Active Directory UDF - Help & Support (II)

[Zolee]

Hi Water!

First of all, a lot of thanks for your work. Solved many problems with it. Great work.

Reading the topics I haven't find too much about trusted domains, so here is an issue:

There is two, trusted domains. I want to add a user from the other trusted domain to a group of my domain (type Domain local).

Im usually use a workaround for this. If a foreign user is added to the AD , its SID is stored in the ForeignSecurityPrincipal container (not visible by default)

After this, I can easily add this SID to any group of mine. . Mostly I always create an array which contains the SID and username of the account using

the _Security__LookupAccountSid function. It's working , It's ok.

The problem occurs, when I faced with a new foreign user , what is not yet a member of any group of my domain, so it has no SID in the FSP container.

I cannot do anything but adding it manualy with ADUC at the first time.

Is there any way to add a user directly from a different but trusted domain to a default (or self) domain group?

I think the "trust" is not handled in this case (or cannot).

Many Thanks!

[water]

The AD UDF is designed to work (read-write) with a single domain at a time. By accessing the Global Catalog you can query multiple domains in the forest.

You could connect to the domain where the user is already defined, grab all necessary information, close the connection, connect to the other domain and create the user.

It's just a workaround but I haven't found anything useful and easier on the web.

[Zolee]

Water,

Thanks for your quick answer.

I see. Unfortunately I have to use the FSP which cannot populate manually so I have to add the user other way (out of AutoIT )

Thakns anyway. It is still a great think!

[water]

If you find anything you would like to see in the UDF just drop me a note.

Or we could even start a new UDF that supports cross domain processing.

[water]

@chaoticyeshua

another idea: As the permissions and the number of OU doesn't change very often the OU treeview doesn't need to be generated in real time.

The table of OUs you have the proper permissions could be written to a file by script A and read by script B when needed. Script A could be part of the Autostart group or run by the logon script or even started by script B on demand.

Edited February 8, 2013 by water

[chaoticyeshua]

While that would be a good idea if I were to run this daily from within Windows, it would not match up with what I am needing it to do. Here's the process I'm imagining in my head for how this works:

1) Boot into WinPE

2) Select the Windows image you want to apply

3) Enter your credentials to connect to the domain (will be different every time pretty much, lots of people will use it), as well as other information (what the computer name will be, customer info, etc.)

4) Connect to AD. If the computer object exists and you have valid permission to bind to the domain using that object, update sysprep's answer file with the correct info and the credentials you entered so it can join to the domain during the specialize pass of Windows setup

5) If the computer object does not exist, populate the tree view with the list of OUs that person has permission on so they can select where to make the object, then proceed as above (update sysprep answer file so it can join to the domain during setup)

This WinPE/image will be used by myself and other full time staff members in my area. It will also be distributed to other IT departments. The roughly one minute wait time to enumerate permissions is acceptable for me, since it used to be three minutes or so. That's a massive improvement, and I thank you for your help.

Edited February 8, 2013 by chaoticyeshua

[water]

At least we have a positive result

I will do some reading about SACL, DACL, ACL, ACE et al and hope to better understand how it works. Maybe the permission checking functions can then be improved and so be useful for othes too.

[water]

Hi Water,

I want to decode msExchMailboxSecurityDescriptor AD attribute (i get it using your UDF). But I can not. Do you have any idea ? A script that can decrypt this binary string ?

This attribute is of type "Binary Blob"

Thank you in advance for your reply.

Good day.

Regards.

I forgot :

Links on msExchMailboxSecurityDescriptor

http://support.microsoft.com/kb/304935/en-us

http://gsexdev.blogspot.fr/2005/04/reverse-msexchmailboxsecuritydescripto.html#!/2005/04/reverse-msexchmailboxsecuritydescripto.html

Thanks

If you run _AD_GetObjectProperties you can see the decoded value for the current user.

This is the code snippet where the blob is decoded:

$oAD_Value = $vAD_PropertyValue.SecurityDescriptor
$aAD_ObjectProperties[$iCount3][1] = "Control:" & $oAD_Value.Control & ", " & _
"Group:" & $oAD_Value.Group & ", " & _
"Owner:" & $oAD_Value.Owner & ", " & _
"Revision:" & $oAD_Value.Revision

[FernandG]

If you run _AD_GetObjectProperties you can see the decoded value for the current user.

This is the code snippet where the blob is decoded:

$oAD_Value = $vAD_PropertyValue.SecurityDescriptor
$aAD_ObjectProperties[$iCount3][1] = "Control:" & $oAD_Value.Control & ", " & _
"Group:" & $oAD_Value.Group & ", " & _
"Owner:" & $oAD_Value.Owner & ", " & _
"Revision:" & $oAD_Value.Revision

Hi All,

Thank's Water, but _AD_GetObjectProperties do not return DACL values for msExchMailboxSecurityDescriptor.

How to get them ? It's possible ?

Thank you all.

[water]

At the moment there is no function in the UDF to decode the DACL.

There are some scripts available on the web which need to be converted to AutoIt. Example.

[water]

How to use these scripts i am new to this forum i see scripts as .au3 extension could you please help in this, i have to lot of stuff in my AD nmigration activity .need your help plz

The AD UDF comes with a lot of example scripts. There you will find what you need.

If you have problems please post your questions here in the Help and Support thread.

[iis4313]

The AD UDF comes with a lot of example scripts. There you will find what you need.

If you have problems please post your questions here in the Help and Support thread.

for expample i have downloaded your script ADCU.zip when i unzip this i see script with .au3 extension so how can i execute this script

[water]

You did install AutoIt and the SciTE editor?

[BrewManNH]

You need to run these scripts with AutoIt. Why would you ask this question on a site devoted to a programming language if you don't even know anything about the language, and haven't even done the basic research needed?

[CoolDude69]

Hi,

I hope that someone could clear something up for me; I have been using AutoIT for a few months and did have that many issues as I can find the help for everything that I needed. Except this time I have a script that requires ad.au3 and ie.au3, this is where I get the problem (I know on a previous post Water mentioned to close AD before continuing the script). When I use the IE function _IEErrorHandlerRegister() with AD, I can't access AD as I get @error = 3 and @extended = 3, if I remove the function (_IEErrorHandlerRegister()) everything works but if you click on the back button or forward button on the IE tab the application crashes.

Here's a part of my code that gives the same error when you double click on the listview item:

expandcollapse popup

#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <GuiListView.au3>
#include <IE.au3>
#include <ListViewConstants.au3>
#include <StructureConstants.au3>
#include <WindowsConstants.au3>

Global $iLVStyle = BitOR($LVS_REPORT, $LVS_SHOWSELALWAYS)
Global $iLVExtStyle = BitOR($WS_EX_CLIENTEDGE, $LVS_EX_GRIDLINES, $LVS_EX_FULLROWSELECT, $LVS_EX_DOUBLEBUFFER, $LVS_EX_HEADERDRAGDROP)
Global $ManagedBy, $BOK, $IComputer, $IDescription

$Form = GUICreate('AD + IE test', 500, 350)

$Size = WinGetClientSize($Form)
$SizeW = $Size[0]
$SizeH = $Size[1]

$Tabs = GUICtrlCreateTab(2, 2, 500, 58)

$Tab0 = GUICtrlCreateTabItem("Search AD")
$hListView = GUICtrlCreateListView("#|PC Name|PC Name|", 4, 60, $SizeW, $SizeH, $iLVStyle, $iLVExtStyle)
GUICtrlCreateListViewItem('1|' & @ComputerName & '$|' & @UserName, $hListView)


$Tab1 = GUICtrlCreateTabItem("Help")
_IEErrorHandlerRegister()
Local $oIE = _IECreateEmbedded()
GUICtrlCreateObj($oIE, 4, 60, 495, 290)
Local $GUI_Button_Back = GUICtrlCreateButton("Back", 5, 24, 100, 30)
Local $GUI_Button_Forward = GUICtrlCreateButton("Forward", 120, 24, 100, 30)
Local $GUI_Button_Home = GUICtrlCreateButton("Home", 230, 24, 100, 30)
Local $GUI_Button_Stop = GUICtrlCreateButton("Stop", 340, 24, 100, 30)

GUICtrlCreateTabItem("")

GUIRegisterMsg($WM_NOTIFY, "WM_NOTIFY")

GUISetState() ;Show GUI

_IENavigate($oIE, "http://www.autoitscript.com")

; Waiting for user to close the window
While 1
    Local $msg = GUIGetMsg()
    Select
        Case $msg = $GUI_EVENT_CLOSE
            ExitLoop
        Case $msg = $GUI_Button_Home
            _IENavigate($oIE, "http://www.autoitscript.com")
        Case $msg = $GUI_Button_Back
            _IEAction($oIE, "back")
        Case $msg = $GUI_Button_Forward
            _IEAction($oIE, "forward")
        Case $msg = $GUI_Button_Stop
            _IEAction($oIE, "stop")
    EndSelect
WEnd

GUIDelete()

Exit


Func WM_NOTIFY($hWnd, $iMsg, $iwParam, $ilParam)
    Local $hWndFrom, $iIDFrom, $iCode, $tNMHDR, $hWndListView, $tInfo
    $hWndListView = $hListView
    If Not IsHWnd($hListView) Then $hWndListView = GUICtrlGetHandle($hListView)

    $tNMHDR = DllStructCreate($tagNMHDR, $ilParam)
    $hWndFrom = HWnd(DllStructGetData($tNMHDR, "hWndFrom"))
    $iIDFrom = DllStructGetData($tNMHDR, "IDFrom")
    $iCode = DllStructGetData($tNMHDR, "Code")
    Switch $hWndFrom
        Case $hWndListView
            Switch $iCode
                Case $LVN_COLUMNCLICK
                    Local $tInfo = DllStructCreate($tagNMLISTVIEW, $ilParam)
                Case $NM_DBLCLK
                    $tInfo = DllStructCreate($tagNMITEMACTIVATE, $ilParam)
                    Local $sAsset = _GUICtrlListView_GetItemText($hWndListView, DllStructGetData($tInfo, "Index"), 1)
                    ConsoleWrite('Command sent _UpdateLDAP(' & $sAsset & ')' & @CR)
                    _UpdateLDAP($sAsset)

            EndSwitch
    EndSwitch
EndFunc   ;==>WM_NOTIFY

Func _UpdateLDAP($nAsset)

    _AD_Open()
    If @error Then Exit MsgBox(16, "Active Directory", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

    If Not _AD_HasRequiredRights($nAsset, 0x10000, @UserName) Then
        MsgBox(16, 'Access Denied', ' You do not have access to modify LDAP')
    Else

        Local $Current = _AD_GetObjectAttribute($nAsset & '$', "description")
        Local $Managed = _AD_GetObjectAttribute($nAsset & '$', "ManagedBy")

        $GUI = GUICreate("Update Computer Description for " & $nAsset, 514, 164, $SizeW / 2, $SizeW / 2, $WS_POPUPWINDOW, $WS_EX_MDICHILD, $Form)

        GUICtrlCreateLabel("Computer Name (samAccountName):", 8, 10, 231, 34)
        GUICtrlCreateLabel("Computer description:", 8, 42, 231, 17)
        GUICtrlCreateLabel("Managed By:", 8, 74, 71, 17)
        $IComputer = GUICtrlCreateInput($nAsset & '$', 241, 8, 259, 21)
        $IDescription = GUICtrlCreateCombo("", 241, 40, 259, 21, 0x0003)
        GUICtrlSetData($IDescription, "Primary|Secondary|Development|Shared|Loaner|Classroom|Conference Room|LOB|BYOD|Storage|Server", $Current)

        $ManagedBy = GUICtrlCreateInput($Managed, 80, 72, 420, 21)

        GUICtrlSetState($IComputer, $gui_disable)

        $Validate = GUICtrlCreateButton("Validate", 8, 122, 121, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
        GUICtrlSetOnEvent($Validate, 'Validate')
        $BOK = GUICtrlCreateButton("Change description", 188, 122, 121, 33)
        GUICtrlSetState($BOK, $gui_disable)
        GUICtrlSetOnEvent($BOK, 'BOK')
        $BCancel = GUICtrlCreateButton("Cancel", 428, 122, 73, 33)
        GUICtrlSetOnEvent($BCancel, 'BCancel')
        GUISetState()

        If GUICtrlRead($IDescription) <> "" And GUICtrlRead($ManagedBy) <> "" Then
            GUICtrlSetState($BCancel, $GUI_FOCUS)
        EndIf

    EndIf

    _AD_Close()
EndFunc   ;==>_UpdateLDAP

Func Validate()

    _AD_Open()
    $sManagerDN = GUICtrlRead($ManagedBy)
    $sManagerDN = _AD_GetObjectAttribute($sManagerDN, "distinguishedName")
    GUICtrlSetData($ManagedBy, $sManagerDN)
    _AD_Close()
    If GUICtrlRead($ManagedBy) Then GUICtrlSetState($BOK, $gui_enable)

EndFunc   ;==>Validate

Func BOK()

    _AD_Open()
    $sComputer = GUICtrlRead($IComputer)
    $sDescription = GUICtrlRead($IDescription)
    $sManagerDN = GUICtrlRead($ManagedBy)
    $sManagerDN = _AD_GetObjectAttribute($sManagerDN, "distinguishedName")
    GUICtrlSetData($ManagedBy, $sManagerDN)
    $iValue = _AD_ModifyAttribute($sComputer, "description", $sDescription, 2)
    $iResult = _AD_ModifyAttribute($sComputer, "ManagedBy", $sManagerDN)

    If $iValue = 1 And $iResult = 1 Then
        MsgBox(64, "Active Directory", "Description / managedBy for computer '" & $sComputer & "' successfully changed")
    ElseIf @error = 1 Then
        MsgBox(48, "Active Directory", "Computer '" & $sComputer & "' does not exist")
    ElseIf @error = -2147352567 Then
        MsgBox(16, "Active Directory", "Access is denied, you do not have the rights to change LDAP")
    Else
        MsgBox(48, "Active Directory", "Return code '" & @error & "' from Active Directory")
    EndIf

    _AD_Close()

EndFunc   ;==>BOK

Func BCancel()
    GUIDelete()
EndFunc   ;==>BCancel

Edited February 13, 2013 by CoolDude69

[CoolDude69]

Hi,

I hope that someone could clear something up for me; I have been using AutoIT for a few months and did have that many issues as I can find the help for everything that I needed. Except this time I have a script that requires ad.au3 and ie.au3, this is where I get the problem (I know on a previous post Water mentioned to close AD before continuing the script). When I use the IE function _IEErrorHandlerRegister() with AD, I can't access AD as I get @error = 3 and @extended = 3, if I remove the function (_IEErrorHandlerRegister()) everything works but if you click on the back button or forward button on the IE tab the application crashes.

Here's a part of my code that gives the same error when you double click on the listview item:

For some reason the code looks weird, so here it is:

expandcollapse popup

#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <GuiListView.au3>
#include <IE.au3>
#include <ListViewConstants.au3>
#include <StructureConstants.au3>
#include <WindowsConstants.au3>
Global $iLVStyle = BitOR($LVS_REPORT, $LVS_SHOWSELALWAYS)
Global $iLVExtStyle = BitOR($WS_EX_CLIENTEDGE, $LVS_EX_GRIDLINES, $LVS_EX_FULLROWSELECT, $LVS_EX_DOUBLEBUFFER, $LVS_EX_HEADERDRAGDROP)
Global $ManagedBy, $BOK, $IComputer, $IDescription

$Form = GUICreate('AD + IE test', 500, 350)

$Size = WinGetClientSize($Form)
$SizeW = $Size[0]
$SizeH = $Size[1]

$Tabs = GUICtrlCreateTab(2, 2, 500, 58)

$Tab0 = GUICtrlCreateTabItem("Search AD")
$hListView = GUICtrlCreateListView("#|PC Name|PC Name|", 4, 60, $SizeW, $SizeH, $iLVStyle, $iLVExtStyle)
GUICtrlCreateListViewItem('1|' & @ComputerName & '$|' & @UserName, $hListView)


$Tab1 = GUICtrlCreateTabItem("Help")
_IEErrorHandlerRegister()
Local $oIE = _IECreateEmbedded()
GUICtrlCreateObj($oIE, 4, 60, 495, 290)
Local $GUI_Button_Back = GUICtrlCreateButton("Back", 5, 24, 100, 30)
Local $GUI_Button_Forward = GUICtrlCreateButton("Forward", 120, 24, 100, 30)
Local $GUI_Button_Home = GUICtrlCreateButton("Home", 230, 24, 100, 30)
Local $GUI_Button_Stop = GUICtrlCreateButton("Stop", 340, 24, 100, 30)

GUICtrlCreateTabItem("")

GUIRegisterMsg($WM_NOTIFY, "WM_NOTIFY")

GUISetState() ;Show GUI

_IENavigate($oIE, "http://www.autoitscript.com")

; Waiting for user to close the window
While 1
Local $msg = GUIGetMsg()
Select
Case $msg = $GUI_EVENT_CLOSE
ExitLoop
Case $msg = $GUI_Button_Home
_IENavigate($oIE, "http://www.autoitscript.com")
Case $msg = $GUI_Button_Back
_IEAction($oIE, "back")
Case $msg = $GUI_Button_Forward
_IEAction($oIE, "forward")
Case $msg = $GUI_Button_Stop
_IEAction($oIE, "stop")
EndSelect
WEnd

GUIDelete()

Exit


Func WM_NOTIFY($hWnd, $iMsg, $iwParam, $ilParam)
Local $hWndFrom, $iIDFrom, $iCode, $tNMHDR, $hWndListView, $tInfo
$hWndListView = $hListView
If Not IsHWnd($hListView) Then $hWndListView = GUICtrlGetHandle($hListView)

$tNMHDR = DllStructCreate($tagNMHDR, $ilParam)
$hWndFrom = HWnd(DllStructGetData($tNMHDR, "hWndFrom"))
$iIDFrom = DllStructGetData($tNMHDR, "IDFrom")
$iCode = DllStructGetData($tNMHDR, "Code")
Switch $hWndFrom
Case $hWndListView
Switch $iCode
Case $LVN_COLUMNCLICK
Local $tInfo = DllStructCreate($tagNMLISTVIEW, $ilParam)
Case $NM_DBLCLK
$tInfo = DllStructCreate($tagNMITEMACTIVATE, $ilParam)
Local $sAsset = _GUICtrlListView_GetItemText($hWndListView, DllStructGetData($tInfo, "Index"), 1)
ConsoleWrite('Command sent _UpdateLDAP(' & $sAsset & ')' & @CR)
_UpdateLDAP($sAsset)

EndSwitch
EndSwitch
EndFunc ;==>WM_NOTIFY

Func _UpdateLDAP($nAsset)

_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

If Not _AD_HasRequiredRights($nAsset, 0x10000, @UserName) Then
MsgBox(16, 'Access Denied', ' You do not have access to modify LDAP')
Else

Local $Current = _AD_GetObjectAttribute($nAsset & '$', "description")
Local $Managed = _AD_GetObjectAttribute($nAsset & '$', "ManagedBy")

$GUI = GUICreate("Update Computer Description for " & $nAsset, 514, 164, $SizeW / 2, $SizeW / 2, $WS_POPUPWINDOW, $WS_EX_MDICHILD, $Form)

GUICtrlCreateLabel("Computer Name (samAccountName):", 8, 10, 231, 34)
GUICtrlCreateLabel("Computer description:", 8, 42, 231, 17)
GUICtrlCreateLabel("Managed By:", 8, 74, 71, 17)
$IComputer = GUICtrlCreateInput($nAsset & '$', 241, 8, 259, 21)
$IDescription = GUICtrlCreateCombo("", 241, 40, 259, 21, 0x0003)
GUICtrlSetData($IDescription, "Primary|Secondary|Development|Shared|Loaner|Classroom|Conference Room|LOB|BYOD|Storage|Server", $Current)

$ManagedBy = GUICtrlCreateInput($Managed, 80, 72, 420, 21)

GUICtrlSetState($IComputer, $gui_disable)

$Validate = GUICtrlCreateButton("Validate", 8, 122, 121, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUICtrlSetOnEvent($Validate, 'Validate')
$BOK = GUICtrlCreateButton("Change description", 188, 122, 121, 33)
GUICtrlSetState($BOK, $gui_disable)
GUICtrlSetOnEvent($BOK, 'BOK')
$BCancel = GUICtrlCreateButton("Cancel", 428, 122, 73, 33)
GUICtrlSetOnEvent($BCancel, 'BCancel')
GUISetState()

If GUICtrlRead($IDescription) <> "" And GUICtrlRead($ManagedBy) <> "" Then
GUICtrlSetState($BCancel, $GUI_FOCUS)
EndIf

EndIf

_AD_Close()
EndFunc ;==>_UpdateLDAP

Func Validate()

_AD_Open()
$sManagerDN = GUICtrlRead($ManagedBy)
$sManagerDN = _AD_GetObjectAttribute($sManagerDN, "distinguishedName")
GUICtrlSetData($ManagedBy, $sManagerDN)
_AD_Close()
If GUICtrlRead($ManagedBy) Then GUICtrlSetState($BOK, $gui_enable)

EndFunc ;==>Validate

Func BOK()

_AD_Open()
$sComputer = GUICtrlRead($IComputer)
$sDescription = GUICtrlRead($IDescription)
$sManagerDN = GUICtrlRead($ManagedBy)
$sManagerDN = _AD_GetObjectAttribute($sManagerDN, "distinguishedName")
GUICtrlSetData($ManagedBy, $sManagerDN)
$iValue = _AD_ModifyAttribute($sComputer, "description", $sDescription, 2)
$iResult = _AD_ModifyAttribute($sComputer, "ManagedBy", $sManagerDN)

If $iValue = 1 And $iResult = 1 Then
MsgBox(64, "Active Directory", "Description / managedBy for computer '" & $sComputer & "' successfully changed")
ElseIf @error = 1 Then
MsgBox(48, "Active Directory", "Computer '" & $sComputer & "' does not exist")
ElseIf @error = -2147352567 Then
MsgBox(16, "Active Directory", "Access is denied, you do not have the rights to change LDAP")
Else
MsgBox(48, "Active Directory", "Return code '" & @error & "' from Active Directory")
EndIf

_AD_Close()

EndFunc ;==>BOK

Func BCancel()
GUIDelete()
EndFunc ;==>BCancel

[water]

It's a bug:

"If you run AutoIt < 3.3.9.2 and your script defines a COM error handler before _AD_Open is called then _AD_Open will fail with @error = 3."

I will post a solution tomorrow.

[water]

To remove the bug please change the following lines in function _AD_Open from

; Activate the COM error handler for older AutoIt versions
If $__iAD_Debug = 0 And Number(StringReplace(@AutoItVersion, ".", "")) < 3392 Then _AD_ErrorNotify(1)

to

; Activate the COM error handler for older AutoIt versions
    If $__iAD_Debug = 0 And Number(StringReplace(@AutoItVersion, ".", "")) < 3392 Then
        _AD_ErrorNotify(1)
        SetError(0) ; Reset @error which is returned by _AD_ErrorNotify if a COM error handler has already been set up by the user
    EndIf

[CoolDude69]

To remove the bug please change the following lines in function _AD_Open from

; Activate the COM error handler for older AutoIt versions
If $__iAD_Debug = 0 And Number(StringReplace(@AutoItVersion, ".", "")) < 3392 Then _AD_ErrorNotify(1)

to

; Activate the COM error handler for older AutoIt versions
    If $__iAD_Debug = 0 And Number(StringReplace(@AutoItVersion, ".", "")) < 3392 Then
        _AD_ErrorNotify(1)
        SetError(0) ; Reset @error which is returned by _AD_ErrorNotify if a COM error handler has already been set up by the user
    EndIf

Thank you water, everything seems to be working fine now.

[water]

This bug will be fixed in the next release of the UDF.