Active Directory UDF - Help & Support (III)

[jazzyjeff]

Thanks Water. I'll do that :-)

[water]

I use the following lines to create a mailbox:

$sCMD = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command . " & _
    "'D:\Exchange Server\V14\bin\RemoteExchange.ps1'; Connect-ExchangeServer -auto; Enable-Mailbox -Identity " & _
    $Kurzzeichen & " -Alias " & $Kurzzeichen & " -Database " & $sEXDatabase & $sSMTPAddress
$pid = Run($sCMD, @SystemDir, @SW_HIDE, $STDIN_CHILD + $STDOUT_CHILD + $STDERR_CHILD)

[jazzyjeff]

Thanks Water. I used this to remove the mailbox.

RunAsWait("username","domain","password",0,@ComSpec & " /c %windir%\system32\WindowsPowerShell\v1.0\powershell.exe -command Add-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010 ; " & _
"remove-mailbox -identity domain\" & _GUICtrlListView_GetItemText($list,$i - 1) & " -Permanent $true -confirm:$false","",@SW_HIDE)

[water]

Fine. How is performance and CPU/storage consumption?

Defining the Mailxbox takes about 40 seconds and uses a lot of CPU and 100MB.

[jazzyjeff]

I never even looked at this information. I have and i5 Processor and while the script was running through a 112 users in an OU, the machine never felt sluggish. Running this command on it's own took about 5 seconds to complete, but that possibly varied depending on the user and their mailbox size.

It took care of removing the mailbox and the AD user account for me though.

[jazzyjeff]

Water,

I have an issue with the _AD_Open function that is causing one of my scripts to crash. Not sure why it is causing just this particular script to crash, but this is the error I get:

 

So I started adding message boxes to pop up, so I could then see where the problem was occurring. It starts right at the beginning of my script.

$loading = SplashTextOn("Loading...", "Gathering Application Store software list...", 339, 65, -1, -1)
$Label1 = GUICtrlCreateLabel("Gathering Application Store software list...", 10, 8, 280, 22)

MsgBox(0, "", @CR & @CR & @CR & @CR & @CR & @CR & @CR & @CR & @CR & @CR & @CR & @CR & @CR & "Check 0.1")
_AD_Open()
MsgBox(0, "", @CR & @CR & @CR & @CR & @CR & @CR & @CR & @CR & @CR & @CR & @CR & @CR & @CR & "Check 1")

The script never reaches the message box "Check 1", so I know it is breaking on the function _AD_Open().

So now I use the message box technique to tell me where it is breaking in the AD.au3 file. Here is how I modified it for testing:

expandcollapse popup

Func _AD_Open($sUserIdParam = "", $sPasswordParam = "", $sDNSDomainParam = "", $sHostServerParam = "", $sConfigurationParam = "", $iSecurity = 0)
    MsgBox(0,"AD", "Test 1")
    $__oAD_Connection = ObjCreate("ADODB.Connection") ; Creates a COM object to AD
    MsgBox(0,"AD", "Test 2")
    If @error Or Not IsObj($__oAD_Connection) Then Return SetError(2, @error, 0)
    MsgBox(0,"AD", "Test 3")
    ; Activate the COM error handler for older AutoIt versions
    #cs ; *************************** Turned off to prevent application crashing ****************************************
    If $__iAD_Debug = 0 And Number(StringReplace(@AutoItVersion, ".", "")) < 3392 Then
        MsgBox(0,"AD", "Test 3.1")
        _AD_ErrorNotify(1)
        MsgBox(0,"AD", "Test 3.2")
        SetError(0) ; Reset @error which is returned by _AD_ErrorNotify if a COM error handler has already been set up by the user
        MsgBox(0,"AD", "Test 3.3")
    EndIf
    #ce
    MsgBox(0,"AD", "Test 4")
    ; ConnectionString Property (ADO): http://msdn.microsoft.com/en-us/library/ms675810.aspx
    $__oAD_Connection.ConnectionString = "Provider=ADsDSOObject" ; Sets Service providertype
    MsgBox(0,"AD", "Test 5")
    If $sUserIdParam <> "" Then
        MsgBox(0,"AD", "Test 6")
        If $sPasswordParam = "" Then Return SetError(7, 0, 0)
        MsgBox(0,"AD", "Test 7")
        $__oAD_Connection.Properties("User ID") = $sUserIdParam ; Authenticate User
        $__oAD_Connection.Properties("Password") = $sPasswordParam ; Authenticate User
        If BitAND($iSecurity, 1) = 1 Then $__oAD_Connection.Properties("Encrypt Password") = True ; Encrypts userid and password
        MsgBox(0,"AD", "Test 8")
        $__bAD_BindFlags = $ADS_SERVER_BIND
        If BitAND($iSecurity, 2) = 2 Then $__bAD_BindFlags = BitOR($__bAD_BindFlags, $ADS_USE_SSL)
        MsgBox(0,"AD", "Test 9")
        ; If userid is the Windows login name then set the flag for secure authentification
        If StringInStr($sUserIdParam, "\") = 0 And StringInStr($sUserIdParam, "@") = 0 Then _
                $__bAD_BindFlags = BitOR($__bAD_BindFlags, $ADS_SECURE_AUTH)
                MsgBox(0,"AD", "Test 10")
        $__oAD_Connection.Properties("ADSI Flag") = $__bAD_BindFlags
        $sAD_UserId = $sUserIdParam
        $sAD_Password = $sPasswordParam
    EndIf
    MsgBox(0,"AD", "Test 11")
    ; ADO Open Method: http://msdn.microsoft.com/en-us/library/ms676505.aspx
    $__oAD_Connection.Open() ; Open connection to AD
    MsgBox(0,"AD", "Test 12")

I never get past the message box, Test 4, so I believe it is breaking on the line:

$__oAD_Connection.ConnectionString = "Provider=ADsDSOObject" ; Sets Service providertype

Now I did comment out the code below, because it was crashing on this bit and I figured that I probably didn't need this anyway.

If $__iAD_Debug = 0 And Number(StringReplace(@AutoItVersion, ".", "")) < 3392 Then
        MsgBox(0,"AD", "Test 3.1")
        _AD_ErrorNotify(1)
        MsgBox(0,"AD", "Test 3.2")
        SetError(0) ; Reset @error which is returned by _AD_ErrorNotify if a COM error handler has already been set up by the user
        MsgBox(0,"AD", "Test 3.3")
    EndIf

The line in red seems pretty important though, so I don't want to mess around much more without understanding whats wrong.

Now this problem doesn't occur on all machines. For example my machine, the program works fine. Admin rights isn't the issue either, because it works on machines where the user doesn't have admin rights.

I am using AD script version 1.4.1.

Autoit version 3.3.10.2

Any help you can offer is appreciated.

Jeff

[jazzyjeff]

Ok, so I rolled back the AutoIT version on another machine to recompile the project. It is now on version 3.3.8.1 and your UDF is now at 1.4.0. it's not ideal, but it's working. If you have a reason why this error is occurring, it would be good to know.

[water]

What do you get if you insert

_AD_ErrorNotify(2)

before _AD_Open?

[jazzyjeff]

It still crashed. 

I looked at the function though and noticed it would create a debug in the ScriptDir. I knew that wouldn't be possible because I only allow read access for users in the ScriptDir, so I figured I'd move the script to the users desktop and run it. From the desktop the script runs fine, so it just has a problem over the network.

There probably isn't more you can do here.

Thanks for you help

[water]

_AD_ErrorNotify(2) shouldn't prevent the script from crashing. It should just display a MsgBox (not write to any disk) when a COM error occurres.

I had a similar problem where a compiled script doesn't run from a network drive.

That was caused by Windows 7 only allowing to run executables from a limited list of "trusted locations". Ask your system admin if your network location is such a "trusted lcoation".

[Iceman682]

Hope someone is able to assist here.

As a local Administrator on a workgroup I have the _AD_OPEN(DomainUserName,Password) command to make a connection to AD to write and append to a .csv file on a network share.

This works fine and I can access network resources as local Administrator however after changes have been made I want to close this connection. I have used _AD_CLOSE() but it seems the connection is still open. I'm probably going about this wrong, has anyone any ideas?

_AD_Open("Domain\UserName", "Password") ; Do processing with predefined account permissions
    ; Create a constant variable in Local scope of the filepath that will be read/written to.
    Local Const $sFilePath = "\\share\FileName.csv" ; change as required to your shared location
    ; Create a temporary file to write data to.
    If Not FileCreate($sFilePath, "header1 " & "," & "header2 "  & @CRLF) Then Return MsgBox(0, "", "An error occurred, please try again in a few minutes.")
    ; Open the file for writing (append to the end of a file) and store the handle to a variable.
    Local $hFileOpen = FileOpen($sFilePath, $FO_APPEND)
    If $hFileOpen = -1 Then
        MsgBox(0, "", "An error occurred when reading the file, please try again in a few minutes.")
        Return False
    EndIf
    ; Write data to the file using the handle returned by FileOpen.
    FileWriteLine($hFileOpen, "Details1" & "," & "Detail 2" & @CRLF)
    ; Close the handle returned by FileOpen.
    FileClose($hFileOpen)
EndFunc   ;==>Monitor
; Create a file.
Func FileCreate($sFilePath, $sString)
    Local $fReturn = True ; Create a variable to store a boolean value.
    If FileExists($sFilePath) = 0 Then $fReturn = FileWrite($sFilePath, $sString) = 1 ; If FileWrite returned 1 this will be True otherwise False.
    Return $fReturn ; Return the boolean value of either True of False, depending on the return value of FileWrite.
EndFunc   ;==>FileCreate
_AD_Close()

Edited May 6, 2014 by Iceman682

[water]

What's the value of @error after _AD_Close?

[Iceman682]

Hi Water

@error = 0

[water]

So if there is no error returned by _AD_Close what makes you think that the connection is still open?

[Iceman682]

When the application is closed I am still able to navigate to the folder that has the file in it.

Is the AD closure immediate or can it take a min or two?

I have managed to resolve a different way by using _WinNet_AddConnection2 and _WinNet_CancelConnection2 instead. Thanks for the replies.

Edited May 11, 2014 by Iceman682

[water]

AD has nothing to do with accessing a directory.

If the application has ended, do you still see the process in the task manager?

[Iceman682]

It does if you are logged on to a workgroup machine as the local administartor.

If you want to access a domain network share from that machine you have to authenticate with domain credentials before you are able to navigate successfully to that share. Or am I wrong?

Edited May 17, 2014 by Iceman682

[water]

_AD_Open is only needed when connecting to a domain controller to query or update AD.

If you want to connect to a network share you might need to provide credentials too. But these are then used by the file service which checks them against the AD.

That's my understanding.

[JoshuaBarnette]

I use this UDF frequently, so firstly thank you!!! Second, on Windows 8/8.1, I seem to be having some slowness connecting to AD. My script gets the members of an AD group then loops through the members to get account properties such as First Name, Last Name, E-Mail, and SAM Account Name. On Windows 7 and XP the code runs in less than 20 Seconds, on WIndows 8/8.1 it is longer, more than 30 minutes for the exact same code. I am including the relevant code, please let me know if it is an issue with Windows, the UDF, or my code? I am ok with any answer, I just need to know how to correct it.

expandcollapse popup

#Region ; Check If Current User Is A Member of The AD Group: Information Services
    LS_SplashScreen("Update", "Retrieving Information Services Group From AD...")
    Global $Current_UserName = @UserName
    Global $Current_FullName = @UserName
    Global $Current_UserName_IsIS = 0
    Global $UserName_DropDown_Content = ""

    _AD_Open($LS_AD_User & "@" & $LS_AD_Domain, $LS_AD_Password, $LS_AD_DNSDomain, $LS_AD_HostServer, $LS_AD_Configuration)
        $Information_Services = _AD_GetGroupMembers("CN=IT Personnel,OU=Security Groups,DC=Domain,DC=com")
    _AD_Close()

    If IsArray($Information_Services) Then
        _ArrayDisplay($Information_Services)
        Dim $ISTech_List[$Information_Services[0]+1][5]
        _AD_Open($LS_AD_User & "@" & $LS_AD_Domain, $LS_AD_Password, $LS_AD_DNSDomain, $LS_AD_HostServer, $LS_AD_Configuration)
        For $a = 1 To $Information_Services[0]
            $Temp_Information_Services = _AD_GetObjectProperties($Information_Services[$a], "GivenName, Mail, sAMAccountName, SN")
            If IsArray($Temp_Information_Services) Then
                _ArrayDisplay($Temp_Information_Services)
                If $Temp_Information_Services[0][0] = 4 Then
                    $ISTech_List[$a][0] = $Temp_Information_Services[3][1]
                    $ISTech_List[$a][1] = $Temp_Information_Services[4][1]
                    $ISTech_List[$a][2] = $Temp_Information_Services[1][1]
                    $ISTech_List[$a][3] = $Temp_Information_Services[4][1] & ", " & $Temp_Information_Services[1][1]
                    $ISTech_List[$a][4] = $Temp_Information_Services[2][1]
                EndIf
            EndIf
        Next
        _AD_Close()

        $ISTech_List[0][0] = UBound($ISTech_List) - 1
        _ArraySort($ISTech_List, 0, 1, 0, 2)
        _ArraySort($ISTech_List, 0, 1, 0, 1)

        For $u = 1 To $ISTech_List[0][0]
            If @UserName = $ISTech_List[$u][0] Then
                $Current_UserName = StringUpper($ISTech_List[$u][0])
                $Current_FullName = $ISTech_List[$u][3]
                $Current_UserName_IsIS = 1
                $UserName_DropDown_Content &= StringUpper($ISTech_List[$u][0]) & "|"
            Else
                $UserName_DropDown_Content &= StringUpper($ISTech_List[$u][0]) & "|"
            EndIf
        Next

        $UserName_DropDown_Content = StringTrimRight($UserName_DropDown_Content, 1)
    EndIf

    If ($Current_UserName_IsIS = 0 And (@UserName = "Administrator" Or @UserName = "Alternate")) Then
        Do
            UserNameSettings()
        Until $Current_UserName <> @UserName
    ElseIf $Current_UserName_IsIS = 1 Then
        ;Do Nothing
    Else
        MsgBox(16, $Script_Name & " Error", "You must be a member of the Domain\IT Personnel group to utilize this script. If you need assistance or feel you have received this message in error, please contact Joshua Barnette @ ext. 12345.")
        Exit
    EndIf
#EndRegion 

[water]

Unfortunately I have no Windows 8/8.1 available to test.

So we need to do it step by step.

First question: Why do you close the AD connection and then reopen it?