Active Directory UDF - Help & Support (III)

[water]

As long as it works for you and you still understand how it works when looking at it again in a year or later then your code is perfect.

[kor]

Question on script efficiency.

If I call _AD_MoveObject what is more efficient?

1) running a check first to see where the object is, and if its already in the place I want to move it to then skip AD_MoveObject

2) dont run a check, run AD_MoveObject regardless and let it fail and move on to the next object in the loop

I have a script that moves computers around to the right OU's based on certain criteria. My environment is roughly 32,000 computer objects with about 150 OU's.

So basically that is 32,000*150 checks = 4.8 million checks each time the script runs.

[water]

_AD_MoveObject already checks if the object exists in the target OU. If it does it returns @error = 3.

If performance is an issue I would strip down function _AD_MoveObject to the bare minimum 8and give it a new name).

Checks for the object and the target OU could be removed etc.

[water]

BTW: Why do you think you need to do 4.8 million checks?

I would retrieve a list of computers, check the OU and if the computer is in the wrong OU then move it.

I have created a new function to extract the OU from an object. If needed I can post here.

[kor]

BTW: Why do you think you need to do 4.8 million checks?

I would retrieve a list of computers, check the OU and if the computer is in the wrong OU then move it.

I have created a new function to extract the OU from an object. If needed I can post here.

I don't know if the computer is in the wrong OU until I do an nslookup on the computer and get it's IP address.

Then based on the 2nd octet of the IP I know which OU it's *supposed* to be in, then I move it.

so my script does all that, but it has to check each computer to make sure its in the right OU, and if not.. move it. If it is in the right OU skip it and move on.

[BrewManNH]

You don't need to check all 150 OUs for the computer, you only need to check the OU the computer is SUPPOSED to be in by your IP check. If it's not in there then you move it to the correct OU. That means you only need to do, at the absolute most, 32000 checks.

You can actually remove checking to see if it's in the correct OU and just try and move it to the correct OU, if it's already there it shouldn't cause any issues, because it's already there.

[kor]

You don't need to check all 150 OUs for the computer, you only need to check the OU the computer is SUPPOSED to be in by your IP check. If it's not in there then you move it to the correct OU. That means you only need to do, at the absolute most, 32000 checks.

You can actually remove checking to see if it's in the correct OU and just try and move it to the correct OU, if it's already there it shouldn't cause any issues, because it's already there.

I calculated wrong. It's not actually doing 4.8 million checks, its still only doing 32,000 checks...BUT

it has to loop through the array that matches the 2nd octet to the correct OU for each of the 32,000 checks. Much less resource intensive, but an array loop of 150 for each of the 32,000 checks none the less.

[water]

I would do it the other way round. Do not create an array with the 150 possible OUs. But create an array with 256 elements (the possible values 0-255 for the octet). Every element of the array should contain the correct OU. You grab the 2nd octet of the IP and use it to directly access the corresponding element in the array.

[water]

I have modified function _AD_GetObjectsInOU. You can now specify the value to be returned when a property has never been set and will be returned as NULLL if you do not specify parameter $vReturnNull.

This comes in handy when you try to write the returned array to Excel.

$vReturnNull = True. Returns NULL as it has done before

$vReturnNull = False. Returns ""

$vReturnNull = "string". Returns the specified string.

expandcollapse popup

; #FUNCTION# ====================================================================================================================
; Name...........: _AD_GetObjectsInOU
; Description ...: Returns a filtered array of objects and attributes for a given OU or just the number of records if $bCount is True.
; Syntax.........: _AD_GetObjectsInOU($sOU[, $sFilter = "(name=*)"[, $iSearchScope = 2[, $sDataToRetrieve =  "sAMAccountName"[, $sSortBy = "sAMAccountName"[, $bCount = False[, $vReturnNull = True]]]]])
; Parameters ....: $sOU - The OU to retrieve from (FQDN) (default = "", equals "search the whole AD tree")
;                  $sFilter - Optional: An additional LDAP filter if required (default = "(name=*)")
;                  $iSearchScope - Optional: 0 = base, 1 = one-level, 2 = sub-tree (default)
;                  $sDataToRetrieve - Optional: A comma-seperated list of attributes to retrieve (default = "sAMAccountName").
;                  |More than one attribute will create a 2-dimensional array
;                  $sSortBy - Optional: name of the attribute the resulting array will be sorted upon (default = "sAMAccountName").
;                  |To completely suppress sorting (even the default sort) set this parameter to "". This improves performance when doing large queries
;                  $bCount - Optional: If set to True only returns the number of records returned by the query (default = False)
;                  $vReturnNull - Optional: If set to any other value but True Null values (occur when the property has never been set) are returned as this value (default = True)
; Return values .: Success - Number of records retrieved or a one or two dimensional array of objects and attributes in the given OU. First entry is for the given OU itself
;                  Failure - "", sets @error to:
;                  |1 - Specified OU does not exist
;                  |2 - No records returned from Active Directory. $sDataToRetrieve is invalid (attribute may not exist). @extended is set to the error returned by LDAP
;                  |3 - No records returned from Active Directory. $sFilter didn't return a record
; Author ........: Jonathan Clelland
; Modified.......: water
; Remarks .......: Multi-value attributes are returned as string with the pipe character (|) as separator.
;+
;                  The default filter returns an array including one record for the OU itself. To exclude the OU use a different filter that doesn't include the OU
;                  e.g. "(&(objectcategory=person)(objectclass=user)(name=*))"
;+
;                  To make sure that all properties you specify in $sDataToRetrieve exist in the AD you can use _AD_ObjectExistsInSchema.
;+
;                  The following examples illustrate the use of the escaping mechanism in the LDAP filter:
;                    (o=Parens R Us \28for all your parenthetical needs\29)
;                    (cn=*\2A*)
;                    (filename=C:\5cMyFile)
;                    (bin=\00\00\00\04)
;                    (sn=Lu\c4\8di\c4\87)
;                  The first example shows the use of the escaping mechanism to represent parenthesis characters.
;                  The second shows how to represent a "*" in a value, preventing it from being interpreted as a substring indicator.
;                  The third illustrates the escaping of the backslash character.
;                  The fourth example shows a filter searching for the four-byte value 0x00000004, illustrating the use of the escaping mechanism to
;                  represent arbitrary data, including NUL characters.
;                  The final example illustrates the use of the escaping mechanism to represent various non-ASCII UTF-8 characters.
; Related .......: _AD_GetAllOUs
; Link ..........:
; Example .......: Yes
; ===============================================================================================================================
Func _AD_GetObjectsInOU($sOU = "", $sFilter = "(name=*)", $iSearchScope = 2, $sDataToRetrieve = "sAMAccountName", $sSortBy = "sAMAccountName", $bCount = False, $vReturnNull = True)

    If $sOU = "" Then
        $sOU = $sAD_DNSDomain
    Else
        If _AD_ObjectExists($sOU, "distinguishedName") = 0 Then Return SetError(1, 0, "")
    EndIf
    Local $sReturnNull = ""
    If Not IsBool($vReturnNull) Then
        $sReturnNull = $vReturnNull
        $vReturnNull = False
    EndIf
    Local $iCount2, $aDataToRetrieve, $aTemp
    If $sDataToRetrieve = "" Then $sDataToRetrieve = "sAMAccountName"
    $sDataToRetrieve = StringStripWS($sDataToRetrieve, 8)
    $__oAD_Command.Properties("Searchscope") = $iSearchScope
    $__oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sOU & ">;" & $sFilter & ";" & $sDataToRetrieve
    $__oAD_Command.Properties("Sort On") = $sSortBy
    Local $oRecordSet = $__oAD_Command.Execute
    If @error Or Not IsObj($oRecordSet) Then Return SetError(2, @error, "")
    Local $iCount1 = $oRecordSet.RecordCount
    If $iCount1 = 0 Then
        If $bCount Then Return SetError(3, 0, 0)
        Return SetError(3, 0, "")
    EndIf
    If $bCount Then Return $iCount1
    If StringInStr($sDataToRetrieve, ",") Then
        $aDataToRetrieve = StringSplit($sDataToRetrieve, ",")
        Local $aObjects[$iCount1 + 1][$aDataToRetrieve[0]]
        $aObjects[0][0] = $iCount1
        $aObjects[0][1] = $aDataToRetrieve[0]
        $iCount2 = 1
        $oRecordSet.MoveFirst
        Do
            For $iCount1 = 1 To $aDataToRetrieve[0]
                If IsArray($oRecordSet.Fields($aDataToRetrieve[$iCount1]).Value) Then
                    $aTemp = $oRecordSet.Fields($aDataToRetrieve[$iCount1]).Value
                    $aObjects[$iCount2][$iCount1 - 1] = _ArrayToString($aTemp)
                Else
                    $aObjects[$iCount2][$iCount1 - 1] = $oRecordSet.Fields($aDataToRetrieve[$iCount1]).Value
                    If Not $vReturnNull And IsKeyword($aObjects[$iCount2][$iCount1 - 1]) = $KEYWORD_NULL Then $aObjects[$iCount2][$iCount1 - 1] = $sReturnNull
                EndIf
            Next
            $oRecordSet.MoveNext
            $iCount2 += 1
        Until $oRecordSet.EOF
    Else
        Local $aObjects[$iCount1 + 1]
        $aObjects[0] = UBound($aObjects) - 1
        $iCount2 = 1
        $oRecordSet.MoveFirst
        Do
            If IsArray($oRecordSet.Fields($sDataToRetrieve).Value) Then
                $aTemp = $oRecordSet.Fields($sDataToRetrieve).Value
                $aObjects[$iCount2] = _ArrayToString($aTemp)
            Else
                $aObjects[$iCount2] = $oRecordSet.Fields($sDataToRetrieve).Value
            EndIf
            $oRecordSet.MoveNext
            $iCount2 += 1
        Until $oRecordSet.EOF
    EndIf
    $__oAD_Command.Properties("Sort On") = "" ; Reset sort property
    Return $aObjects

EndFunc   ;==>_AD_GetObjectsInOU

Comments are welcome!

[jcpetu]

Hi Water,

I'm trying to get the IP number of printers defined in Print servers in AD with:

Local $aPrinterDetails = _AD_GetObjectProperties($aPrintQueues[1][2])

But the returned IP for each printer belongs to the first printer defined in the server, that is to say, all are the same.

Would you please help me.

Thanks in advance.

[water]

Will check as soon as I return from vacation.

[jcpetu]

OK, Thanks a lot and have a GOOD VACATION.

[GreenCan]

I'm trying to get the IP number of printers defined in Print servers in AD with:

Local $aPrinterDetails = _AD_GetObjectProperties($aPrintQueues[1][2])

But the returned IP for each printer belongs to the first printer defined in the server

Hi jcpetu,

I don't think there is anything wrong with AD_GetObjectProperties.  You didn't attach the script but I guess you always query the same queue ($aPrintQueues[1][2]).

You have to loop through all print queues in the array

For $i = 1 to $aPrinterQueues[0][0]
 $aPrinterDetails = _AD_GetObjectProperties($aPrinterQueues[$i][2])
Next

The attached example works fine, and gives the IP address for every printer in AD.

AD - Get Printer Info (to text).au3

I slightly modified waters _AD_ListPrintQueues function because we have mioe than 1000 printers (and far too many on 1 print server) in the group and I am only interested in my location (_AD_ListPrintQueues2)

GreenCan

Edited April 24, 2015 by GreenCan

[water]

I'm going to modify _AD_ListPrintQueues so you can filter on printer names as well. The printer name filter will reduce the number of print queues returned by the LDAP query so the overall processing time should drop as well.

[GreenCan]

I'm going to modify _AD_ListPrintQueues so you can filter on printer names as well. The printer name filter will reduce the number of print queues returned by the LDAP query so the overall processing time should drop as well.

giving you new ideas?  

Edited April 24, 2015 by GreenCan

[water]

Correct

If new ideas are so easy to implement I'm always ready to modify the UDF.

[jcpetu]

HI GreenCan, thanks a lot it works very well now. I just added Water search by OU to reduce the seeking time in large installations.

Here it is in case it can be useful for someone.

Regards.

expandcollapse popup

; #FUNCTION# ====================================================================================================================
; Name...........: AD_ListPrintQueuesByOU

; Description ...: Enumerates all PrintQueues in the AD tree,the specified spool server or OU.
; Syntax.........: _AD_ListPrintQueues([$sServername=*[, $sOU = ""[, $iSearchScope = 2]]])
; Parameters ....: $sServername  - Optional: Short name of the spool server to process
;                  $sOU          - Optional: The OU to retrieve from (FQDN) (default = "", equals "search the whole AD tree")
;                  $iSearchScope - Optional: 0 = base, 1 = one-level, 2 = sub-tree (default)
; Return values .: Success - One-based two dimensional array with the following information:
;                  |0 - PrinterName: Short name of the PrintQueue

;                  |1 - ServerName: SpoolServerName.Domain
;                  |2 - DistinguishedName: FQDN of the PrintQueue

;                  Failure - "", @error set
;                  |1 - There is no PrintQueue available. @extended is set to the error returned by LDAP
;                  |2 - Specified OU does not exist
; Author ........: water (based on VB code by Richard L. Mueller)
; ===============================================================================================================================
Func AD_ListPrintQueuesByOU($sServername = "*", $sOU = "", $sPrinterName = "*", $iSearchScope = 2)
    If $sOU = "" Then
        $sOU = $sAD_DNSDomain
    Else
        If _AD_ObjectExists($sOU, "distinguishedName") = 0 Then Return SetError(2, 0, "")
    EndIf
    $__oAD_Command.Properties("Searchscope") = $iSearchScope
    $__oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sOU & ">;(&(objectclass=printQueue)(shortservername=" & $sServername & "));distinguishedName,PrinterName,ServerName"
    Local $oRecordSet = $__oAD_Command.Execute
    If @error Or Not IsObj($oRecordSet) Or $oRecordSet.RecordCount = 0 Then Return SetError(1, @error, "")
    Local $aPrinterList[$oRecordSet.RecordCount + 1][3] = [[0, 3]]
    $oRecordSet.MoveFirst
    Do
        Local $sTest = $oRecordSet.Fields("printerName").Value
        If $sPrinterName = "*" Or StringInStr($sTest, $sPrinterName) > 0 Then
            $aPrinterList[0][0] += 1
            $aPrinterList[$aPrinterList[0][0]][0] = $sTest ;$oRecordSet.Fields("printerName").Value
            $aPrinterList[$aPrinterList[0][0]][1] = $oRecordSet.Fields("serverName").Value
            $aPrinterList[$aPrinterList[0][0]][2] = $oRecordSet.Fields("distinguishedName").Value
        EndIf
        $oRecordSet.MoveNext
    Until $oRecordSet.EOF
    $oRecordSet.Close
    Return $aPrinterList
EndFunc   ;==>AD_ListPrintQueuesByOU

 

 

 

 

 

 

 

 

 

 

[GreenCan]

HI GreenCan, thanks a lot it works very well now. I just added Water search by OU to reduce the seeking time in large installations.

Here it is in case it can be useful for someone.

Regards.

​Nice, thanks

[water]

expandcollapse popup

; #FUNCTION# ====================================================================================================================
; Name...........: _AD_ListPrintQueues
; Description ...: Enumerates all PrintQueues in the AD tree, the specified spool server or OU.
; Syntax.........: _AD_ListPrintQueues([$sServername="*"[, $sOU = ""[, $iSearchScope = 2, [$sPrintQueues="*"]]])
; Parameters ....: $sServername  - Optional: Short name of the spool server to process. LDAP wildcards apply (default = "*", equals "search all servers")
;                  $sOU          - Optional: The OU to retrieve from (FQDN) (default = "", equals "search the whole AD tree")
;                  $iSearchScope - Optional: 0 = base, 1 = one-level, 2 = sub-tree (default)
;                  $sPrintQueues - Optional: Short name of the printqueues to search for. LDAP wildcards apply (default = "*", equals "search all print queues")
; Return values .: Success - One-based two dimensional array with the following information:
;                  |0 - PrinterName: Short name of the PrintQueue
;                  |1 - ServerName: SpoolServerName.Domain
;                  |2 - DistinguishedName: FQDN of the PrintQueue
;                  Failure - "", @error set
;                  |1 - There is no PrintQueue available. @extended is set to the error returned by LDAP
;                  |2 - Specified OU does not exist
; Author ........: water
; Modified.......:
; Remarks .......: To get more (including multi-valued) attributes of a printqueue use _AD_GetObjectProperties
; Related .......:
; Link ..........: http://msdn.microsoft.com/en-us/library/aa706091(VS.85).aspx, http://www.activxperts.com/activmonitor/windowsmanagement/scripts/printing/printerport/#LAPP.htm
; Example .......: Yes
; ===============================================================================================================================
Func _AD_ListPrintQueuesEX($sServername = "*", $sOU = "", $iSearchScope = 2, $sPrintQueues = "*")

    If $sOU = "" Then
        $sOU = $sAD_DNSDomain
    Else
        If _AD_ObjectExists($sOU, "distinguishedName") = 0 Then Return SetError(2, 0, "")
    EndIf
    $__oAD_Command.Properties("Searchscope") = $iSearchScope
    $__oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sOU & ">;(&(objectclass=printQueue)(shortservername=" & $sServername & ")(PrinterName=" & $sPrintQueues & "));distinguishedName,PrinterName,ServerName"
    Local $oRecordSet = $__oAD_Command.Execute
    If @error Or Not IsObj($oRecordSet) Or $oRecordSet.RecordCount = 0 Then Return SetError(1, @error, "")
    Local $aPrinterList[$oRecordSet.RecordCount + 1][3] = [[0, 3]]
    $oRecordSet.MoveFirst
    Do
        $aPrinterList[0][0] += 1
        $aPrinterList[$aPrinterList[0][0]][0] = $oRecordSet.Fields("printerName").Value
        $aPrinterList[$aPrinterList[0][0]][1] = $oRecordSet.Fields("serverName").Value
        $aPrinterList[$aPrinterList[0][0]][2] = $oRecordSet.Fields("distinguishedName").Value
        $oRecordSet.MoveNext
    Until $oRecordSet.EOF
    $oRecordSet.Close
    Return $aPrinterList

EndFunc   ;==>_AD_ListPrintQueues

This is the new _AD_ListPrintQueues function which will be part of the next version of the AD UDF.

Any comments?

[tweakster2010]

Stopping in here as I havent seen a post from this in awhile! The New format does make checking this particular forum a little tougher for me as this is a HUGE source of a lot of what I am adding functionally to the tool I am working on for my job. 

To address your question Water, will that also list based on users or will that be based on the account accessing, I noticed when I use powershell as well it struggles to return me the values of a logged in user for their printers most of the time.

Also I am looking at adding in a timer that refreshes on each access of a passwordmanager I created.

 

_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get the password info
Global $aAD_PwdInfo[13]



Global $aTemp = _AD_GetPasswordInfo()
For $iCount = 1 To $aTemp[0]
    $aAD_PwdInfo[$iCount] = $aTemp[$iCount]
Next
$aAD_PwdInfo[0] = $aTemp[0]

;_ArrayDisplay($aAD_PwdInfo, "Active Directory Functions - Example 1")
MsgBox(0,"test", _ArrayToString($aAD_PwdInfo,@CRLF,9,9))
; Close Connection to the Active Directory
_AD_Close()

This is what I stripped it to for confirming its pulling the data I want out of it. But when I was thinking about it it looks like its only hitting the username initially would I have to do a call like so....

_AD_Open()
Global $sFQDN = _AD_SamAccountNameToFQDN(GuiCtrlRead($Username))

Global $sDisplayName = _AD_FQDNToDisplayname(GuiCtrlRead($Username))

To get the password info from another account? I am still playing around with it but its a theory atm that i havent pushed on much. >.>

Reason(I have 2 IDs 1 for regular access 1 for admin access and the password manager program is designed so far(still baby phase) to display my time out period.) I also plan on setting it to access to changing the password on updating same said accounts.

 

Sorry for a little rambling in there. >.>