Active Directory UDF - General - Revision history

Water at 08:42, 6 June 2020

2020-06-06T08:42:45Z

← Older revision		Revision as of 08:42, 6 June 2020
Line 17:		Line 17:
	Every script calls at least the following functions:		Every script calls at least the following functions:
	<syntaxhighlight lang="autoit">		<syntaxhighlight lang="autoit">
	_AD_Open() ; Open a connection to the Active Directory		_AD_Open() ; Open a connection to the Active Directory
	_AD_* ; Any function that queries or alters the Active Directory		_AD_* ; Any function that queries or alters the Active Directory
	_AD_Close() ; Close the connection		_AD_Close() ; Close the connection
	</syntaxhighlight>		</syntaxhighlight>

Line 41:		Line 41:
	The following examples are equivalent:		The following examples are equivalent:
	<syntaxhighlight lang="autoit">		<syntaxhighlight lang="autoit">
	$iResult = _AD_Open("DJ", "password of DJ")		$iResult = _AD_Open("DJ", "password of DJ")
	$iResult = _AD_Open("microsoft\DJ", "password of DJ")		$iResult = _AD_Open("microsoft\DJ", "password of DJ")
	$iResult = _AD_Open("DJ@microsoft.com", "password of DJ")		$iResult = _AD_Open("DJ@microsoft.com", "password of DJ")
	</syntaxhighlight>		</syntaxhighlight>
	If you want to connect to a specific Domain Controller in the domain then simply specify the HostServer.		If you want to connect to a specific Domain Controller in the domain then simply specify the HostServer.
Line 58:		Line 58:
	Examples of the needed parameters:		Examples of the needed parameters:
	<syntaxhighlight lang="autoit">		<syntaxhighlight lang="autoit">
	$sDNSDomainParam = Active Directory domain name e.g. "DC=subdomain,DC=example,DC=com"		$sDNSDomainParam = Active Directory domain name e.g. "DC=subdomain,DC=example,DC=com"
	$sHostServerParam = Name of Domain Controller e.g. "servername.subdomain.example.com" or "subdomain.example.com" (access the domain root)		$sHostServerParam = Name of Domain Controller e.g. "servername.subdomain.example.com" or "subdomain.example.com" (access the domain root)
	$sConfigurationParam = Configuration naming context e.g. "CN=Configuration,DC=subdomain,DC=example,DC=com"		$sConfigurationParam = Configuration naming context e.g. "CN=Configuration,DC=subdomain,DC=example,DC=com"
	</syntaxhighlight>		</syntaxhighlight>
	Example:<br>		Example:<br>
Line 124:		Line 124:

	Example of an INI-file:		Example of an INI-file:
	~~<syntaxhighlight lang="text">~~[Global]		[Global]
	Security=1		Security=1

			[TEST_Open]
			Security=18

	~~[TEST_Open]~~
	~~Security=18~~
	~~</syntaxhighlight>~~
	The Global variable $__iSecurity or the SECURITY key from the INI files can have the values as specified for the $iSecurity parameter.<br>		The Global variable $__iSecurity or the SECURITY key from the INI files can have the values as specified for the $iSecurity parameter.<br>
	If $iSecurity was not specified in _AD_Open then this Global values overwrite $iSecurity.<br>		If $iSecurity was not specified in _AD_Open then this Global values overwrite $iSecurity.<br>

Water at 08:37, 6 June 2020

2020-06-06T08:37:09Z

← Older revision		Revision as of 08:37, 6 June 2020
Line 1:		Line 1:
	The Active Directory UDF offers functions to control and manipulate Microsoft Active Directory. This page describes the Active Directory UDF in general.		The Active Directory UDF offers functions to control and manipulate Microsoft Active Directory. This page describes the Active Directory UDF in general.

	== Concept ==		== Concept ==
	The Active Directory UDF is based upon this concept:		The Active Directory UDF is based upon this concept:
Line 12:		Line 13:
	== Prerequisites ==		== Prerequisites ==
	You have to run version 3.3.6.0 of AutoIt or newer.		You have to run version 3.3.6.0 of AutoIt or newer.

	== Structure ==		== Structure ==
	Every script calls at least the following functions:		Every script calls at least the following functions:
Line 22:		Line 24:
	== Open a connection ==		== Open a connection ==
	There are multiple ways to open a connection to the Active Directory. <br>Only one connection can be open at any time. This means you can't connect to two domains at the same time. You have to connect to the first domain, do all the work, close the connection and open the connection to the second domain. This is true for the Global Catalog as well.		There are multiple ways to open a connection to the Active Directory. <br>Only one connection can be open at any time. This means you can't connect to two domains at the same time. You have to connect to the first domain, do all the work, close the connection and open the connection to the second domain. This is true for the Global Catalog as well.

	=== To current domain ===		=== To current domain ===
	No additional information is needed if you want to connect to the domain the computer is already connected to. _AD_Open uses the credentials of the currently logged in user to connect to the domain.		No additional information is needed if you want to connect to the domain the computer is already connected to. _AD_Open uses the credentials of the currently logged in user to connect to the domain.
Line 44:		Line 47:
	If you want to connect to a specific Domain Controller in the domain then simply specify the HostServer.		If you want to connect to a specific Domain Controller in the domain then simply specify the HostServer.

	Example:~~<br>~~		Example:
	<syntaxhighlight lang="autoit">		<syntaxhighlight lang="autoit">
	$iResult = _AD_Open("DJ", "password of DJ", "", "DC1.domain.com") ; setting alternate credentials		$iResult = _AD_Open("DJ", "password of DJ", "", "DC1.domain.com") ; setting alternate credentials
Line 93:		Line 96:

	=== Secure connection ===		=== Secure connection ===

	==== To a Domain Controller ====		==== To a Domain Controller ====
	If you want to use SSL and/or password encryption when you connect to a Domain Controller you have to set parameter 6 of _AD_Open.<br>		If you want to use SSL and/or password encryption when you connect to a Domain Controller you have to set parameter 6 of _AD_Open.<br>
Line 120:		Line 124:

	Example of an INI-file:		Example of an INI-file:
	<syntaxhighlight>[Global]		<syntaxhighlight lang="text">[Global]
	Security=1		Security=1

Line 183:		Line 187:

	== Debugging ==		== Debugging ==

	=== _AD_ErrorNotify ===		=== _AD_ErrorNotify ===
	To get detailed error information about COM errors add function _AD_ErrorNotify. This function traps all COM errors and logs them. The following values can be used as first parameter:		To get detailed error information about COM errors add function _AD_ErrorNotify. This function traps all COM errors and logs them. The following values can be used as first parameter:
Line 208:		Line 213:

	== Example scripts ==		== Example scripts ==

	=== Query Bitlocker Recovery Information ===		=== Query Bitlocker Recovery Information ===
	<syntaxhighlight lang="autoit">		<syntaxhighlight lang="autoit">
Line 224:		Line 230:
	_AD_Close()		_AD_Close()
	</syntaxhighlight>		</syntaxhighlight>

	== Tips & Tricks ==		== Tips & Tricks ==
	* The UDF does not fully support the "granular password policy" feature implemented with Windows Server 2008. Please check the section about Fine-Grained Password Policy above.		* The UDF does not fully support the "granular password policy" feature implemented with Windows Server 2008. Please check the section about Fine-Grained Password Policy above.
Line 231:		Line 238:
	* Special characters: If you call a function with a Fully Qualified Domain Name (FQDN) as parameter you as a user have to make sure that all special characters ("\/#,+<>;=) are escaped with a preceding backslash. You can call function _AD_FixSpecialChars(String, 1) to escape or _AD_FixSpecialChars(string, 0) to unescape the special characters		* Special characters: If you call a function with a Fully Qualified Domain Name (FQDN) as parameter you as a user have to make sure that all special characters ("\/#,+<>;=) are escaped with a preceding backslash. You can call function _AD_FixSpecialChars(String, 1) to escape or _AD_FixSpecialChars(string, 0) to unescape the special characters
	* How to run the AD UDF on Windows PE is described [https://www.autoitscript.com/forum/topic/109251-active-directory-udf-help-support/?do=findComment&comment=910175 here].		* How to run the AD UDF on Windows PE is described [https://www.autoitscript.com/forum/topic/109251-active-directory-udf-help-support/?do=findComment&comment=910175 here].

	== Good reading ==		== Good reading ==
	* [https://blogs.technet.microsoft.com/389thoughts/2017/02/03/uniqueness-requirements-for-attributes-and-objects-in-active-directory/ Uniqueness requirements for attributes and objects in Active Directory]		* [https://blogs.technet.microsoft.com/389thoughts/2017/02/03/uniqueness-requirements-for-attributes-and-objects-in-active-directory/ Uniqueness requirements for attributes and objects in Active Directory]
	[[Category:UDF]]		[[Category:UDF]]

Water: /* Error handling */

2020-06-06T08:29:58Z

Error handling

← Older revision		Revision as of 08:29, 6 June 2020
Line 154:		Line 154:
	[3] LDAP Provider - name of the provider that raised the error		[3] LDAP Provider - name of the provider that raised the error
	[4] 52e - Win32 error code extracted from element[2]		[4] 52e - Win32 error code extracted from element[2]
	[5] Logon failure: unknown user name or bad password - description of the Win32 error code ~~as returned by _WinAPI_FormatMessage~~		[5] Logon failure: unknown user name or bad password - description of the Win32 error code

	Some of the Win32 error codes you can see:		Some of the Win32 error codes you can see:

Water: /* Fine-Grained Password Policy */

2020-06-06T08:26:32Z

Fine-Grained Password Policy

← Older revision		Revision as of 08:26, 6 June 2020
Line 177:		Line 177:
	* _AD_SetPasswordExpire (not affected)		* _AD_SetPasswordExpire (not affected)
	<br />		<br />
	The following functions ~~DO NOT work with~~ FGPP ~~or have not been tested yet~~:		The following functions do not (fully) support FGPP:
	* _AD_GetPasswordExpired (does not support FGPP)		* _AD_GetPasswordExpired (does not support FGPP)
	* _AD_GetPasswordInfo (all returned values are based on the Group Policy, except value 13 (calculated password expiration date/time) which takes FGPP into account)		* _AD_GetPasswordInfo (all returned values are based on the Group Policy, except value 13 (calculated password expiration date/time) which takes FGPP into account)

Water: /* Set security settings from outside your script */

2020-04-18T10:26:59Z

Set security settings from outside your script

← Older revision		Revision as of 10:26, 18 April 2020
Line 131:		Line 131:

	This means for the INI file above:		This means for the INI file above:
	* If you didn't specify security setting for _AD_Open then security is set to 1 (encrypt userid and password) else the security setting for _AD_Open ~~remain~~ unchanged.</br>This is True for all scripts but _TEST_Open.		* If you didn't specify security setting for _AD_Open then security is set to 1 (encrypt userid and password) else the security setting for _AD_Open remains unchanged.</br>This is True for all scripts but _TEST_Open.
	* The security setting for _AD_Open gets overwritten with a value of 2 (encrypt the channel using Secure Sockets Layer (SSL)). This is because you added 16 to the security setting.</br>This is True for _TEST_Open.		* The security setting for _AD_Open gets overwritten with a value of 2 (encrypt the channel using Secure Sockets Layer (SSL)). This is because you added 16 to the security setting.</br>This is True for _TEST_Open.

Water: /* Set security settings from outside your script */

2020-04-18T10:25:51Z

Set security settings from outside your script

← Older revision		Revision as of 10:25, 18 April 2020
Line 119:		Line 119:
	# Set Global variable $__iSecurity in your script or one of your include files		# Set Global variable $__iSecurity in your script or one of your include files

	~~Format~~ of an INI-file:		Example of an INI-file:
	<syntaxhighlight>[Global]		<syntaxhighlight>[Global]
	Security=1		Security=1

Water: /* Set security settings from outside your script */

2020-04-09T08:02:34Z

Set security settings from outside your script

← Older revision		Revision as of 08:02, 9 April 2020
Line 110:		Line 110:
	Microsoft has changed the minimum security requirements for LDAP access as described [https://www.autoitscript.com/forum/topic/158419-active-directory-udf-help-support-iii/?do=findComment&comment=1448538 here].		Microsoft has changed the minimum security requirements for LDAP access as described [https://www.autoitscript.com/forum/topic/158419-active-directory-udf-help-support-iii/?do=findComment&comment=1448538 here].

	If you do not want to modify all of your AutoIt scripts you can modify the security ~~settings~~ from outside.		If you do not want to modify all of your AutoIt scripts you can modify the security setting from outside.
	The UDF provides several levels to set the security from outside. The levels are processed from low to high, overwriting a previously set level.		The UDF provides several levels to set the security from outside. The levels are processed from low to high, overwriting a previously set level.

Line 131:		Line 131:

	This means for the INI file above:		This means for the INI file above:
	* If you didn't specify security ~~settings~~ for _AD_Open then security is set to 1 (encrypt userid and password) else the security ~~settings~~ for _AD_Open remain unchanged.</br>This is True for all scripts but _TEST_Open.		* If you didn't specify security setting for _AD_Open then security is set to 1 (encrypt userid and password) else the security setting for _AD_Open remain unchanged.</br>This is True for all scripts but _TEST_Open.
	* The security ~~settings~~ for _AD_Open gets overwritten with a value of 2 (~~encrypted~~ the channel using Secure Sockets Layer (SSL)). This is because you added 16 to the security setting.</br>This is True for _TEST_Open.		* The security setting for _AD_Open gets overwritten with a value of 2 (encrypt the channel using Secure Sockets Layer (SSL)). This is because you added 16 to the security setting.</br>This is True for _TEST_Open.

	This rules ~~applay~~ to the Global variable $__iSecurity as well.		This rules apply to the Global variable $__iSecurity as well.

	=== Error handling ===		=== Error handling ===

Water: /* Secure connection */

2020-03-26T19:21:10Z

Secure connection

← Older revision		Revision as of 19:21, 26 March 2020
Line 108:		Line 108:

	==== Set security settings from outside your script ====		==== Set security settings from outside your script ====
	Microsoft has changed the minimum security requirements for LDAP ~~accAddess~~ as described [https://www.autoitscript.com/forum/topic/158419-active-directory-udf-help-support-iii/?do=findComment&comment=1448538 here].		Microsoft has changed the minimum security requirements for LDAP access as described [https://www.autoitscript.com/forum/topic/158419-active-directory-udf-help-support-iii/?do=findComment&comment=1448538 here].

	If you do not want to modify all of your AutoIt scripts ~~accessing AD~~ you can modify the security settings from outside.		If you do not want to modify all of your AutoIt scripts you can modify the security settings from outside.
	The UDF provides several levels to set the security from outside. The levels are processed from low to high, overwriting a previously set level.		The UDF provides several levels to set the security from outside. The levels are processed from low to high, overwriting a previously set level.

	# AD.INI file in the AutoIt include directory with a GLOBAL section (this is used for ALL scripts ~~calling _AD_Open~~)		# AD.INI file in the AutoIt include directory with a GLOBAL section (this is used for ALL scripts. It's a Global setting)
	# AD.INI file in the AutoIt include directory with a <scriptname> section (this is used for ~~ALL~~ scripts named <scriptname>.au3 or <scriptname>.exe)		# AD.INI file in the AutoIt include directory with a <scriptname> section (this is used for scripts named <scriptname>.au3 or <scriptname>.exe. It's a Global setting)
	# AD.INI file in the working directory with a GLOBAL section name (this is used for scripts in the working directory)		# AD.INI file in the working directory with a GLOBAL section name (this is used for ALL scripts in the working directory. It's a Local setting)
	# AD.INI file in the working directory directory with a <scriptname> section name (this is used for scripts named <scriptname>.au3 or <scriptname>.exe in the working directory)		# AD.INI file in the working directory directory with a <scriptname> section name (this is used for scripts named <scriptname>.au3 or <scriptname>.exe in the working directory. It's a Local setting)
	# Set Global variable $__iSecurity in your script or one of your include files		# Set Global variable $__iSecurity in your script or one of your include files

	Format of an INI-file:		Format of an INI-file:
	[Global]		<syntaxhighlight>[Global]
	-Security=11		Security=1

	[TEST_Open]		[TEST_Open]
	-Security=12		Security=18
			</syntaxhighlight>
			The Global variable $__iSecurity or the SECURITY key from the INI files can have the values as specified for the $iSecurity parameter.<br>
			If $iSecurity was not specified in _AD_Open then this Global values overwrite $iSecurity.<br>
			If $iSecurity was specified in _AD_Open then you need to add 16 to this Global values to overwrite $iSecurity.<br>

	~~The Global variable $__iSecurity or the SECURITY key from~~ the INI ~~files can have the values as specified for the $iSecurity parameter.~~		This means for the INI file above:
	If ~~$iSecurity was not specified in~~ _AD_Open then ~~this Global values overwrite $iSecurity~~.		* If you didn't specify security settings for _AD_Open then security is set to 1 (encrypt userid and password) else the security settings for _AD_Open remain unchanged.</br>This is True for all scripts but _TEST_Open.
	~~If $iSecurity was specified in~~ _AD_Open ~~then~~ you ~~need~~ to ~~add 16~~ to ~~this~~ Global ~~values to overwrite~~ $~~iSecurity~~.		* The security settings for _AD_Open gets overwritten with a value of 2 (encrypted the channel using Secure Sockets Layer (SSL)). This is because you added 16 to the security setting.</br>This is True for _TEST_Open.

			This rules applay to the Global variable $__iSecurity as well.

	=== Error handling ===		=== Error handling ===

Water: /* Secure connection */

2020-03-26T19:02:07Z

Secure connection

@@ Line 106: / Line 106: @@
 ==== To a Global Catalog ====
 If you want to use SSL for your connection to the Global Catalog use port 3269 instead of 3268.
 === Error handling ===

Water: Section "Good reading" added

2019-09-03T19:56:53Z

Section "Good reading" added

← Older revision		Revision as of 19:56, 3 September 2019
Line 202:		Line 202:
	* Special characters: If you call a function with a Fully Qualified Domain Name (FQDN) as parameter you as a user have to make sure that all special characters ("\/#,+<>;=) are escaped with a preceding backslash. You can call function _AD_FixSpecialChars(String, 1) to escape or _AD_FixSpecialChars(string, 0) to unescape the special characters		* Special characters: If you call a function with a Fully Qualified Domain Name (FQDN) as parameter you as a user have to make sure that all special characters ("\/#,+<>;=) are escaped with a preceding backslash. You can call function _AD_FixSpecialChars(String, 1) to escape or _AD_FixSpecialChars(string, 0) to unescape the special characters
	* How to run the AD UDF on Windows PE is described [https://www.autoitscript.com/forum/topic/109251-active-directory-udf-help-support/?do=findComment&comment=910175 here].		* How to run the AD UDF on Windows PE is described [https://www.autoitscript.com/forum/topic/109251-active-directory-udf-help-support/?do=findComment&comment=910175 here].
			== Good reading ==
			* [https://blogs.technet.microsoft.com/389thoughts/2017/02/03/uniqueness-requirements-for-attributes-and-objects-in-active-directory/ Uniqueness requirements for attributes and objects in Active Directory]
	[[Category:UDF]]		[[Category:UDF]]