Active Directory UDF - Help & Support (III)

[water]

[Kovacic]

Hi water, long time no chat! I have a simple script to enumerate the members of a group, but it seems to be generating an error from ad.au3..

Here is the code:

#include <ButtonConstants.au3>
#include <EditConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>
#include <ad.au3>
$Form1 = GUICreate("Get Members of a group.. JACI Edition.. By Kovacic", 615, 410, 192, 114)
$Input1 = GUICtrlCreateInput("", 8, 8, 121, 21)
$Button1 = GUICtrlCreateButton("Get Members", 144, 8, 75, 25)
$Edit1 = GUICtrlCreateEdit("", 8, 40, 593, 353)
GUICtrlSetData(-1, "")
GUISetState(@SW_SHOW)
While 1
    $nMsg = GUIGetMsg()
    Switch $nMsg
        Case $GUI_EVENT_CLOSE
            Exit
        Case $Button1
            get(GUICtrlRead($Input1))
    EndSwitch
WEnd
Func get($group)
    _AD_OPEN()
    Local $muhval, $stuff
    $muhval = _AD_GetGroupMembers($group)
    For $i = 1 To UBound($muhval) - 1
        $muhval[$i] = StringReplace($muhval[$i], "/", "\2f")
        $val = StringSplit($muhval[$i], ",")
        $val = StringReplace($val[1], "CN=", "")
        $stuff &= $muhval[$i]
        If $i <> UBound($mhval) Then $stuff &= ","
    Next
    _AD_CLOSE()
    GUICtrlSetData($Edit1, $stuff)
EndFunc   ;==>get

The error is attached.. 

 

Thanks in advance!

Edited June 12, 2014 by Kovacic

[water]

Which version of AutoIt do you run?

[Kovacic]

Which version of AutoIt do you run?

 

My current install is 3.3.10.2

[water]

Will need to investigate as soon as I return to my office. Stay tuned.

[Kovacic]

Will need to investigate as soon as I return to my office. Stay tuned.

No prob much thanks!!

[water]

I tested with AutoIt 3.3.12.0 and version 1.4.1.0 of the UDF and it works just fine here.

Which version of the AD UDF do you run?

Edited June 13, 2014 by water

[Kovacic]

I tested with AutoIt 3.3.12.0 and version 1.4.1.0 of the UDF and it works just fine here.

Which version of the AD UDF do you run?

 

Ahhh... I have UDF Version ...: 1.3.0.0

I will poke around for the update... Thanks!!

[Kovacic]

I tested with AutoIt 3.3.12.0 and version 1.4.1.0 of the UDF and it works just fine here.

Which version of the AD UDF do you run?

 

Updating both autoit and the UDF made it work like a charm! (Except the one variable I misspelled) 

Thanks!!!!!!

[water]

Great the problem could be solved

[Neutro]

Hey water,

I'm trying to get the password expiration date of some users of my AD using _AD_GetPasswordInfo()

I'm getting this array as a result (@error = 0):

Row|Col 0
[0]|12
[1]|-10675199.1167245
[2]|1
[3]|3
[4]|4
[5]|30
[6]|0
[7]|30
[8]|2014/01/28 07:55:52
[9]|0000/00/00 00:00:00
[10]|2014/01/28 06:55:52
[11]|0
[12]|0

Success: Returns a one-based array with the following information:
    1 - Maximum Password Age (days)
    2 - Minimum Password Age (days)
    3 - Enforce Password History (# of passwords remembered)
    4 - Minimum Password Length
    5 - Account Lockout Duration (minutes). 0 means the account has to be unlocked manually by an administrator
    6 - Account Lockout Threshold (invalid logon attempts)
    7 - Reset account lockout counter after (minutes)
    8 - Password last changed (YYYY/MM/DD HH:MM:SS in local time of the calling user) or "1601/01/01 00:00:00" (means "Password has never been set")
    9 - Password expires (YYYY/MM/DD HH:MM:SS in local time of the calling user) or empty when password has not been set before or never expires

    10 - Password last changed (YYYY/MM/DD HH:MM:SS in UTC) or "1601/01/01 00:00:00" (means "Password has never been set")

 

So i'm having 2 problems with this :

 1 - Maximum Password Age (days) : is not in days but in unreadable intergrer 8 value => how can i convert this to a readable value ?

 2 - Password expires date is at 0 whereas maximum password age is not 0 => incorrect value.

Any idea ?

TIA

Edited June 27, 2014 by Neutro

[water]

Do you use the Granular Password Policy at your site?

[Neutro]

Well I didn't know we were until you asked, but after checking, it seems like we do indeed.

#edit: yes I actually found the active PSC that is used on our domain.

So ok I understand now, your function is working properly, it's just that it's using the default domain policy and not the PSC policy as a reference.

Any idea on how can i determine the expiration date using this PSC?

Edited June 27, 2014 by Neutro

[water]

That caused the wrong results.

Unfortunately the AD UDF is not ready for Fine Grained Password Policy.

Do you think the UDF should be extended?

[Neutro]

Well I think most larges companies will be using grained password policy so it sure would be useful in the future!

Thanks again for your help

[water]

I will have a look.

But I would need some testers then as we do not use FGPW!

[Neutro]

I can do some tests if you want

[water]

Would be great!

But first I need to gather some information about how this new stuff works and how I can grab that information!

[water]

I just had some reading and I am not sure if it is possible to do what you want to do.

MS Technet:

The key sentence is: "The settings on the PSO (Password Settings Object) may be considered confidential; therefore, by default Authenticated Users do not have Read Property permissions for a PSO. By default, only members of the Domain Admins group have Read Property permissions on default security descriptor of the PSO object in the schema."

[kor]

Not sure if bug or by design, but when renaming an Active Directory group with the _AD_RenameObject function, it will change the "cn" and "sAMAccountName", but it will not change the "displayName" field.

Any way to get this function to also change the displayName field?