Active Directory UDF - Help & Support (III)

[water]

Something like this:

_AD_Open < -- First

_AD_OpenGC <-- Second

~~ Some functions that alter the domain opened by _AD_Open but need to query the Global Catalog when using internal query functions.
~~ E.G. _AD_AddUserToGroup uses _AD_ObjectExists to check if user and group already exist. For this query the GC would be used if _AD_OpenGC had been called before.

_AD_Close (will close all connections opened by _AD_Open and _AD_OpenGC)

[Surf243]

Ok Awesome. That would work perfectly!

[water]

Added the first alpha version here:

 

[Surf243]

Awesome!

Found some bugs for you:

 

[Surf243]

Hey water,

I have an interesting issue I found with my script. I've isolated it down to a simple reproducer. When I try to set an expiration date it sometimes offsets by an hour, but that depends on the date. I'm not sure what the issue is but perhaps you may have a better idea.

#include <AD.au3>

Global $sUser = "tst_usr1"
Global $sDate1 = "2017/03/11 12:00:00"
Global $sDate2 = "2017/03/12 12:00:00"
Global $sProperty = "accountExpires"
Global $aArray

ConsoleWrite(@CRLF)

_AD_Open()
_AD_SetAccountExpire($sUser, $sDate1)
$aArray = _AD_GetObjectProperties($sUser, $sProperty)
ConsoleWrite("Test1: " & @CRLF)
ConsoleWrite("Set Date: " & $sDate1 & @CRLF)
ConsoleWrite("Get Date: " & $aArray[1][1] & @CRLF)
ConsoleWrite(@CRLF)


_AD_SetAccountExpire($sUser, $sDate2)
$aArray = _AD_GetObjectProperties($sUser, $sProperty)
ConsoleWrite("Test2: " & @CRLF)
ConsoleWrite("Set Date: " & $sDate2 & @CRLF)
ConsoleWrite("Get Date: " & $aArray[1][1] & @CRLF)
ConsoleWrite(@CRLF)
_AD_Close()

ConsoleWrite(@CRLF)

Screenshot:

[BrewManNH]

Daylight Savings Time kicks in on March 12th in 2017.

[Surf243]

16 hours ago, BrewManNH said:

Daylight Savings Time kicks in on March 12th in 2017.

OMG, such as simple answer lol

Thanks BrewManNH!

[Valnurat]

What it the best way to find computers an user is manager of by using this UDF?

I know I need to use the FQDN to find it.

I have a ComboBox with names. I get the names from the attribute "distinguishedName" by using this:
 

$sFill &= StringMid($aResult[$i],4,StringInStr($aResult[$i],',') -4) & "|"

How can I get FQDN when I'm using the above syntax?

[water]

_AD_GetManagedBy

[Valnurat]

But isen't that for groups?

I want to find all computers that I'm managedBy of.

[water]

How about this extended version? Parameter 2 allows to specify the objectCategory to quey (group, computer, user ... "*" returns all categories.)
 

Func _AD_GetManagedByEX($sManagedBy = "*", $sCategory = Default)

    If $sManagedBy = Default Then $sManagedBy = "*"
    If $sCategory = Default Then $sCategory = "group"
    If $sManagedBy <> "*" Then
        If _AD_ObjectExists($sManagedBy) = 0 Then Return SetError(1, 0, "")
        If StringMid($sManagedBy, 3, 1) <> "=" Then $sManagedBy = _AD_SamAccountNameToFQDN($sManagedBy) ; sAMAccountName provided
    EndIf
    $__oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sAD_DNSDomain & ">;(&(objectCategory=" & $sCategory & ")(managedby=" & $sManagedBy & "))" & ";distinguishedName,managedby,objectCategory;subtree"
    Local $oRecordSet = $__oAD_Command.Execute
    If @error Or Not IsObj($oRecordSet) Or $oRecordSet.RecordCount = 0 Then Return SetError(2, @error, "")
    $oRecordSet.MoveFirst
    Local $aResult[1][3], $iCount1 = 1
    Do
        ReDim $aResult[$iCount1 + 1][3]
        $aResult[$iCount1][0] = $oRecordSet.Fields("distinguishedName").Value
        $aResult[$iCount1][1] = $oRecordSet.Fields("managedBy").Value
        $aResult[$iCount1][2] = $oRecordSet.Fields("objectCategory").Value
        $oRecordSet.MoveNext
        $iCount1 += 1
    Until $oRecordSet.EOF
    $oRecordSet.Close
    $aResult[0][0] = UBound($aResult, 1) - 1
    $aResult[0][1] = UBound($aResult, 2)
    Return $aResult

EndFunc   ;==>_AD_GetManagedBy

 

[Valnurat]

Yes, that would be useful, but you will still use the FQDN.

How should I find that by the above mentioned syntax?

[water]

All functions of the AD UDF now support samaccountname as well. The translation to FQDN is done by the function.
Or do you talk about the FQDNs in the returned array?

[Valnurat]

Just now, water said:

Or do you talk about the FQDNs in the returned array?

Yes.

$sFill &= StringMid($aResult[$i],4,StringInStr($aResult[$i],',') -4) & "|"

The $aResult in my case, is an array of FQDN. I skip the first 3 letters "CN=" and then pick the name. You could say I'm "using" the attribute "cn" in AD.

[water]

Property "managedby" is stored as FQDN. So you need to translate it the way you do or call _AD_GetObjectAttribute for each record and retrieve the "cn" property.

[silber]

I apologize if this has been answered before (I couldn't find any similar questions that had been answered). I am attempting to add a login validation to my script/exe and I want it to test the LDAP credentials against our authentication server.  I have a bind user/password and the desired filter, but I can't see a function that will allow me to test the credentials.  To my limited understanding, $sUserIdParam and $sPasswordParam seem like they would only work for an account that has permission to query the server (the bind user) so how can I actually test the non-bind credentials?  Thank you.

[water]

Either use _AD_Open/_AD_Close with the credentials to validate and then again use _AD_Open using the binduser/password or check this little function:

 

[mprudhomme]

Hi water,

I've been looking for a lot, but I can not do what I want.

I want to create the same AD treeview as that via this link (https://www.autoitscript.com/forum/topic/75502-active-directory-treeview-solved/?do=findComment&comment=910440)

But I want with more objects inside the "OU" (ex: computers, ...), then you can select a "computer object" or an OUand carry out operations (PC start, modification AD attributes ...).

I hope you understand my request and that you can help me

 

[Neutro]

Hi mprudhomme and welcome to the AutoIT forums

Quote

But I want with more objects inside the "OU" (ex: computers, ...)

So i guess you understand that the fuction _AD_GetAllOUs is used to gather all OUs in your active directory.

You can then use the function _AD_GetObjectsInOU()  to get objects from any OU that you want and associated attributes.

For example:

_AD_GetObjectOU($someOU, "(objectclass=Computer)", 1, "name,distinguishedName,managedBy")

will return all computers inside $someOU alongside with the attributes "name", "distinguishedname" and "managedby" attributes for each computer in an array.

Quote

then you can select a "computer object"

This is not related to the AD UDF but to autoIT GUI design. If you never created a GUI yourself with autoIT, i suggest you try it with a simple example.

Quote

and carry out operations (PC start, modification AD attributes ...).

You can use the function _AD_ModifyAttribute($SomeObject, $SomeAttribute, "attribute value") to modify the attribute of an object.

If by PC start you mean a wake on lan function, i suggest you use an already existing software to do it (which can be managed by your autoIT software).

Edited May 12, 2017 by Neutro

[mprudhomme]

Thank you for your prompt response

I can not use existing software, I have specific needs.

So I have the list of OU, then for each OU, I look for the presence of computer objects with the command:

$aComputers = _AD_GetObjectsInOU($aResult[12][1], "(objectcategory=computer)", 0, "displayname,distinguishedName", "displayname")

But I have the following error:

"C:\Program Files (x86)\AutoIt3\Include\ad.au3" (591) : ==> The requested action with this object has failed.:
Local $oRecordSet = $__oAD_Command.Execute
Local $oRecordSet = $__oAD_Command^ ERROR38.0 SciTE v.3.6.0.0   Keyboard:0000040C  OS:WIN_10/  CPU:X64 OS:X64    Environment(Language:040C)

For information, i use include of "Water" in version 1.4.8.0

I tried to look at different posts again, but I can not fix this error.

Sorry for my poor English