Active Directory UDF (II)

[blumi]

50 minutes ago, water said:

Just:

$sScriptName = "Test"
$sSystemname = "Lapgruppex1"
; Verbindung mit Domänencontroller herstellen
_AD_Open("", "", "", "ldap.abcde.xxx.yy:3268", "")
If @error Then
    MsgBox(64, $sScriptName, "Verbindung NICHT hergestellt! error=" & @error)
    Exit
Else
    MsgBox(64, $sScriptName, "Verbindung hergestellt!")
EndIf

If _AD_ObjectExists($sSystemname) Then
    MsgBox(64, $sScriptName, $sSystemname & " existiert")
Else
    MsgBox(16, $sScriptName, $sSystemname & " existiert NICHT! error=" & @error)
EndIf
_AD_Close()
Exit

 

That works very fine, thank you very much.

[water]

[Deathgod_Anubis]

2 hours ago, water said:

@Deathgod_Anubis

Seems this should be possible with a small modification of the current AD UDF:

To set the TTL (time to live) for a user you need to

• add the "dynamicObject" class to the user object
• set property "entryTTL" to the number of seconds the user should exist

As a static object can not be changed to a dynamic object the dynamicObject class has to be set at creation time.
So we need a modified version of _AD_CreateUser:

expandcollapse popup

; #FUNCTION# ====================================================================================================================
; Name...........: _AD_CreateUser
; Description ...: Creates and activates a user in the specified OU.
; Syntax.........: _AD_CreateUser($sOU, $sUser, $sCN[, $bDynamic = False])
; Parameters ....: $sOU - OU to create the user in. Form is "OU=sampleou,OU=sampleparent,DC=sampledomain1,DC=sampledomain2"
;                  $sUser - Username, form is SamAccountName without leading 'CN='
;                  $sCN - Common Name (without CN=) or RDN (Relative Distinguished Name) like "Lastname Firstname"
;                  $bDynamic - Sets the dynamicObject class.
;                    You can then set dynamic properties like entryTTL to delete the user after expiration (default = False)
; Return values .: Success - 1
;                  Failure - 0, sets @error to:
;                  |1 - $sUser already exists
;                  |2 - $sOU does not exist
;                  |3 - $sCN is missing
;                  |4 - $sUser is missing
;                  |5 - $sUser could not be created. @extended is set to the error returned by LDAP
;                  |6 - Could not add the dynamicObject class to the user. @extended is set to the error returned by LDAP
;                  |x - Error returned by SetInfo method (Missing permission etc.)
; Author ........: Jonathan Clelland
; Modified.......: water
; Remarks .......: This function sets the following properties:
;                    * objectClass to "dynamicObject" if $bDynamic = True
;                    * sAMAccountName (= $sUser)
;                    * userPrincipalName (e.g. $sUser@microsoft.com)
;                    * pwdLastSet to not expire
;                    * AccountDisabled to False (= activate the user)
;                  All other attributes have to be set using function _AD_ModifyAttribute
; Related .......: _AD_CreateOU, _AD_CreateGroup, _AD_AddUserToGroup, _AD_RemoveUserFromGroup
; Link ..........:
; Example .......: Yes
; ===============================================================================================================================
Func _AD_CreateUserEX($sOU, $sUser, $sCN, $bDynamic = False)
    If _AD_ObjectExists($sUser) Then Return SetError(1, 0, 0)
    If Not _AD_ObjectExists($sOU, "distinguishedName") Then Return SetError(2, 0, 0)
    If $sCN = "" Then Return SetError(3, 0, 0)
    $sCN = _AD_FixSpecialChars($sCN)
    If $sUser = "" Then Return SetError(4, 0, 0)
    Local $oOU = __AD_ObjGet("LDAP://" & $sAD_HostServer & "/" & $sOU)
    Local $oUser = $oOU.Create("User", "CN=" & $sCN)
    If @error Or Not IsObj($oUser) Then Return SetError(5, @error, 0)
    If $bDynamic = True then
        $oUser.PutEx($ADS_PROPERTY_APPEND, "objectClass", "dynamicObject")
        if @error Then Return SetError(6, @error, 0)
    Endif
    $oUser.sAMAccountName = $sUser
    $oUser.userPrincipalName = $sUser & "@" & StringTrimLeft(StringReplace($sAD_DNSDomain, ",DC=", "."), 3)
    $oUser.pwdLastSet = -1 ; Set password to not expired
    $oUser.SetInfo
    If @error Then Return SetError(@error, 0, 0)
    $oUser.AccountDisabled = False ; Activate User
    $oUser.SetInfo
    If @error Then Return SetError(@error, 0, 0)
    Return 1
EndFunc   ;==>_AD_CreateUser

Can you please

• Add the above function _AD_CreateUserEX to your script (so it does not interfere with ther AD UDF)
• Run _AD_CreateUserEX and create a new user with $bDynamic = True
• If successful please check if the "dynamicObject" class has been set by running _AD_GetObjectClass($sUser, True). You should get an array with "top, person, organizationalPerson, user" and "dynamicObject"
• If True please set attribute "entryTTL" to 15 Minutes (or whatever value you like) by using _AD_ModifyAttribute($sUser, "entryTTL", 900)
• If successful please check the value by running _ADGetObjectProperties for this user

@water

Thanks for your replies. I'm not sure if I'm understanding the "dynamicObject" things right.. As far as I know (I haven't done much research yet), and as long as it concerns powershell, it's possible to add any existing user with a ttl to a group. It would be quite inconvenient to (re-)create all existing users, just for the "dynamicObject" thing?

Unfortunately, I'm currently in the middle of the process of raising the function level of our productive environment. As a consequence, I don't currently have an Active Directory available that provides the required function level. I will see if I can pull up a test environment in a timely manner. Thanks so far for your help! I will get back to you as soon as possible!

[water]

I have taken the "dynamicObject" information from here: https://www.oreilly.com/library/view/active-directory-cookbook/0596004648/ch04s15.html

You could run this example script to get the ObjectClass property for your user - maybe the dynamicObject class is configured by default.

#include <AD.au3>

_AD_Open()
If @error Then Exit MsgBox(16, "AD Example", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Return Main class / Structural class plus superior classes from which the main class is deduced hierarchically for the logged on user
_ArrayDisplay(_AD_GetObjectClass(@UserName, True), "AD Example")

_AD_Close()

 

[JoshuaBarnette]

Thanks for all you hard work on this UDF. I have been using it for a long time.

I noticed I kept getting and error "For $iCount2 = 1 To $aTempMemberOf^ ERROR" when using _AD_RecursiveGetMemberOf. To eliminate the error, I added "If IsArray($aTempMemberOf) Then" after " $aTempMemberOf = _AD_RecursiveGetMemberOf($aGroups[$iCount1], $iDepth - 1, $bListenherited, $bFQDN)". I am including the updates I made below. I have tested and compare to the PowerShell equivalent, the groups come back identically.

expandcollapse popup

; #FUNCTION# ====================================================================================================================
; Name...........: _AD_RecursiveGetMemberOf
; Description ...: Takes a group, user or computer and recursively returns a list of groups the object is a member of.
; Syntax.........: _AD_RecursiveGetMemberOf($sObject[, $iDepth = 10[, $bListInherited = True[, $bFQDN = True]]])
; Parameters ....: $sObject - User, group or computer for which the group membership is to be returned. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
;                  $iDepth - [optional] Maximum depth of recursion (default = 10)
;                  $bListInherited - [optional] Defines if the function returns the group(s) it was inherited from (default = True)
;                  $bFQDN - [optional] Specifies the attribute to be returned. True = distinguishedName (FQDN), False = SamAccountName (default = True)
; Return values .: Success - Returns an one-based one dimensional array of group names (FQDN or sAMAccountName) the user or group is a member of
;                  Failure - "", sets @error to:
;                  |1 - Specified user, group or computer does not exist
; Author ........: Jonathan Clelland
; Modified.......: water
; Remarks .......: This function traverses the groups that the object is immediately a member of while also checking its group membership.
;                  For groups that are inherited, the return is the FQDN or sAMAccountname of the group, user or computer, and the FQDN(s) or sAMAccountname(s) of the group(s) it
;                  was inherited from, seperated by '|'(s) if flag $bListInherited is set to True.
;+
;                  If flag $bListInherited is set to False then the group names are sorted and only unique groups are returned.
; Related .......: _AD_IsMemberOf, _AD_GetUserGroups, _AD_GetUserPrimaryGroup
; Link ..........:
; Example .......: Yes
; ===============================================================================================================================
Func _AD_RecursiveGetMemberOf($sObject, $iDepth = 10, $bListInherited = True, $bFQDN = True)
    If $iDepth = Default Then $iDepth = 10
    If $bListInherited = Default Then $bListInherited = True
    If $bFQDN = Default Then $bFQDN = True
    If _AD_ObjectExists($sObject) = 0 Then Return SetError(1, 0, "")
    If StringMid($sObject, 3, 1) <> "=" Then $sObject = _AD_SamAccountNameToFQDN($sObject) ; sAMAccountName provided
    $sObject = _AD_FixSpecialChars($sObject, 1, '"\/#+<>;=') ; the object needs to be unescaped (except a comma) for the LDAP query but the result might be escaped
    Local $iCount1, $iCount2
    Local $sField = "distinguishedName"
    If Not $bFQDN Then $sField = "samaccountname"
    $__oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sAD_DNSDomain & ">;(member=" & $sObject & ");" & $sField & ";subtree"
    Local $oRecordSet = $__oAD_Command.Execute
    Local $aGroups[$oRecordSet.RecordCount + 1] = [0]
    If $oRecordSet.RecordCount = 0 Then Return $aGroups
    $oRecordSet.MoveFirst
    $iCount1 = 1
    Local $aTempMemberOf[1]
    Do
        $aGroups[$iCount1] = $oRecordSet.Fields(0).Value
        If $iDepth > 0 Then
            $aTempMemberOf = _AD_RecursiveGetMemberOf($aGroups[$iCount1], $iDepth - 1, $bListInherited, $bFQDN)
            If IsArray($aTempMemberOf) Then
                If $bListInherited Then
                    For $iCount2 = 1 To $aTempMemberOf[0]
                        $aTempMemberOf[$iCount2] &= "|" & $aGroups[$iCount1]
                    Next
                EndIf
                _ArrayDelete($aTempMemberOf, 0)
                _ArrayConcatenate($aGroups, $aTempMemberOf)
            EndIf
        EndIf
        $iCount1 += 1
        $oRecordSet.MoveNext
    Until $oRecordSet.EOF
    $oRecordSet.Close
    If $bListInherited = False Then
        _ArraySort($aGroups, 0, 1)
        $aGroups = _ArrayUnique($aGroups, 0, 1)
    EndIf
    $aGroups[0] = UBound($aGroups) - 1
    Return $aGroups
EndFunc   ;==>_AD_RecursiveGetMemberOf

 

[water]

Thanks for updating the code!
I will have a look at the latest version and will add your modifications.

Glad you like the UDF

[water]

Can you please check @error and the variable type so we can make sure what the function returns?

Global $aTempMemberOf = _AD_RecursiveGetMemberOf($aGroups[$iCount1], $iDepth - 1, $bListInherited, $bFQDN)
MsgBox(0, "", "@error=" & @error & ", VarGetType=" & VarGetType($aTempMemberOf))
If IsArray($aTempMemberOf) Then _ArrayDisplay($aTempMemberOf)

 

[water]

Version 1.5.4.0 of the UDF has been released.

Please test before using in production!

For download please see my signature.

[araneon]

Good afternoon, thank you water for your UDF.
I wrote to you in private messages, and then found this topic and decided to ask more here.

Tell me how you can get the value of the distinguishedName attribute from the user's current computer.
I need to find out in which department this computer is located.
tried so

$aProperties = _AD_GetObjectProperties(@ComputerName & "$")
MsgBox(0, '', $aProperties[8][1])

But this is not correct, since it does not point exactly to distinguishedName and sometimes other values of the description type or others are supplied in the output.

Edited August 8, 2021 by araneon

[water]

Simply use

Global $aResult = _AD_GetObjectAttribute(@ComputerName & "$", "distinguishedName")

You get a string holding the distinguished name.

[araneon]

Super, thank you very much !!!

 

[mrserkaan]

Hello to everyone,

I'm so sorry for my bad english. 

I want to create bulk user on AD with this script. But I don't know how to write code. Can someone good at this do it for me? For example, it can be the user information that I have added to the attached excel file.

Thanks in advance for your help

create_blkuser.xlsx

[Jos]

10 hours ago, mrserkaan said:

But I don't know how to write code.

No problem...  I'll do it for $200 an hour, so lets say I spend about 10 hours to write and test the code it will be $2000 to pay for this, of which half of it upfront.
Do we have a deal?

Jos

[water]

If you do not know how to code, you should not be allowed to modify the Active Directory of your company using a script. 
Just my 2 cents worth 😃
 

[crackdonalds]

First of all, thanks for the great udf.

Did you ever look into dealing with the "LogonHours" attribute?
I'm looking to implement a GUI that does the same thing as the "logon hours" GUI in Active Directory Users and Computer.

If this is something you'd like to share in case you have it, that would be great. If not, no worries. Just wanna check before I start cracking my brain on this sudoku

[water]

Glad you like my UDF

I never had to cope with "logonhours". 
If you search the forum you will find a few - quite old - hits. it seems to be a bit complex to convert the byte array of the property to readable data.
If you find a solution I will be happy to add this to the AD UDF.

Maybe a good starting point:

Richard L. Mueller has created a VBS script to extract the lastlogon information: https://www.rlmueller.net/ADLogonHours.htm

We do not use logonhours, so I can't test.

 

[ptrex]

Hi All,

This is a start ...

expandcollapse popup

#include <string.au3>
#include <array.au3>

Dim $temp
Dim $arrLogonHoursBits[168]
Dim $arrDayOfWeek[7] = ["Mon", "Tue", "Wed", "Thu", "Fri", "Sat","Sun"]

$objUser = ObjGet ("LDAP://cn=User_name,ou=DEPT,dc=DOMAIN,dc=COM")
$arrLogonHours = $objUser.Get("LogonHours")

;~ ConsoleWrite((StringMid($arrLogonHours,3)) & @CRLF)

;LittleEndian(StringMid($arrLogonHours,3))
$arrLogonHoursBytes = StringSplit(StringMid($arrLogonHours,3), "")

$intCounter = 0
$intLoopCounter = 0

$arrLogonHourBit = Stringsplit(_HexToBinaryString(StringMid($arrLogonHours,3)), "")

ConsoleWrite ("Day  Byte 1   Byte 2   Byte 3" & @CRLF)

;For $LogonHourByte In $arrLogonHoursBytes
For $x = 1 To UBound($arrLogonHoursBytes)-1
$arrLogonHourBits = Stringsplit(_HexToBinaryString($arrLogonHoursBytes[$x]), "")

   If $intCounter = 0 Then
    ConsoleWrite( $arrDayOfWeek[$intLoopCounter] & "  " )
    $intLoopCounter += 1
  EndIf

    ;For $LogonHourBit In $arrLogonHourBits
    For $y = 1 to UBound($arrLogonHourBits)-1
    ;ConsoleWrite($arrLogonHourBits[$y])
        $temp = $temp & $arrLogonHourBits[$y]
        $intCounter += 1

        If $intCounter = 8 or $intCounter = 16 Then
        ConsoleWrite(_StringReverse($temp))
        $temp = ""
        ConsoleWrite( "  " )
        EndIf

        If $intCounter = 24 Then
        ConsoleWrite(_StringReverse($temp))
        $temp = ""
        ConsoleWrite (@CRLf)
         $intCounter = 0
        EndIf
    Next
Next

; Hex To Binary
Func _HexToBinaryString($HexValue)
    Local $Allowed = '0123456789ABCDEF'
    Local $Test,$n
    Local $Result = ''
    if $hexValue = '' then
        SetError(-2)
        Return
    EndIf

    $hexvalue = StringSplit($hexvalue,'')
    for $n = 1 to $hexValue[0]
        if not StringInStr($Allowed,$hexvalue[$n]) Then
            SetError(-1)
            return 0
        EndIf
    Next

    Local $bits = "0000|0001|0010|0011|0100|0101|0110|0111|1000|1001|1010|1011|1100|1101|1110|1111"
    $bits = stringsplit($bits,'|')
    for $n = 1 to $hexvalue[0]
        $Result &=  $bits[Dec($hexvalue[$n])+1]
    Next

    Return $Result
EndFunc

Func _StringReverse($string)
    $n = StringLen($string)
    $reversed = ""
    For $i = 1 To $n Step +1
        $reversed = $reversed & StringLeft(StringTrimLeft($string,$n-$i),1)
    Next
    Return $reversed
EndFunc

PS : Don't forget to change the LDAP settings.

 

 

Edited November 22, 2021 by ptrex

[water]

Perfect!
I just played with my user and it returns the correct result.
As we do not use logonhours I get all 1's

If crackdonals gets satisfying results for his environment as well I will add your script to the AD UDF.
Thanks for your effort

[crackdonalds]

It works perfectly well indeed, thanks for that.

I was trying to get a quick and dirty gui up with checkboxes. Each box would be 1 hour, just like in the default AD management tool. Checkbox on = 1, checkbox off = 0.
Which suits the script well since it is binary. By default checkbox off = 4 tho and since there are maaaaany checkboxes, i thought to be smart and loop through them.

Turns out i can't put variable names into an array and then use GUICTRLREAD() on them.

Case $ButtonTest
            Dim $checkboxarray[169]
            For $i = 0 to UBound($checkboxarray) -1
               $checkboxarray[$i] = "$Checkbox" & $i +1
               Next
            Dim $box[169]
         For $i = 0 to UBound($box) -1
            If GUICtrlRead($checkboxarray[$i]) = 4 then
               $box[$i] = 0
            Else
               $box[$i] = 1
EndIf
            ;MsgBox(0, "", $box1)
         Next
         _ArrayDisplay($checkboxarray)
         _ArrayDisplay($box)

 

Any tips so i don't have to create 169 lines to read each checkbox?

[water]

Create the checkboxes in a loop and store the ControlID of the first checkbox in a variable. The ControlID is just a number that gets counted up by AutoIt.
Will provide an example quite soon