Active Directory UDF - Help & Support (III)

[JonF]

[water]

Could you please test and specify the port to use?

_AD_Open("<redacted>\<redacted>", "<redacted>", "", "mail.<redacted>.com:636", "", 3)

 

[JonF]

Same thing, on ports 636 and  3269.  I made sure the router was forwarding both to the correct place.

ETA: I checked the listeners. LDAP is listening to port 636 but the local address is 0.0.0.0 or ::.  

Looks like it's the server's cert not being fully integrated.  I added it to the Services cert store on the server and now the erro is 4 and extended is -214016646.

Edited August 29, 2017 by JonF
Add content

[water]

Very strange value for @extended. Seems to be a problm with creating the RootDSE object.
Can you please provide the (anonymized) code you run?

[JonF]

Pretty straightforward:

#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open("<redacted>\<redacted>", "<redacted>", "", "mail.<redacted>.com:636", "", 3)

I'm a domain admin so there's no question of permissions.

When I use the Softerra LDAP browser there still seems to be a cert error, see the screenshot.

 

Edited August 30, 2017 by JonF

[water]

I'm glad the problem does not seem to be AD UDF related.
I hope that, when it works with the LDAP browser, it will work with the AD UDF as well.

Please keep me informed.

[MoveJockey]

I've got an error:

 

Function _AD_Open encountered a problem. @error = 4, @ extended = -2147023541

 

How to solve it?

[water]

The wiki describes what went wrong: https://www.autoitscript.com/wiki/Active_Directory_UDF_-_General#AD_Open

[JonF]

I finally figured it out. This works for Small Business Server 2008 and may help for other servers.

First step is to run, on a domain-joined computer:

#include <AD.au3>
_AD_Open()
ConsoleWrite($sAD_DNSDomain & @CRLF)
ConsoleWrite($sAD_Configuration & @CRLF)
_AD_Close()

The first value printed is the third parameter for _AD_Open and the second value printed is the fifth parameter for _AD_Open.

On the server, do the standard MMC dance to manage certificates.  Select "Computer Account".  Under Personal certificates, export the server's self-signed CA certificate (mine is <domain>-<servername>-CA) and the third-party certificate for the external URL (mine is mail.<redacted>.com), including the private key. Note that the third-party certificate has to include "Client Authentication" in its intended purpose.

On the client, again do the standard MMC dance selecting "Computer Account" and import the self-signed certificate into the "Trusted Root Certification Authorities" store. You might have to import your third-party CA certificates into this store too, such as Go Daddy Class 2 Certification Authority and  Go Daddy Root Certificate Authority.

Open Internet Explorer and click the settings gear and select Internet Options (or Control Panel | Internet Options.) Then Content tab | Certificates | Import and import the third-party certificate.

Now:

_AD_Open("<username>", "<password>", "DC=<redacted>,DC=local", "mail.<redacted>.com", "CN=Configuration,DC=<redacted>,DC=local", 3)

works a treat.

[water]

Thanks a lot for posting your solution!
I'm sure it will be helpful for other users in the future.

[water]

When used with AutoIt 3.3.14.3. (or later) you need to insert the following line to the UDF. This is caused by functions being moved to a new WinAPI UDF.

#include <WinAPIConv.au3> ; Needed for AutoIt >= 3.3.14.3

 

[breadstick]

Hi water,

I'm encountering an error message when running some of the example files included in the AD UDF.

For example, _AD_GetLastLoginDate.au3 generates the following error:

"C:\Program Files (x86)\AutoIt3\Include\AD.au3" (1413) : ==> The requested action with this object has failed.:
$aSubNet = $oSite.GetEx("siteObjectBL")
$aSubNet = $oSite^ ERROR

The _AD_ListDomainControllers.au3 example also generates the same error.

I did update the example files to include "#include <WinAPIConv.au3>" since I'm testing on 3.3.14.3, but the same errors also occurs on 3.3.14.2.

Thanks for any insight you can offer.

Edited February 7, 2018 by breadstick
Include the actual error message

[water]

Will check tomorrow when I return to my office.

[AdamUL]

Did you also update the Array.au3 and File.au3 in you 3.3.14.3 installation?  I do know that AD.au3 uses the Array.au3.  It could be causing an issue.  

Adam

[water]

_AD_GetLastLoginDate.au3 and _AD_ListDomainControllers.au3 work just fine here with 3.3.14.3.

[water]

Which version of the AD UDF do you run?
Line 1413 in the latest version is somewhere in function _AD_GetObjectsInOU.

[breadstick]

The problem turned out to be an old copy of the AD.au3 file.

After updating to the latest AD UDF 1.4.8.0, both _AD_GetLastLoginDate  and _AD_ListDomainControllers functions  works perfectly. So the issue was only on my end.

I much appreciate the help, and thanks for making such an awesome UDF!

[water]

Glad you Like this UDF

[Hazpartame]

Good morning,

I found your AD UDF very convenient, and I try to use it as much as possible.
But I have a problem I can't solve, and I'm a beginner.

I need to retrieve the information (first name, last name, username) in 3 variables by doing a search from the email address in AD. 

I created my own script that retrieves this information by opening the active directory (.png), and via the following function copies the data :

Local $Prenom = ControlGetText ("Properties of","",1030)
Local $Family = ControlGetText ("Properties of","",1031)
Local $Family1 = StringUpper($Family) ;
Local $CUID = ControlGetText ("Properties of","",1025)

It's work perfectly but i want to do it with your script. I saw that one could search by user name but I don't know how to search by e-mail and find my 3 informations...

Can you guide me?

Thank you very much in advance!!

Edited April 16, 2018 by Hazpartame

[water]

I answered your question in your other thread: