Active Directory UDF - Help & Support (III)

[rafzak]

 

In the list of computers, field the description contains DisplayName. Can I make filtering computers to description field (DisplayName)?

 

'>

DisplayName in this fields (Description) is User`s Surname+Name (sn+ +given name). Sorry, if I don`t good explain.

[JLogan3o13]

If you have that configured in the Description already, then you could do something like this. Someone can probably help you with a regex to capture only the user's name:

#include <AD.au3>

_AD_Open()

    $aComputers = _AD_GetObjectsInOU("","(objectclass=computer)", 2,"name,operatingSystem,description")
    _ArraySort($aComputers, 0, 0, 0, 1)
    _ArrayDisplay($aComputers, "Computers in AF Domain", "", Default, Default, "PC Name|Operating System|Description")

[rafzak]

 

If you have that configured in the Description already, then you could do something like this. Someone can probably help you with a regex to capture only the user's name:

#include <AD.au3>

_AD_Open()

    $aComputers = _AD_GetObjectsInOU("","(objectclass=computer)", 2,"name,operatingSystem,description")
    _ArraySort($aComputers, 0, 0, 0, 1)
    _ArrayDisplay($aComputers, "Computers in AF Domain", "", Default, Default, "PC Name|Operating System|Description")

Thank you. But how can I select Computers for Description field (display only Computers with specific Description)?

Edited February 12, 2015 by rafzak

[water]

Global $sSearch = "description to search for"
$aComputers = _AD_GetObjectsInOU("","(&(objectclass=computer)(description=*" & $sSearch & "*)), 2,"name,operatingSystem,description")

[rafzak]

water, JLogan3o13

Big thank you. All work!

[water]

[Grantson]

Hi Water

I tried to follow this example to limit my search to a specific server

; *****************************************************************************
; Example 2
; Get a list of all PrintQueues for a specified spool server
; *****************************************************************************
Global $sSpoolServer = StringSplit($aPrintQueues[1][1], ".")
$aPrintQueues = _AD_ListPrintQueues($sSpoolServer[1])
If @error > 0 Then
    MsgBox(16, "Active Directory Functions", "Could not find any print queues for server '" & $sSpoolServer[1] & "'")
    Exit
Else
    _ArrayDisplay($aPrintQueues, "Active Directory Functions - Example 2 - All print queues for spool server '" & $sSpoolServer[1] & "'")
EndIf
 

but it complains about $aprintqueues being used before deceleration. which looks right as it doesnt populate the array until the next line.

My enviroment has 6 print servers and I need to sreturn only the printers on two of them.

Is there a way to do this with the UDF or do I just need to get creative with _arraysearch?

Thanks

Grant

[water]

The array causing the error message is defined in example 1.

But for what you need this example should work (untested):

#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 2
; Get a list of all PrintQueues for the specified spool server
; *****************************************************************************
Global $sSpoolServer = "Name of the print server you want to query"
Global $aPrintQueues = _AD_ListPrintQueues($sSpoolServer)
If @error > 0 Then
    MsgBox(16, "Active Directory Functions", "Could not find any print queues for server '" & $sSpoolServer & "'")
    Exit
Else
    _ArrayDisplay($aPrintQueues, "Active Directory Functions - Example 2 - All print queues for spool server '" & $sSpoolServer & "'")
EndIf

; Close Connection to the Active Directory
_AD_Close()

[kor]

@Water, is there a way to filter both users AND ou's in the filter for _GetObjectsInOU ??

I need to query all users in AD and exclude users that have certain attributes, but I also need to exclude outright all users in 1 particular OU. Is this possible?

Here is my code but it's not working.

I've been reading online and one person had some luck doing something similar with a different coding language where they did 2 separate queries, the first getting all the users, then filtering them based on the OU they are in.

My particular problem is our environment is so huge either method isn't particularly practical.

The original user query returns ~69,000 users (after the filter)

and if I wanted to query just by OU's we have over 300 OU's to loop through and query users for.

#include <AD.au3>
#include <Array.au3>

_AD_Open()

$q1 = ""
;$q1 = "(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(company=stu)(!(!company=*)))"
$q2 = ""
$q2 = "(&(objectCategory=organizationlUnit)(!(ou=dn:=OU=Alumni,OU=Users,OU=Building1,DC=test,DC=domain,DC=ORG)))"
$sStudentQuery = "(&" & $q1 & $q2 & ")"

ConsoleWrite($sStudentQuery & @CR)

    $aUsers = _AD_GetObjectsInOU("", $sStudentQuery, 2, "sAMAccountName,physicalDeliveryOfficeName,title", "") ; query AD
    ; $aUsers[$i][0] = sAMAccountName (username)
    ; $aUsers[$i][1] = physicalDeliveryOfficeName (site)
    ; $aUsers[$i][2] = title (grade)

_ArrayDisplay($aUsers)

;OU=Alumni,OU=Users,OU=Building1,DC=test,DC=domain,DC=ORG
;(!(ou:dn:=Alumni))
;(!(ou=dn:=dn:=OU=Alumni,OU=Users,OU=Building1,DC=test,DC=domain,DC=ORG))
;(!(ou:dn:OU=Alumni,OU=Users,OU=Building1,DC=test,DC=domain,DC=ORG))


_AD_Close()

[water]

I'm not in my office right now, so I can't test.

But it should be possible by excluding all users with the specufic OU in property distinguishedname.

[kor]

I'm not in my office right now, so I can't test.

But it should be possible by excluding all users with the specufic OU in property distinguishedname.

I'm not sure that is possible.

http://www.winvistatips.com/threads/ldap-filter-on-distinguishedname-wildcards-dont-work.758937/

http://stackoverflow.com/questions/2295092/ldap-using-a-filter-to-avoid-a-sub-cn-in-active-directory

http://www.developerscrappad.com/1052/windows/active-directory/quick-note-unable-to-perform-ldap-wildcard-search-on-windows-active-directory/

At least using a wildcard. Were you suggesting something else?

[water]

I would have tried wildcards.

How many users need to be excluded?

[kor]

I would have tried wildcards.

How many users need to be excluded?

Currently the OU that needs to be excluded contains about ~3,000 users. However it grows by about 800-1000 users every 6 month rotation.

[jorgev]

Hello,

I have a performance issue with the following example:

#include <AD.au3>
#include <File.au3>
_AD_Open()
Local $array
_FileReadToArray ( "userslist.txt", $array ); +- 250 lines: CN=xxxxxxxxxx,OU=xxxx,OU=xxxx,OU=xxxx,OU=xxxx,DC=xxxx,DC=xx,DC=xx

for $x = 1 to $array[0]
   $prop = _AD_GetObjectProperties($array[$x], "displayname")
Next

>Exit code: 0    Time: 48.02

48 secs for 250 users. If i do this in powershell it would take only a few secs.

Can i somehow speed up the process?

Edited March 4, 2015 by jorgev

[water]

Currently the OU that needs to be excluded contains about ~3,000 users. However it grows by about 800-1000 users every 6 month rotation.

In this case I would read all users and drop the unneeded from the array.

Other way would be to pull a list of OUs and query all but one of them and combine the results.

[water]

Hello,

 

I have a performance issue with the following example:

#include <AD.au3>
#include <File.au3>
_AD_Open()
Local $array
_FileReadToArray ( "userslist.txt", $array ); +- 250 lines: CN=xxxxxxxxxx,OU=xxxx,OU=xxxx,OU=xxxx,OU=xxxx,DC=xxxx,DC=xx,DC=xx

for $x = 1 to $array[0]
   $prop = _AD_GetObjectProperties($array[$x], "displayname")
Next

>Exit code: 0    Time: 48.02

 

48 secs for 250 users. If i do this in powershell it would take only a few secs.

 

Can i somehow speed up the process?

You could try function _AD_GetObjectAttribute. This function only grabs a single attribute and hence is much faster.

[jorgev]

Thanks,

I don't know why but i thought    _AD_GetObjectProperties($array[$x], "displayname")    would only grab 1 property, displayname.

_AD_GetObjectAttribute is much faster if you need 1 or few properties, tx

[water]

_AD_GetObjectProperties does not just read the properties, but formats them (lockout date/time etc.). It can return multiple properties at once.

_AD_GetObjectAttribute only retrieves a single attribute without formatting.

[Robdog1955]

I am trying to find a list of usernames for a given last name. I've been playing around with this line of code:

$aObjects = _AD_GetObjectsInOU($sOU, "(name=smithrl1)", 2, "displayname,name")

After this line I use _ArrayDisplay($aObjects)

It works perfectly. However, when I change to this:

$aObjects = _AD_GetObjectsInOU($sOU, "(lastname=Smith)", 2, "displayname,name")

Its returns error of No OU found.

I've tried both "lastname=Smith" and "surname=Smith" and neither work.

What am I missing?

[water]

Should be:

$aObjects = _AD_GetObjectsInOU($sOU, "(sn=Smith)", 2, "displayname,name")