Active Directory UDF - Help & Support (III)

[spuri]

Hello

I searched for details but I am still not sure about a few things.
I would like to show number of days till account expiration and user should change password if expired.

_AD_GetObjectProperties($SUserId,"accountexpires")  gives 0000/00/00 00:00:00
_AD_GetObjectProperties($SUserId,"pwdLastSet")  gives 2018/05/20 11:08:05

How could I calculate the expiration date? (could not get password age info)

Is it allowed to change password after its expiration?

Thanks
spuri

[AdamUL]

Look at the following functions for what you are looking for.  

_AD_IsAccountExpired

_AD_GetAccountsExpired

_AD_IsPasswordExpired

_AD_GetPasswordExpired

_AD_GetPasswordInfo

_AD_SetPassword

Use _AD_GetPasswordInfo to get password expiration date.

Use _AD_SetPassword to set the password after its expiration date.  

 

Adam

 

[Carni]

First of all, Water, thank you so much for making the one of the best and most useful UDFs.

I have a problem though. I am trying to write a tool for our weird setup currently where users are located in a diffrent forest but need to be able to reset their passwords on another forest. Connection to AD with special credentials works fine, I can use most functions from the UDF when providing it as plain text in the script. What I am unable to to do is the following:

global $sFQDN = _AD_SamAccountNameToFQDN($user) - it always returns an empty string. When I provide $user= "sAMAccountName" it does find the FQDN. I am reading the username from the other forest from the credential manager like:

RunWait(@ComSpec & " /C cmdkey.exe /list:SERVERNAME > @tempdir & "\usernametemp.txt", "", "", @SW_HIDE)
    $fileArray = FileRead(@TempDir & "\usernametemp.txt")
    $user = _StringBetween($fileArray, "domain\", " ")

it does fill $user with the sAMAccountName of the correct user but the $sFQDN is still empty.

 

Example of working code:

$user = 'sob'
_AD_Open()
Global $sFQDN = _AD_SamAccountNameToFQDN($user)
Global $sSamAccountName = _AD_FQDNToSamAccountName($sFQDN)
MsgBox(64, "Active Directory Functions - Example 1", "The Fully Qualified Domain Name (FQDN) for the currently logged on user is: " & @CRLF & $sFQDN & @CRLF & @CRLF & _
        "The Security Accounts Manager (SAM) Account Name (SamAccountName) for the current logged on user is: " & @CRLF & $sSamAccountName)
_ad_close()

 

What I try to do and which fails: (even if I put the var $user in ''

RunWait(@ComSpec & " /C cmdkey.exe /list:ServerName > @TempDir & "\usernametemp.txt", "", "", @SW_HIDE)
    $fileArray = FileRead(@TempDir & "\usernametemp.txt")
    $user = _StringBetween($fileArray, "DOMAIN\", " ")
    $user = $user[0]


_AD_Open()
Global $sFQDN = _AD_SamAccountNameToFQDN($user)
Global $sSamAccountName = _AD_FQDNToSamAccountName($sFQDN)
MsgBox(64, "Active Directory Functions - Example 1", "The Fully Qualified Domain Name (FQDN) for the currently logged on user is: " & @CRLF & $sFQDN & @CRLF & @CRLF & _
        "The Security Accounts Manager (SAM) Account Name (SamAccountName) for the current logged on user is: " & @CRLF & $sSamAccountName)

        MsgBox(64, "","User from $user is: " & $user)

_ad_close()

The outcome is:

 

When I explicitiy use $username = 'user' it's working without a problem. When reading the user from a diffrent source, like inputbox, fileread, regread it's not working. Also tried string($user).

My Version I use are:

(I made a wrong password connection so I get these info from within your UDF function )

 

Thanks so much for your help in advanced

 

[water]

Replace

RunWait(@ComSpec & " /C cmdkey.exe /list:SERVERNAME > @tempdir & "\usernametemp.txt", "", "", @SW_HIDE)

with

RunWait(@ComSpec & " /C cmdkey.exe /list:SERVERNAME > " & @tempdir & "\usernametemp.txt", " ", "", @SW_HIDE)

 

[Carni]

Ah, stupid me. My Command is correct. Just replaced the hard coded path with tempdir on the file in the editor here Stupid me.
I still have the same issue.

_AD_ErrorNotify(2)

$OpenAD = _ad_open($DomAcc, $DomPWD, "", $DC, "", 1)
$user = _getUsername()
MsgBox(262144, 'Debug line ~' & @ScriptLineNumber, 'Selection:' & @CRLF & '$user' & @CRLF & @CRLF & 'Return:' & @CRLF & $user) ;### Debug MSGBOX

Global $sFQDN = _AD_SamAccountNameToFQDN($user)
Global $sSamAccountName = _AD_FQDNToSamAccountName($sFQDN)
MsgBox(64, "Active Directory Functions - Example 1", "The Fully Qualified Domain Name (FQDN) for the currently logged on user is: " & @CRLF & $sFQDN & @CRLF & @CRLF & _
        "The Security Accounts Manager (SAM) Account Name (SamAccountName) for the current logged on user is: " & @CRLF & $sSamAccountName)

MsgBox(64, "", "User from $user is: " & $user)

_ad_close()


Func _getUsername()
    RunWait(@ComSpec & " /C cmdkey.exe /list:ecofysprint-001.ecofys.com > " & @TempDir & "\usernametemp.txt", "", "", @SW_HIDE)
    $fileArray = FileRead(@TempDir & "\usernametemp.txt")
    $user = _StringBetween($fileArray, "ecofys\", " ")
    If @error Then
        MsgBox(16, "Error", "Can not find your DOMAIN Username...aborting")
        _AD_close()
        Exit
    EndIf
    $user = $user[0]
    FileDelete(@TempDir & "\usernametemp.txt")
    Return $user
EndFunc   ;==>_getUsername

The debug msgboxes return the correct read username, the AD functions do not return anything. I am connected to AD, script is running on the DC itself with domain admin rights. If I replace:

$user = fileread("somefile")
;with
$user = 'username'

it's working. Also a normal inputbox before _ad_open() works fine. Tried also regread, fileread. Maybe I start over and make one step at a time.

 

Thanks for your help so far

[Carni]

somehow I can not edit my posts. Can someone remove the fqdn servername. Don't want our servernames on the internet although it's my own failt

[water]

I suggest to add a line to check for errors after each function call. Example:

ConsoleWrite("_AD_SamAccountNameToFQDN: " & @error & "/" & @extended & @CRLF)

The same is true for the FileRead.

[water]

IIRC you need to have at least a post count of 5 before you can edit your posts

Edited May 29, 2018 by water

[water]

So you just need two more posts on this thread

[Carni]

FileRead: 0/160 --> 160 doesn't ring a bell The $user is filled with the correct username:

StringBetween 0/0
_AD_SamAccountNameToFQDN: 1/0 --> Cause the username is NULL or empty
_AD_FQDNToSamAccountName: 0/0

 

[Carni]

Ok, I am getting somewhere:

$fileArray = FileRead("c:\temp\user.txt")
    ConsoleWrite("FileRead: " & @error & "/" & @extended & @CRLF)
    $user = _StringBetween($fileArray, "ecofys\", " ")
    ConsoleWrite("StringBetween " & @error & "/" & @extended & @CRLF)
    If @error Then
        MsgBox(16, "Error", "Can not find your DOMAIN Username...aborting")
        _AD_close()
        Exit
    EndIf
    $user = $user[0]
    MsgBox(262144, 'Debug line ~' & @ScriptLineNumber, 'Selection:' & @CRLF & '$user' & @CRLF & @CRLF & 'Return:' & @CRLF & $user) ;### Debug MSGBOX

When I create a file calles user.txt and read the whole file and do a stringbetween domain\ and " " and get the username and AD function is working.

Thank you

[water]

According to the help file @extended gets set to the number of bytes read.

_AD_SamAccountNameToFQDN: 1/0 means: No record returned from Active Directory. $sSamAccountName not found

It seems the file holds more than just the username. Can you write $user to the console like this:

ConsoleWrite(">>" & $user & "<<" & @CRLF)

Is the result what you expect it to be?

[water]

Lessons learned is: Always check for errors and verify the return value is what you expect it to be

[Carni]

1 minute ago, water said:

According to the help file @extended gets set to the number of bytes read.

_AD_SamAccountNameToFQDN: 1/0 means: No record returned from Active Directory. $sSamAccountName not found

It seems the file holds more than just the username. Can you write $user to the console like this:

ConsoleWrite(">>" & $user & "<<" & @CRLF)

Is the result what you expect it to be?

Thank you so much!!! the username returned has a line feed in it. Now I know how to solve it! Thank you so much!

[water]

Glad to be of service
BTW: Can you edit your posts now?

[Carni]

unfortunately not But that is not a real problem yet

 

[water]

Then the limit is 10
Or you could send a private message to one of the Mods (Melba23 or JLogan3o13).

[Carni]

At least my dumb problem is now solved.

$user = StringReplace($user, @CRLF, "")

Thanks again

[water]

Another helpful function is StringStripWS to remove all kind of unwanted characters (white space).

[water]

Version 1.4.9.0 of the UDF has been released.

Please test before using in production!
For download please see my signature.