Active Directory UDF (II)

[water]

Does the example script I posted above work for you and return the desired result?

[Valnurat]

Yes it does.

 

[Valnurat]

For some reason _AD_GetObjectsInOU gives 1 more computer than exists. We only have 113 desktops, but end result shows 114. As mentioned in post 35

[water]

This is described in the help file (or the function header in the UDF):

Quote

The default filter returns an array including one record for the OU itself. To exclude the OU use a different filter that doesn't include the OU
e.g. "(&(objectcategory=person)(objectclass=user)(name=*))"

Use

$aComputersSource = _AD_GetObjectsInOU("OU=Laptops,OU=bla bla bla", "(&(objectCategory=computer)"(name=*))"

 

[Valnurat]

I get an syntax error:
 

"(&(objectCategory=computer)"(
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^

 

[water]

My bad. Should be:

$aComputersSource = _AD_GetObjectsInOU("OU=Laptops,OU=bla bla bla", "(&(objectCategory=computer)(name=*))"

 

[Valnurat]

$aComputers is empty.

$aComputers = _AD_GetObjectsInOU("OU=Desktops,OU=Computers,OU=BLA,DC=org", "(&(objectCategory=computer)(name=*))")
_ArrayDisplay("",$aComputers)

 

[water]

Strange. Will test tomorrow.

[jazzyjeff]

Is it possible to retrieve group policy information from this script?

 

Thanks.

[water]

Short answer: No
But IIRC there is a UDF available on the forum.

[Valnurat]

9 hours ago, water said:

Strange. Will test tomorrow.

Sorry, I'm stupid.

This will not work.

_ArrayDisplay("",$aComputers)

But this will.

_ArrayDisplay($aComputers,"")

So your filter is working. Doh.

[water]

 

[water]

Quote

The UDF does not support the Default keyword. Please check the wiki (section Tips & Tricks) for this.

@Valnurat: The next version of the UDF will support the Default keyword

[Valnurat]

[31290]

Hi fellows

Is there a way to get the "sAMAccountName" of an account by giving my script the "Displayname" properties that I have stored in an excel file?

Thanks

-31290-

[water]

As the Displayname is not unique (means: There could be more than one user with the same Displayname) you need to use a - time consuming  - approach like this:

#include <AD.au3>

_AD_Open()
Global $sDisplayName1 = "Doe Jane"
Global $aResult = _AD_GetObjectsInOU("", "(&(objectcategory=person)(objectclass=user)(displayname=" & $sDisplayName1 & "))", 2, "samaccountname,displayname")
_ArrayDisplay($aResult)

To make it a bit faster you could query multiple users at once:

#include <AD.au3>

_AD_Open()
Global $sDisplayName1 = "Doe Jane"
Global $sDisplayName2 = "Schneider*"
Global $aResult = _AD_GetObjectsInOU("", "(&(objectcategory=person)(objectclass=user)(|(displayname=" & $sDisplayName1 & ")(displayname=" & $sDisplayName2 & ")))", 2, "samaccountname,displayname")
_ArrayDisplay($aResult)

Note:

The displayName attribute of user objects has no restrictions. In ADUC, this is the field labeled "Display name". It can be missing, or identical to the value for other users. However, you could also mean the Relative Distinguished Name of the user. This is also called the "Common Name" and is the value of the cn attribute of the user. It corresponds to the field labeled "Name" in ADUC.

The value of the cn attribute is required must be unique in the Organizational Unit or container where the object resides. Two users can have the same value for cn if their objects are in different OU/containers. The sAMAccountName (also called the "pre-Windows 2000 logon" name, or what many people call the username or userid) must be unique in the domain.

 

[31290]

Hi Water, 

That is perfect, thanks a lot

[water]

 

[david1337]

Hi water

I use this to get a list of users in the OU "Department"

#include <AD.au3>

_AD_Open()

$Users = _AD_GetObjectsInOU("OU=Department,OU=Users,OU=topOU,DC=company,DC=local", "(objectclass=user)")

_AD_Close()


_ArrayDisplay($Users, "", Default, 8)

Is it possible to exclude disabled users in the result?

[water]

Extend your LDAP query to exclude those with

"userAccountControl:1.2.840.113556.1.4.803:=" & $ADS_UF_ACCOUNTDISABLE

 

Edited March 8, 2017 by water