Active Directory UDF - Help & Support (III)

[water]

I would like to avoid that users need to modify their AD-related AutoIt scripts!

I'm thinking about a Global variable ($__iSecurity) that allows to either set the security parameter for _AD_Open when it has not been set by the user or to overwrite the settings specified by the user.

Parameter $iSecurity of function _AD_Open now can have a value of 0 (no security), 1 (encrypt userid/password), 2 (SSL) or 3 (encrypt userid/password plus SSL).

With the future change it would work this way:

• When you set the global variable $__iSecurity to 1, 2, or 3 then $iSecurity is set to this values if the user did not specify this parameter.
• When you add 16 to this values (resulting in 17, 18, or 19) $iSecurity is set to to 1, 2, or 3 ignoring/overwriting what the user did specify.

You just have to set $__iSecurity in your script (= local scope) or modify the AD UDF (= global scope).

If needed I could modify _AD_Open even more so the setting for $__iSecurity gets read from a file (with either a global scope = all scripts) or local scope (= just for the script you specify in this file).

What do you think?

Modification to _AD_Open (without the file feature):

; Overwrite $iSecurity if needed
#forcedef $__iSecurity
If IsDeclared($__iSecurity) Then
    If BitAND($__iSecurity, 16) = 16 Then
        $iSecurity = $__iSecurity - 16 ; $__iSecurity has been set to overwrite existing values
    ElseIf $iSecurity = 0 Then
        $iSecurity = $__iSecurity ; Only set $iSecurity if the user did not set this parameter
    EndIf
EndIf

 

Edited March 3, 2020 by water

[ViciousXUSMC]

Something super easy that is not working.

 

Playing around with the concept of the user getting a notification when password is due to expire soon.

So using  _AD_GetPasswordInfo() for that (have not actually built the script yet that reads that data and compares it to real time)

This is working using the example provided I see the array with all the users password info.

 

Then the next step would be the _AD_ChangePassword()

 

This is where I have an issue.

 

I get @Error 2 and @Extended -2147352567

Searching the forum shows this is probably permissions.

 

So I changed _AD_Open() to use my administrative credentials that I know have full access instead of the current user, and this also still resulted in the same error.

 

I verified that the user has not been locked out of changing their password.

I also viewed effective access for the user and verified they have change password capacity.

 

I am just using the example scripts thus not posting any code.

 

Any ideas?  I am still assuming its permissions, but not sure why/how.

 

 

[water]

This is the only function that doesn't use LDAP to work with the AD:

Func _AD_ChangePassword($sOldPW, $sNewPW)

    Local $oUsr = ObjGet("WinNT://" & @LogonDomain & "/" & @UserName & ",user")
    If @error Then Return SetError(1, @error, 0)
    $oUsr.ChangePassword($sOldPW, $sNewPW)
    If @error Then Return SetError(2, @error, 0)
    Return 1

EndFunc   ;==>_AD_ChangePassword

I was able to reproduce the error. I'm running Windows 10.

Which OS do you use?

Please check the next post!

Edited March 4, 2020 by water

[water]

It's a bug in the example script
Please use the following new version of _AD_ChangePassword.au3 (has been enhanced to hide the entered passwords, has a show/hide passwords button, requires to enter the new passwords twice and makes sure they match):

Spoiler

 

expandcollapse popup

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_AU3Check_Parameters=-d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6 -w 7 
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
; *****************************************************************************
; Example 1
; Sets the password for the currently logged on user
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>
#include <EditConstants.au3>
#include <MsgBoxConstants.au3>

Global $bShow = False

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script changes the password for the current user." & @CRLF & @CRLF & _
        "Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter user and password to change
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 414, 156, 251, 112)
GUICtrlCreateLabel("Old (current) password:", 8, 10, 231, 17)
GUICtrlCreateLabel("New password:", 8, 42, 121, 17)
GUICtrlCreateLabel("New password:", 8, 72, 121, 17)
Global $IOldPW = GUICtrlCreateInput("", 241, 8, 159, 21, $ES_PASSWORD)
Global $INewPW1 = GUICtrlCreateInput("", 241, 40, 159, 21, $ES_PASSWORD)
Global $INewPW2 = GUICtrlCreateInput("", 241, 72, 159, 21, $ES_PASSWORD)
Global $BOK = GUICtrlCreateButton("Change Password", 8, 104, 121, 33)
Global $BShowPW = GUICtrlCreateButton("Show Passwords", 200, 104, 110, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 328, 104, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

Global $sDefaultPassChar = GUICtrlSendMsg($IOldPW, $EM_GETPASSWORDCHAR, 0, 0)
While 1
    Global $nMsg = GUIGetMsg()
    Switch $nMsg
        Case $GUI_EVENT_CLOSE, $BCancel
            Exit
        Case $BShowPW
            If $bShow = False Then
                GUICtrlSendMsg($IOldPW, $EM_SETPASSWORDCHAR, 0, 0)
                GUICtrlSendMsg($INewPW1, $EM_SETPASSWORDCHAR, 0, 0)
                GUICtrlSendMsg($INewPW2, $EM_SETPASSWORDCHAR, 0, 0)
                GUICtrlSetData($BShowPW, "Hide Passwords")
                $bShow = True
            Else
                GUICtrlSendMsg($IOldPW, $EM_SETPASSWORDCHAR, $sDefaultPassChar, 0)
                GUICtrlSendMsg($INewPW1, $EM_SETPASSWORDCHAR, $sDefaultPassChar, 0)
                GUICtrlSendMsg($INewPW2, $EM_SETPASSWORDCHAR, $sDefaultPassChar, 0)
                GUICtrlSetData($BShowPW, "Show Passwords")
                $bShow = False
            EndIf
            GUICtrlSetState($IOldPW, $GUI_FOCUS) ;Input needs focus to redraw characters
            GUICtrlSetState($INewPW1, $GUI_FOCUS)
            GUICtrlSetState($INewPW2, $GUI_FOCUS)
        Case $BOK
            Global $sOldPW = GUICtrlRead($IOldPW)
            Global $sNewPW1 = GUICtrlRead($INewPW1)
            Global $sNewPW2 = GUICtrlRead($INewPW2)
            if $sNewPW1 = $sNewPW2 Then ExitLoop
            MsgBox($MB_ICONERROR, "Active Directory - Change Password", "New passwords don't match!")
        EndSwitch
WEnd

; Change the password
Global $iValue = _AD_ChangePassword($sOldPW, $sNewPW1)
If $iValue = 1 Then
    MsgBox(64, "Active Directory Functions - Example 1", "Password for the current user successfully changed")
ElseIf @error = 1 Then
    MsgBox(16, "Active Directory Functions - Example 1", "Error occurred when accessing the current user object!" & @LF & "@error = " & @error & ", @extended = " & @extended)
Else
    MsgBox(16, "Active Directory Functions - Example 1", "Error occurred when changing the password!" & @LF & "@error = " & @error & ", @extended = " & @extended)
EndIf

; Close Connection to the Active Directory
_AD_Close()

 

 

 

 

Edited March 4, 2020 by water

[ViciousXUSMC]

2 hours ago, water said:

It's a bug in the example script
Please use the following new version of _AD_ChangePassword.au3 (has been enhanced to hide the entered passwords, has a show/hide passwords button, requires to enter the new passwords twice and makes sure they match):

  Hide contents

 

expandcollapse popup

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_AU3Check_Parameters=-d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6 -w 7 
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
; *****************************************************************************
; Example 1
; Sets the password for the currently logged on user
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>
#include <EditConstants.au3>
#include <MsgBoxConstants.au3>

Global $bShow = False

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script changes the password for the current user." & @CRLF & @CRLF & _
        "Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter user and password to change
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 414, 156, 251, 112)
GUICtrlCreateLabel("Old (current) password:", 8, 10, 231, 17)
GUICtrlCreateLabel("New password:", 8, 42, 121, 17)
GUICtrlCreateLabel("New password:", 8, 72, 121, 17)
Global $IOldPW = GUICtrlCreateInput("", 241, 8, 159, 21, $ES_PASSWORD)
Global $INewPW1 = GUICtrlCreateInput("", 241, 40, 159, 21, $ES_PASSWORD)
Global $INewPW2 = GUICtrlCreateInput("", 241, 72, 159, 21, $ES_PASSWORD)
Global $BOK = GUICtrlCreateButton("Change Password", 8, 104, 121, 33)
Global $BShowPW = GUICtrlCreateButton("Show Passwords", 200, 104, 110, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 328, 104, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

Global $sDefaultPassChar = GUICtrlSendMsg($IOldPW, $EM_GETPASSWORDCHAR, 0, 0)
While 1
    Global $nMsg = GUIGetMsg()
    Switch $nMsg
        Case $GUI_EVENT_CLOSE, $BCancel
            Exit
        Case $BShowPW
            If $bShow = False Then
                GUICtrlSendMsg($IOldPW, $EM_SETPASSWORDCHAR, 0, 0)
                GUICtrlSendMsg($INewPW1, $EM_SETPASSWORDCHAR, 0, 0)
                GUICtrlSendMsg($INewPW2, $EM_SETPASSWORDCHAR, 0, 0)
                GUICtrlSetData($BShowPW, "Hide Passwords")
                $bShow = True
            Else
                GUICtrlSendMsg($IOldPW, $EM_SETPASSWORDCHAR, $sDefaultPassChar, 0)
                GUICtrlSendMsg($INewPW1, $EM_SETPASSWORDCHAR, $sDefaultPassChar, 0)
                GUICtrlSendMsg($INewPW2, $EM_SETPASSWORDCHAR, $sDefaultPassChar, 0)
                GUICtrlSetData($BShowPW, "Show Passwords")
                $bShow = False
            EndIf
            GUICtrlSetState($IOldPW, $GUI_FOCUS) ;Input needs focus to redraw characters
            GUICtrlSetState($INewPW1, $GUI_FOCUS)
            GUICtrlSetState($INewPW2, $GUI_FOCUS)
        Case $BOK
            Global $sOldPW = GUICtrlRead($IOldPW)
            Global $sNewPW1 = GUICtrlRead($INewPW1)
            Global $sNewPW2 = GUICtrlRead($INewPW2)
            if $sNewPW1 = $sNewPW2 Then ExitLoop
            MsgBox($MB_ICONERROR, "Active Directory - Change Password", "New passwords don't match!")
        EndSwitch
WEnd

; Change the password
Global $iValue = _AD_ChangePassword($sOldPW, $sNewPW1)
If $iValue = 1 Then
    MsgBox(64, "Active Directory Functions - Example 1", "Password for the current user successfully changed")
ElseIf @error = 1 Then
    MsgBox(16, "Active Directory Functions - Example 1", "Error occurred when accessing the current user object!" & @LF & "@error = " & @error & ", @extended = " & @extended)
Else
    MsgBox(16, "Active Directory Functions - Example 1", "Error occurred when changing the password!" & @LF & "@error = " & @error & ", @extended = " & @extended)
EndIf

; Close Connection to the Active Directory
_AD_Close()

 

 

 

 

Seems to work!

 

One thing I noticed is that I will still get the same error as before if the password does not match the complexity requirements, I wonder if it's "safe" enough to assume that error is a password complexity issue so I can tell the user.  But it does also double as a "no permission" error or other generic reason why the change cant be made.

[water]

I had written a password tester when we activated password complexity. It's written in German but if you (or someone else) is interested I might translate it to English.

Another approach is to do the checks using Powershell.

You could incorporate this check into your script to make sure the password adheres to the complexity rules.

[ViciousXUSMC]

7 minutes ago, water said:

I had written a password tester when we activated password complexity. It's written in German but if you (or someone else) is interested I might translate it to English.

Another approach is to do the checks using Powershell.

You could incorporate this check into your script to make sure the password adheres to the complexity rules.

I wanted it to check against AD itself and say "this is good" or "this is not" but I bet I could also use RegEx and just check against it locally completely within autoit.

Have it not even allow clicking the change password button until complexity is met and a little notice about the password "rules" that still have not been met.

So perhaps something like a GUI label for each complexity rule and they disappear once regex determines the complexity is met.

After all the rules are met, allow clicking on the submit button.

That sounds kind of fun

I suppose password history would still be an issue, but it would get me most of the way there. 

Edited March 4, 2020 by ViciousXUSMC

[water]

That's exactly what my password tester does

[water]

I use the following MS sources to get the rules for the complexity check:

https://technet.microsoft.com/en-us/library/hh994562(v=ws.10).aspx

https://technet.microsoft.com/en-us/library/cc786468(v=ws.10).aspx

 

[water]

Version 1.5.0.0 of the UDF has been released.

Please test before using in production!

For download please see my signature.

[edumanilha]

Hello water! Everything is ok?

I tried to use the ad udf, but I need to connect to a especific DC and get the machines from a branch... The name patern for the branchs is filXXX.com. I tried as the function description said so I leave the first tree values blank and put only the DC name on the fourth field...The script take some time but returns couldnt connect msg...When we need to connect to this dc from home office or field we need a specific username, I tried to fill the first two fields with that information without successs too... I'll try a little more, but can you help me figure out how to aim to a specific DC from a branch? thanks in advance!

[edumanilha]

another problem I run into is when I start the script default...I get all company machines (8k more or less) but no IP's... that the example I'm using:

 

#include <AD.au3>

_AD_Open()

If @error Then
MsgBox(0, "", "unable to connect")
Exit
EndIf

$aComputers2 = _AD_GetObjectsInOU("", "(objectclass=computer)")

_AD_Close()

Local $results[1][1]

TCPStartup()

For $i = 1 To UBound($aComputers2) - 1
$ip_address = TCPNameToIP($aComputers2[$i])

ReDim $results[UBound($results) + 1][2]

$results[UBound($results) - 1][0] = $aComputers2[$i]
$results[UBound($results) - 1][1] = $ip_address

ConsoleWrite($aComputers2[$i] & @CRLF)
ConsoleWrite($ip_address & @CRLF)
ConsoleWrite(@CRLF)
Next

TCPShutdown()

_ArrayDisplay($results)

 

[water]

22 minutes ago, edumanilha said:

I need to connect to a especific DC

Do you store the computers of a branch in a specific OU?
Or do the names of the computer accounts start with the branch name?

[water]

This example retrieves the IP of the current computer. Replace $sComputers with "filxxx*" if your computer names start with the branch name.

#include <ad.au3>
_AD_Open()
$sComputers = @ComputerName
$aObjects = _AD_GetObjectsInOU("", "(&(objectclass=computer)(name=" & $sComputers & "))", 2, "sAMAccountName,displayname") ; Return at least 2 properties, the second will be overwritten with the IP
If @error > 0 Then
    MsgBox(64, "Active Directory Functions", "No objects could be found")
Else
    for $i = 1 to UBound($aObjects) - 1
        $aObjects[$i][0] = StringTrimRight($aObjects[$i][0], 1) ; Remove the trailing $
        $aObjects[$i][1] = TCPNameToIP($aObjects[$i][0])
    Next
    _ArrayDisplay($aObjects, "Computers")
EndIf

 

[edumanilha]

1 hour ago, water said:

Do you store the computers of a branch in a specific OU?
Or do the names of the computer accounts start with the branch name?

Studying your questions I find out that the machines I need to reach have no account in the OU...The machines start with the: "equip type" "number" "FIL" "FIL number"

Right now I tried some autoit ipscan to try another aproach but for some reason, maybe lag in my connection or the machines, mostly wireless, i couldn't get all the matches I saw in the server...

Can I fetch the machines in DC consulting dhcp leases?

[water]

4 minutes ago, edumanilha said:

Can I fetch the machines in DC consulting dhcp leases?

Not that I know of.

If you modify my script above you should be able to get all computers of a branch. Example to select branch number 0815

$sComputers = "*FIL0815"

 

[edumanilha]

Just now, water said:

Not that I know of.

If you modify my script above you should be able to get all computers of a branch. Example to select branch number 0815

$sComputers = "*FIL0815"

 

Thank you very much! I'll try! Have a nice day!

 

[edumanilha]

just one more question, so I won't need to change this part? I can't call the dc directly, so I'll scan all the domain right?

_AD_Open()

[water]

1 hour ago, edumanilha said:

another problem I run into is when I start the script default...I get all company machines (8k more or less)

This lets me assume that the default DC holds all machines (including the computers in your branches).
Correct? If yes then there is no need to connect to a specific DC.

[edumanilha]

2 minutes ago, water said:

This lets me assume that the default DC holds all machines (including the computers in your branches).
Correct? If yes then there is no need to connect to a specific DC.

I think the machines I need to reach are in the local server...Cause when I try default I'm calling the connected domain (company.com) besides I can see 8k machines equips or whatever...I cant see any the machines that are usually connected into the branches, just regular desktops and some unidentified equips... Some times when I need to connect to a branch server, I got a error msg and need to specify, like filxxx.com\username...

so when I run the script without parameters I can't reach the branches I think. Maybe I need to aim filXXX.com directly! In that case what can I try? I tried filling only the forth parameter, filling the first parameter with just username, with filxxx\username etc...