Active Directory UDF - Help & Support (III)

[legend]

here's the result

 

[water]

This means that the displayed date of "1601/01/01 00:00:00" is correct and is not calculated by _AD_GetObjectProperties.

Now we need to check why setting the "users needs to change password on next logon" does not reset this date to 0.

Will have to think about it ....

Edited July 15, 2020 by water

[water]

Can you make sure that the password is set to expire:
"This value is stored as a large integer that represents the number of 100 nanosecond intervals since January 1, 1601 (UTC).
If this value is set to 0 and the User-Account-Control attribute does not contain the UF_DONT_EXPIRE_PASSWD flag, then the user must set the password at the next logon."
https://docs.microsoft.com/en-au/windows/win32/adschema/a-pwdlastset?redirectedfrom=MSDN

This property gets displayed as "userAccountControl" when you run _AD_GetObjectProperties to display all properties.

Edited July 15, 2020 by water

[water]

Seems here you get a good explanation of how it all works.

Means:
If the user has never set the password for his account OR an admin has set "user must change password on next logon" you will get "1601/01/01 00:00:00".

Quote

Is it possible to get the information for a user object if this checkbox is checked? "User must change password at next logon"

If pwdlastset = "1601/01/01 00:00:00" AND lastlogon <> "1601/01/01 00:00:00" then you can assume that an admin has set "user must change password on next logon".

Edited July 15, 2020 by water

[Kiesp]

Hi.

I'm trying to get info on a bunch of users and looping through them, I use the following to get the data for each user

$userdata = _AD_GetObjectProperties($user,"mail,physicalDeliveryOfficeName,department,pwdLastSet")

I've found that, if the userobject is missing one (or more) of the properties, the row is just missing from my array. This means that the following code might not actually get me the mail of the use, if there's no mail defined on the object in AD.

$mail = $userdata[2][1]

 

Is there any way to keep the row in my array, but simply just leave the value blank ?

 

Thanks in advance,

Kiesp

[water]

Something like this?

#include <ad.au3>
Global $sUser = @UserName
_AD_Open()
Global $sProperties = "aa,mail,xx,physicalDeliveryOfficeName,department,pwdLastSet,yy"
Global $aUserData = _AD_GetObjectProperties($sUser, $sProperties)
_ArrayDisplay($aUserData, "Without unset properties")

Global $aProperties = StringSplit($sProperties, ",")
For $i = 1 To $aProperties[0]
    $bFound = False
    For $j = 1 To $aUserData[0][0]
        If $aUserData[$j][0] = $aProperties[$i] Then
            $bFound = True
            ExitLoop
        EndIf
    Next
    If $bFound = False Then
        _ArrayAdd($aUserData, $aProperties[$i])
        $aUserData[0][0] = $aUserData[0][0] + 1
    EndIf
Next
_ArrayDisplay($aUserData, "With unset properties")
_ArraySort($aUserData, 0, 1, 0)
_ArrayDisplay($aUserData, "With unset properties - sorted")

 

[Kiesp]

Thanks, that works I was just hoping that there might have been a buildin function for it, since missing data can serve as a big problem.

[water]

That's caused by the way the function is coded. It passes the list of properties to an AD function. This function drops all parameters it can't find.
Maybe I should add the code above to _AD_GetObjectProperties and add a new parameter to activate this code?

[water]

Version 1.5.3.0 of the UDF has been released.

Please test before using in production!

For download please see my signature.

[gcue]

i am using this function to get samaccount for several hundred emails. however the email addresses i am getting aren't always the primary email.  sometimes they are alternate emails so this query wont work.  anyway to make this work with alternate emails?  or at least get a persons alternate emails to validate in ad?

Func Get_Sam_Account($email)

    $aObjects = _AD_GetObjectsInOU("", "(ANR=" & $email & ")", 2, "sAMAccountName")
    If @error > 0 Then
        Return SetError(1)
    EndIf

    $sam_account = $aObjects[1]

    Return $sam_account

EndFunc

THANK YOU for this wonderful UDF and for any help in advance!

[water]

The property "proxyAddresses" holds an array where you can find the primary and all secondary SMTP-addresses.

Run the following script and you will get an array of entries:

SMTP: is the primary mail address
smtp: are the secondary mail addresses
xxxx: can be ignored

#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $aProperties[1][2]

$aProperties = _AD_GetObjectProperties(@UserName, "proxyaddresses")
_ArrayDisplay($aProperties, "Active Directory Functions - Example 1 - Properties for user '" & @UserName & "'")

; Close Connection to the Active Directory
_AD_Close()

 

[gcue]

2 hours ago, water said:

The property "proxyAddresses" holds an array where you can find the primary and all secondary SMTP-addresses.

Run the following script and you will get an array of entries:

SMTP: is the primary mail address
smtp: are the secondary mail addresses
xxxx: can be ignored

#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $aProperties[1][2]

$aProperties = _AD_GetObjectProperties(@UserName, "proxyaddresses")
_ArrayDisplay($aProperties, "Active Directory Functions - Example 1 - Properties for user '" & @UserName & "'")

; Close Connection to the Active Directory
_AD_Close()

 

very awesome!  now i just need to figure out how to validate if an alternate email is valid.. i get a report with tons of emails - some are primary and some are alternate... i cant seem to use _AD_GetObjectsInOU with an alternate email to get the samaccount.  how would i go about getting the samaccount from an alternate email? or maybe even get primary email from alternate email then get sam account...

Edited May 20, 2021 by gcue

[water]

Something like this:

#include <AD.au3>

_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)
Global $sSMTPAddress = "Firstname.Lastname@company.com" ; Can be the primary or one of the secondary addresses
$aObjects = _AD_GetObjectsInOU("", "(proxyAddresses=smtp:" & $sSMTPAddress & ")", 2, "sAMAccountName, proxyAddresses")
_ArrayDisplay($aObjects)
$aAddresses = StringSplit($aObjects[1][1], "|")
_ArrayDisplay($aAddresses)
For $i = 1 To $aAddresses[0]
    If StringLeft($aAddresses[$i], 5) == "SMTP:" Then ConsoleWrite("Primary Address  : " & $aAddresses[$i] & @CRLF)
    If StringLeft($aAddresses[$i], 5) == "smtp:" Then ConsoleWrite("Secondary Address: " & $aAddresses[$i] & @CRLF)
Next
_AD_Close()

 

[gcue]

thank you thank you thank you!!!

works great!!!

hope you have a good rest of the week

[water]

Thanks 👍
I wish you a nice weekend as well.

[blumi]

_AD_CreateGroup Question

I can connect to the AD but I tried to create a group there, it does not work. 

The OU Lokale Administratoren does exist already.

AD UDF 1.5.2

What do I wrong?

$success = _AD_CreateGroup('OU=Lokale Administratoren,DC=my,DC=domain,DC=de', '_TEST')
MsgBox(64, $ScriptName, "success: " & $success & @CRLF & "Error: " & @error)

 

[water]

What is the value of @error and @extended after _AD_CreateGroup?

Can you add "_AD_ErrorNotify(2)" at the top of your script so we get more detailed error information?

[blumi]

Error -2147352567

extended 0

[water]

That's 0x80020009 which means "General Exception" and doesn't tell us much.
What do you get from _AD_ErrorNotify? Please post the screenshot of the MsgBox.

[blumi]

How to user _AD_ErrorNotify correct?

$success = _AD_CreateGroup("OU=Lokale Administratoren,DC=my,DC=domain,DC=de", "_TEST121")
$x = _AD_ErrorNotify(2)
MsgBox(64, $ScriptName, "success: " & $success & @CRLF & "Error: " & @error & @CRLF & "extended: " & @extended & @CRLF & "x: " & $x)

success = 0

error = 0

extended = 0

x = 1