property. Can't you just put all values into an array and set the property in one go?

[Jochem]

I tried:

_AD_ModifyAttribute($sUser, "kerio-Mail-Authorization", "kms.own.domain.only; kms.autodelete.deleteditems.days=30; kms.autodelete.junkemail.days=30")

But this didn`t worked, I get then one big value, and the server doesn`t "understand" this value

Edited April 16, 2013 by Jochem

[water]

It should be something like this:

Global $aValues[3] = ["kms.own.domain.only", "kms.autodelete.deleteditems.days=30", "kms.autodelete.junkemail.days=30"]
_AD_ModifyAttribute($sUser, "kerio-Mail-Authorization", $aValues)

Edited April 16, 2013 by water

[Jochem]

hi,

this worked!

thank very much