Active Directory UDF - Help & Support (III)

[water]

_AD_ErrorNotify(2)
$success = _AD_CreateGroup("OU=Lokale Administratoren,DC=my,DC=domain,DC=de", "_TEST121")
MsgBox(64, $ScriptName, "success: " & $success & @CRLF & "Error: " & @error & @CRLF & "extended: " & @extended)

[blumi]

Okay, changed it, thanks. 

Now I get

success = 0

Error = -2147352567

extended = 0

 

[blumi]

Did some autoit and udf updates the last minutes, no change. 

[water]

Line 845 is the

$oGroup.SetInfo

in function _AD_GroupCreate.
So there seems to be a problem when creating the group.
Maybe a permission problem (use other credentials for _AD_Open ...), a problem with the server you connected to (maybe you need to connect to the Global Catalog ...) etc. etc.
Google returns a long list of results.

As I have just read access to our AD I can't test myself.

[AlexMethuselah]

Hi author(s),

Many thanks for your great effort!

I have a couple of question in regards to 2 functions. 

1)_AD_IsPasswordExpired function tells, that the password has expired for John Smith (username: JSmith). I ran "net user  JSmith /domain" and found out, that "Password expires" is set to "Never". Is that a bug or intended?

2)_AD_GetObjectAttribute function is capable of returning AD computer description: _AD_GetObjectAttribute($sMachineName & "$","description"). When I try to feed it a computer name with empty description field I get an error (exception).

Thank you

[water]

1. Which version of the AD UDF do you run? Run _AD_VersionInfo.au3 to get this information.
   Do you use the Fine grained Password Policy (FGPP)?
   What is the return value of _AD_IsPasswordExpired, @error and @extended?
2. You should get @error = 2 when $sAttribute does not exist for $sObject.
   Which version of AutoIt do you run? For versions < 3.3.9.2 and > 3.3.12.0 the AD COM error handler should handle the situation.
   Else add _AD_ErrorNotify(4) at the top of your script.

[AlexMethuselah]

Hi water,

1)Release type  V (production), Major version 1, Minor version 5, Sub version 4.1.

I think our domain uses Fine grained password policy, but I'm not sure I have access rights to tell for sure. Return value of _AD_IsPasswordExpired is 1. @error is 0 and @extended is also 0;

2) The attribute exists and Attribute editor shows "description" attribute as "not set". AutoIt version: 3.3.14.5. See exception attached. Correct, after it I get @error=2.

[water]

1. _AD_IsPasswordExpired mainly uses _AD_GetPasswordInfo.
   Could you please run _AD_GetPasswordInfo.au3 and post the result (at least rows 9, 11 and 13?
2. Seems you use a different COM error handler (provided by the ADODB UDF).
   Could you please deactivate the ADODB COM error handler so the AD COM error handler can handle the COM error?

[AlexMethuselah]

1. Please find the output (rows 8-13) attached

2. I deactivated error handler by commenting the following string:

;Global $errADODB = ObjEvent("AutoIt.Error","_ErrADODB")
Now I don't get any errors (even from AD COM handler).

[water]

1. Strange, your column 0 (description) is missing. My output looks like this:
   
   Did you run _AD_GetPasswordInfo.au3 or did you create your own script to extract the information?
   
   What is the value of Row 1 "Maximum Password Age (days)"?
    
2. _AD_Open uses its own COM error handler when none is active. If you want to get all error messages you could call _AD_ErrorNotify(2) before _AD_Open.

[water]

 

Version 1.6.0.0 of the UDF has been released.

Now you get a help file that looks like the AutoIt help.

Please test before using in production!

For download please see my signature.

 

[water]

Version 1.6.1.0 of the UDF has been released.

Please test before using in production!

For download please see my signature.

[gcue]

is there a way to filter AD groups based off a wildcard?

for instance - can _AD_GetObjectsInOU("", "(objectcategory=group)", 2, "sAMAccountName") be used along with a wildcard to include only groups that start with "APPL_" and "APZ_" or is there another way to easily get a listing of those groups other than a for loop through all the ad groups?

thank you for the amazing UDF!

thanks in advance

[water]

Sure. The wiki describes how to use _AD_GetObjectsInOU and links you to a site where they explain how to create LDAP queries.
So it should be something like: "(&(objectcategory=group)(name=APPL_*))"

[gcue]

thank you!  i was able to search for one of the wildcard but couldnt figure out the syntax for 2

tried but neither worked

"(&(objectcategory=group)(name=APPL_* AND name=APZ_*))"

"(&(objectcategory=group)(name=APPL_*)(name=APZ_*))"

"(&(&(objectcategory=group)(name=APPL_*)(name=CPZ_PRD_*)))" (from wiki example)

 

Edited March 25, 2022 by gcue

[water]

& stands for AND
| stands for OR
You are looking for groups whose name start with APZ_ OR APPL_ OR CPZ_PRD_. The syntax gets a bit more complex now:

"(&(objectcategory=group)(|(name=APPL_*)(name=APZ_*)(name=CPZ_PRD_*)))"

See "Nested Operation" on the SelfADSI page.

 

Edited March 25, 2022 by water

[gcue]

awesome thank you!

[water]

 

[nikink]

Hi I'm trying to detect the existence of a computer object but _AD_ObjectExists is only returning 0.

My code:

_AD_Open()
    If @error Then
        Local $sError = @error, $sExtended = @extended
        Local $sAD_Hive = "HKLM", $sErrorMsg
        If @OSArch = "IA64" Or @OSArch = "X64" Then $sAD_Hive = "HKLM64"
        Local $sAD_OSVersion = RegRead($sAD_Hive & "\SOFTWARE\Microsoft\Windows NT\CurrentVersion", "CurrentVersion")
        $sAD_OSVersion = StringSplit($sAD_OSVersion, ".")
        If Int($sAD_OSVersion[1]) >= 6 Then ; Delivers detailed error information for Windows Vista and later if debugging is activated
            Local $aAD_Errors = _AD_GetLastADSIError()
            If $aAD_Errors[4] <> 0 Then $sErrorMsg = $aAD_Errors[5]
        EndIf
        LogMe("Error accessing the Active Directory. @Error: " & $sError & ", @extended: " & $sExtended & @CRLF & $sErrorMsg)
    Else
        LogMe('Connected to AD')
    EndIf

    Local $iResult = _AD_ObjectExists($sComputerName)
    LogMe("RESULT! [" & $iResult & "]")
    _AD_Close()

$iResult is always 0.

I've tried _AD_ObjectExists("$" & $sComputerName) as well.

I'm sure it's something incredibly obvious but I just can't see it. Any help appreciated!

[DonChunior]

3 hours ago, nikink said:

Hi I'm trying to detect the existence of a computer object but _AD_ObjectExists is only returning 0.

$iResult is always 0.

I've tried _AD_ObjectExists("$" & $sComputerName) as well.

I'm sure it's something incredibly obvious but I just can't see it. Any help appreciated!

What is the result if you try @ComputerName instead of $sComputerName?