AD Probems

[sandyd]

Hi Everyone,

We have multiple domain controllers i n multiple sites around the country.

When an account is locked out, it doesn't always show as locked on all of the domain controllers and I have to manually use AD Users and Computers to connect to each and unlock, reset accounts.

Does anyone know of some code to connect to each domain controller, find the required user and unlock their account / reset their password.

Any bits of code, ideas etc are welcome.

I believe that this may be a useful tool, and once the basics are done, any extra functions can be added.

Possible start a new Autoit project?

If not, just a bit help for me would be nice.

[nfwu]

You can have a client/server type of architechure.

Every single domain controller has a server that you write. This program stays on all the time. (Usually as a service)

You carry around a client application that you can use to connect to anyone of the servers and send commands to one or more servers at a time.

The client will respond to the commands and do the required automation on the targeted domain controller(s).

Hope this makes sense.

For the networking part, you can use AutoIt's TCP functions.

Starting point for some TCP references:

http://www.autoitscript.com/forum/index.php?showtopic=20589

#)

[arcker]

this bug is a well known bug of AD

the lockedout part is really bugged in windows 2000 server, but not in 2003

anyway, there is on msdn a script that permit to show all user locked on the domain, (you have to paste this code to create a new rule)

c u

[Jos]

MS has a utility called LockoutStatus.exe which can show the status of a user in all DC's .....