Active Directory UDF

Introduction

The Active Directory UDF offers functions to control and manipulate Microsoft Active Directory.


Function _AD_Close

Function Reference

_AD_Close

Closes the connection established to Active Directory by _AD_Open.

#Include <AD.au3>
_AD_Close()

Parameters

None.

Return Value

Success: 1
Failure: 0, sets @error to:
1 - Closing the connection to the AD failed. @extended returns the error code received by the COM error handler

Remarks

Even if closing the connection wasn't successfull and @error is set all used variables have been reset.

Related

_AD_Open

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Open a connection to the Active Directory; get the Fully Qualified Domain
; Name (FQDN) for the current user; close the connection.
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get the Fully Qualified Domain Name (FQDN) for the current User
Global $sFQDN = _AD_SamAccountNameToFQDN()
MsgBox(64, "Active Directory Functions - Example 1", "The Fully Qualified Domain Name (FQDN) for the currently logged on user is: " & @CRLF & $sFQDN)

; Close Connection to the Active Directory
_AD_Close()


Function _AD_Open

Function Reference

_AD_Open

Opens a connection to Active Directory.

#Include <AD.au3>
_AD_Open([$sUserIdParam = "", $sPasswordParam = ""[, $sDNSDomainParam = "", $sHostServerParam = "", $sConfigurationParam = ""[, $iSecurity = 0]]])

Parameters

$sUserIdParam | [optional] UserId credential for authentication. This has to be a valid domain user
$sPasswordParam | [optional] Password for authentication
$sDNSDomainParam | [optional] Active Directory domain name if you want to connect to an alternate domain e.g. DC=microsoft,DC=com
$sHostServerParam | [optional] Name of Domain Controller if you want to connect to a different domain e.g. DC-Server1.microsoft.com If you want to connect to a Global Catalog append port 3268 e.g. DC-Server1.microsoft.com:3268 You can omit the servername e.g. only specify microsoft.com if you want to access the domain root
$sConfigurationParam | [optional] Configuration naming context if you want to connect to a different domain e.g. CN=Configuration,DC=microsoft,DC=com
$iSecurity | [optional] Specifies the security settings to be used. This can be set from outside the script - please see Remarks. Can be a combination of the following: 0: No security settings are used (default) 1: Sets the connection property "Encrypt Password" to True to encrypt userid and password 2: The channel is encrypted using Secure Sockets Layer (SSL). AD requires that the Certificate Server be installed to support SSL

Return Value

Success: 1
Failure: 0, sets @error to:
1 - (No longer used)
2 - Creation of the COM object to the AD failed. @extended returns error code from ObjCreate
3 - Open the connection to AD failed. @extended returns error code of the COM error handler.
Generated if the User doesn't have query / modify access
4 - Creation of the RootDSE object failed. @extended returns the error code received by the COM error handler.
Generated when connection to the domain isn't successful. @extended returns -2147023541 (0x8007054B)
5 - Creation of the DS object failed. @extended returns the error code received by the COM error handler
6 - Parameter $sHostServerParam and $sConfigurationParam are required when $sDNSDomainParam is specified
7 - Parameter $sPasswordParam is required when $sUserIdParam is specified
8 - OpenDSObject method failed. @extended set to error code received from the OpenDSObject method.
On Windows XP or lower this shows that $sUserIdParam and/or $sPasswordParam are invalid
x - For Windows Vista and later: Win32 error code (decimal). To get detailed error information call function _AD_GetLastADSIError

Remarks

To close the connection to the Active Directory, use the _AD_Close function.

_AD_Open will use the alternative credentials $sUserIdParam and $sPasswordParam if passed as parameters.
$sUserIdParam has to be in one of the following forms (assume the samAccountName = DJ)
* Windows Login Name e.g. "DJ"
* NetBIOS Login Name e.g. "\DJ"
* User Principal Name e.g. "DJ@domain.com"
All other name formats have NOT been successfully tested (see section "Link").

Connection to an alternate domain (not the domain your computer is a member of) or if your computer is not a domain member
requires $sDNSDomainParam, $sHostServerParam and $sConfigurationParam as FQDN as well as $sUserIdParam and $sPasswordParam.
Example:
$sDNSDomainParam = "DC=subdomain,DC=example,DC=com"
$sHostServerParam = "servername.subdomain.example.com"
$sConfigurationParam = "CN=Configuration,DC=subdomain,DC=example,DC=com"

The COM error handler will be initialized only if there doesn't already exist another error handler.

If you specify $sUserIdParam as NetBIOS Login Name or User Principal Name and the OS is Windows Vista or later then _AD_Open will try to
verify the userid/password.
@error will be set to the Win32 error code (decimal). To get detailed error information please call _AD_GetlastADSIError.
For all other OS or if userid is specified as Windows Login Name @error=8.
This is OS dependant because Windows XP doesn't return useful error information.
For Windows Login Name all OS return success even when an error occures. This seems to be caused by secure authentification.

$iSecurity = 2 activates LDAP/SSL. LDAP/SSL uses port 636 by default.
Note that an SSL server certificate must be configured properly in order to use SSL.

Lately MS changed the minimum security requirements for LDAP connections.
The UDF provides several levels to set the security from outside. The levels are processed from low to high, overwriting a previously set level.
This avoids the need to modify each script.
1) AD.INI file in the AutoIt include directory with a GLOBAL section name and a SECURITY key name
2) AD.INI file in the AutoIt include directory with a section name and a SECURITY key name
3) AD.INI file in the working directory with a GLOBAL section name and a SECURITY key name
4) AD.INI file in the working directory directory with a section name and a SECURITY key name
5) Global variable $__iSecurity

The Global variable $__iSecurity or the SECURITY key from the INI files can have the values as specified for the $iSecurity parameter.
If $iSecurity was not specified in _AD_Open then this Global values overwrite $iSecurity.
If $iSecurity was specified in _AD_Open then you need to add 16 to this Global values to overwrite $iSecurity.

If you want to connect to a specific DC in the current domain then just provide $sHostServerParam and let $sDNSDomainParam and $sConfigurationParam be blank.

Related

_AD_Close

See Also

http://msdn.microsoft.com/en-us/library/cc223499(PROT.10).aspx (Simple Authentication), http://msdn.microsoft.com/en-us/library/aa746471(VS.85).aspx (ADO)

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Open a connection to the Active Directory; get the Fully Qualified Domain
; Name (FQDN) for the current user; close the connection.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <EditConstants.au3>
#include <WindowsConstants.au3>

Global $SUserID1, $SUserID2, $SUserId3, $SDNSDomain, $SHostServer, $SConfiguration, $SPassword, $SUserId, $aTEMP

; User is already a domain member
If @LogonDomain <> "" Then
; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)
$SUserID1 = @UserName
$SUserID2 = @LogonDomain & "\" & @UserName
$SUserId3 = @UserName & "@" & @LogonDNSDomain
$SDNSDomain = $sAD_DNSDomain
$SHostServer = $sAD_HostServer
$SConfiguration = $sAD_Configuration
_AD_Close()
EndIf

#region ### START Koda GUI section ### Form=
Global $Form1_1 = GUICreate("Active Directory Functions - Example 1", 515, 290, 251, 112)
GUICtrlCreateLabel("UserId", 8, 12, 39, 21)
GUICtrlSetFont(-1, 8, 800, 0, "MS Sans Serif")
GUICtrlCreateLabel("Windows Login Name:", 96, 12, 131, 21)
Global $IRadio1 = GUICtrlCreateRadio("", 72, 8, 17, 21)
Global $IUserId1 = GUICtrlCreateInput($SUserID1, 241, 8, 259, 21)
GUICtrlCreateLabel("NetBIOS Login Name:", 96, 44, 131, 21)
Global $IRadio2 = GUICtrlCreateRadio("", 72, 40, 17, 21)
Global $IUserId2 = GUICtrlCreateInput($SUserID2, 241, 40, 259, 21)
GUICtrlCreateLabel("User Principal Name:", 96, 76, 131, 21)
Global $IRadio3 = GUICtrlCreateRadio("", 72, 72, 17, 21)
Global $IUserId3 = GUICtrlCreateInput($SUserId3, 241, 72, 259, 21)
GUICtrlCreateLabel("Password", 8, 108, 200, 21)
GUICtrlSetFont(-1, 8, 800, 0, "MS Sans Serif")
Global $IPassword = GUICtrlCreateInput("", 241, 104, 259, 21, $ES_PASSWORD)
GUICtrlCreateLabel("DNSDomain", 8, 140, 200, 21)
GUICtrlSetFont(-1, 8, 800, 0, "MS Sans Serif")
Global $IDNSDomain = GUICtrlCreateInput($SDNSDomain, 241, 140, 259, 21)
GUICtrlCreateLabel("HostServer", 8, 172, 200, 21)
GUICtrlSetFont(-1, 8, 800, 0, "MS Sans Serif")
Global $IHostServer = GUICtrlCreateInput($SHostServer, 241, 172, 259, 21)
GUICtrlCreateLabel("Configuration", 8, 204, 200, 21)
GUICtrlSetFont(-1, 8, 800, 0, "MS Sans Serif")
Global $IConfiguration = GUICtrlCreateInput($SConfiguration, 241, 204, 259, 21)
Global $BOK = GUICtrlCreateButton("Logon", 8, 246, 130, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 428, 246, 73, 33)

; User is already a domain member
If @LogonDomain <> "" Then
GUICtrlSetState($IRadio2, $GUI_CHECKED)
GUICtrlSetState($IPassword, $GUI_FOCUS)
EndIf

GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
$SPassword = GUICtrlRead($IPassword)
If $SPassword = "" Then
MsgBox(16, "Active Directory Functions", "Password is missing!")
GUICtrlSetState($IPassword, $GUI_FOCUS)
ContinueCase
EndIf
$SDNSDomain = GUICtrlRead($IDNSDomain)
$SHostServer = GUICtrlRead($IHostServer)
$SConfiguration = GUICtrlRead($IConfiguration)
If GUICtrlRead($IRadio1) = $GUI_CHECKED Then
$SUserId = GUICtrlRead($IUserId1)
EndIf
If GUICtrlRead($IRadio2) = $GUI_CHECKED Then
$SUserId = GUICtrlRead($IUserId2)
$aTEMP = StringSplit($SUserId, "\")
If $aTEMP[0] <> 2 Then
MsgBox(16, "Active Directory Functions", "Wrong format for NETBIOS name." & @CRLF & "Has to be 'Domain\Userid'.")
GUICtrlSetState($IUserId2, $GUI_FOCUS)
ContinueCase
EndIf
EndIf
If GUICtrlRead($IRadio3) = $GUI_CHECKED Then
$SUserId = GUICtrlRead($IUserId3)
If StringInStr($SUserId, "@") = 0 Then
MsgBox(16, "Active Directory Functions", "Wrong format for User Principal Name." & @CRLF & "Has to be e.g. 'Userid@domain.com'.")
GUICtrlSetState($IUserId3, $GUI_FOCUS)
ContinueCase
EndIf
EndIf
; Open Connection to the Active Directory
If _AD_Open($SUserId, $SPassword, $SDNSDomain, $SHostServer, $SConfiguration) Then
MsgBox(64, "Active Directory Functions", "Logon was succcessful!")
ElseIf @error <= 8 Then
MsgBox(16, "Active Directory Functions", "The logon was not succcessful!" & @CRLF & @CRLF & "@error: " & @error & ", @extended: " & @extended)
Else
MsgBox(16, "Active Directory Functions", "The logon was not succcessful!" & @CRLF & @CRLF & "@error: " & @error & ", @extended: " & @extended & _
@CRLF & @CRLF & "Extended error information will be displayed")
Global $aError = _AD_GetLastADSIError()
_ArrayDisplay($aError)
EndIf
; Close Connection to the Active Directory
_AD_Close()
EndSwitch
WEnd


Function _AD_ErrorNotify

Function Reference

_AD_ErrorNotify

Set or query the debug level.

#Include <AD.au3>
_AD_ErrorNotify($iDebug[, $sDebugFile = @ScriptDir & "\AD_Debug.txt"])

Parameters

$iDebug | Debug level. Allowed values are: -1 - Return the current settings 0 - Disable debugging 1 - Enable debugging. Output the debug info to the console 2 - Enable Debugging. Output the debug info to a MsgBox 3 - Enable Debugging. Output the debug info to a file defined by $sDebugFile 4 - Enable Debugging. The COM errors will be handled (the script no longer crashes) without any output
$sDebugFile | [optional] File to write the debugging info to if $iDebug = 3 (Default = @ScriptDir & "\AD_Debug.txt")

Return Value

Success (for $iDebug =: 1) - one based one-dimensional array with the following elements:
1 - Debug level. Value from 0 to 3. Check parameter $iDebug for details
2 - Debug file. File to write the debugging info to as defined by parameter $sDebugFile
3 - True if the COM error handler has been set for this UDF. False if debugging is set off or another COM error handler was already set
Success (for $iDebug = 0): 1
Success (for $iDebug => 0): 1, sets @extended to:
0 - The COM error handler for this UDF was already active
1 - A COM error handler has successfully been initialized for this UDF
Failure: 0, sets @error to:
1 - $iDebug is not an integer or < -1 or > 4
2 - Installation of the custom error handler failed. @extended is set to the error code returned by ObjEvent
3 - COM error handler already set to another function

Remarks

None.

Related

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1
; Set the debugging options to MsgBox.
; *****************************************************************************
_AD_ErrorNotify(2)
If @error Then MsgBox(16, "Active Directory Example Skript", "Function _AD_ErrorNotify encountered a problem. @error = " & @error & ", @extended = " & @extended)
; Provoke a COM error
_AD_GetObjectAttribute(@UserName, "xyz")

; *****************************************************************************
; Example 2
; Set the debugging option to file and set the filename.
; Query the debugging options and display the resulting array.
; *****************************************************************************
; Set the debugging options
_AD_ErrorNotify(3, "C:\temp\AD_Loggin.txt")
If @error Then MsgBox(16, "Active Directory Example Skript", "Function _AD_ErrorNotify encountered a problem. @error = " & @error & ", @extended = " & @extended)
; Query the debugging options
Global $aResult = _AD_ErrorNotify(-1)
If @error Then MsgBox(16, "Active Directory Example Skript", "Function _AD_ErrorNotify encountered a problem. @error = " & @error & ", @extended = " & @extended)
_ArrayDisplay($aResult)


Function _AD_VersionInfo

Function Reference

_AD_VersionInfo

Returns an array of information about the AD.au3 UDF.

#Include <AD.au3>
_AD_VersionInfo()

Parameters

None.

Return Value

Success: one-dimensional one based array with the following information:
1 - Release Type (T=Test or V=Production)
2 - Major Version
3 - Minor Version
4 - Sub Version
5 - Release Date (YYYYMMDD)
6 - AutoIt version required
7 - List of authors separated by ","
8 - List of contributors separated by ","

Remarks

Based on function _IE_VersionInfo written bei Dale Hohm

Related

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y

#include <AD.au3>

;------------------------------------------------------------------------------------------------------------------------------------------------
; Example 1 - Display the version info for this UDF
;------------------------------------------------------------------------------------------------------------------------------------------------
Global $aVersionInfo = _AD_VersionInfo()
Global $aResult[9][2] = [[8,2],["Release type", $aVersionInfo[1]],["Major version", $aVersionInfo[2]],["Minor version", $aVersionInfo[3]], _
["Sub version", $aVersionInfo[4]],["Release date", $aVersionInfo[5]],["AutoIt version required", $aVersionInfo[6]],["Authors", $aVersionInfo[7]], _
["Contributors", $aVersionInfo[8]]]
_ArrayDisplay($aResult, "Active Directory Functions - Version Info for the UDF")


Function _AD_CreateUser

Function Reference

_AD_CreateUser

Creates and activates a user in the specified OU.

#Include <AD.au3>
_AD_CreateUser($sOU, $sUser, $sCN)

Parameters

$sOU | OU to create the user in. Form is "OU=sampleou,OU=sampleparent,DC=sampledomain1,DC=sampledomain2"
$sUser | Username, form is SamAccountName without leading 'CN='
$sCN | Common Name (without CN=) or RDN (Relative Distinguished Name) like "Lastname Firstname"

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sUser already exists
2 - $sOU does not exist
3 - $sCN is missing
4 - $sUser is missing
5 - $sUser could not be created. @extended is set to the error returned by LDAP
x - Error returned by SetInfo method (Missing permission etc.)

Remarks

This function only sets sAMAccountName (= $sUser) and userPrincipalName (e.g. $sUser@microsoft.com).
All other attributes have to be set using function _AD_ModifyAttribute

Related

_AD_CreateOU, _AD_CreateGroup, _AD_AddUserToGroup, _AD_RemoveUserFromGroup

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Creates and activates a user in a particular OU.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $sFQDN = _AD_SamAccountNameToFQDN()
Global $sParentOU = StringMid($sFQDN, StringInStr($sFQDN, ",OU=") + 1)
Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script creates a new user in the specified OU." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter parent OU and user to create
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 124)
GUICtrlCreateLabel("Enter the OU (FQDN):", 8, 10, 231, 17)
GUICtrlCreateLabel("Enter the user to create (samAccountName)", 8, 42, 231, 17)
Global $IOU = GUICtrlCreateInput($sParentOU, 241, 8, 459, 21)
Global $IUser = GUICtrlCreateInput("Test-User", 241, 40, 459, 21)
Global $BOK = GUICtrlCreateButton("Create User", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sOU = GUICtrlRead($IOU)
Global $sUser = GUICtrlRead($IUser)
ExitLoop
EndSwitch
WEnd

; Create a new user
Global $iValue = _AD_CreateUser($sOU, $sUser, "Doe John")
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' in OU '" & $sOU & "' successfully created")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' already exists")
ElseIf @error = 2 Then
MsgBox(64, "Active Directory Functions - Example 1", "OU '" & $sOU & "' does not exist")
ElseIf @error = 3 Then
MsgBox(64, "Active Directory Functions - Example 1", "Value for CN (e.g. Lastname Firstname) is missing")
ElseIf @error = 4 Then
MsgBox(64, "Active Directory Functions - Example 1", "Value for $sAD_User is missing")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_GetAccountsExpired

Function Reference

_AD_GetAccountsExpired

Returns an array with FQDNs of expired accounts (user, computer).

#Include <AD.au3>
_AD_GetAccountsExpired([$sClass = "user"[ ,$sDTEExpire = ""[ ,$sDTSExpire = ""[, $sRoot = ""]]]])

Parameters

$sClass | [optional] Specifies if expired user accounts or computer accounts should be returned (default = "user"). "user" - Returns objects of category "user" "computer" - Returns objects of category "computer"
$sDTEExpire | YYYY/MM/DD HH:MM:SS (local time) returns all accounts that expire between $sDTSExpire and the specified date/time (default = "" = Now)
$sDTSExpire | YYYY/MM/DD HH:MM:SS (local time) returns all accounts that expire between the specified date/time and $sDTEExpire (default = "1601/01/01 00:00:00)
$sRoot | [optional] FQDN of the OU where the search should start (default = "" = search the whole tree)

Return Value

Success: One-based two dimensional array of FQDNs of expired accounts
0 - FQDNs of expired accounts
1 - account expired YYYY/MM/DD HH:NMM:SS UTC
2 - account expired YYYY/MM/DD HH:NMM:SS local time of calling user
Failure: "", sets @error to:
1 - No expired accounts found. @extended is set to the error returned by LDAP
2 - Specified date/time is invalid
3 - Invalid value for $sClass. Has to be "user" or "computer"
4 - Specified $sRoot does not exist

Remarks

None.

Related

_AD_IsAccountExpired, _AD_SetAccountExpire

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $aExpired[1]
; *****************************************************************************
; Example 1
; Get a list of expired user accounts
; *****************************************************************************
$aExpired = _AD_GetAccountsExpired()
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "No expired user accounts could be found")
Else
_ArrayDisplay($aExpired, "Active Directory Functions - Example 1 - Expired User Accounts")
EndIf

; *****************************************************************************
; Example 2
; Get a list of user accounts that expire end of this year
; *****************************************************************************
$aExpired = _AD_GetAccountsExpired("user", @YEAR & "/12/31")
If @error = 0 Then
_ArrayDisplay($aExpired, "Active Directory Functions - Example 2 - Expired User Accounts (by the end of this year)")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 2", "No expired user accounts could be found")
Else
MsgBox(64, "Active Directory Functions - Example 2", "Invalid parameters provided")
EndIf

; *****************************************************************************
; Example 3
; Get a list of user accounts that expire between january and october this year
; *****************************************************************************
$aExpired = _AD_GetAccountsExpired("user", @YEAR & "/10/31", @YEAR & "/01/01")
If @error = 0 Then
_ArrayDisplay($aExpired, "Active Directory Functions - Example 3 - Expired User Accounts (january to october this year)")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 3", "No expired user accounts could be found")
Else
MsgBox(64, "Active Directory Functions - Example 3", "Invalid parameters provided")
EndIf

; *****************************************************************************
; Example 4
; Get a list of expired computer accounts
; *****************************************************************************
$aExpired = _AD_GetAccountsExpired("computer")
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 4", "No expired computer accounts could be found")
Else
_ArrayDisplay($aExpired, "Active Directory Functions - Example 4 - Expired Computer Accounts")
EndIf


Function _AD_GetLastLoginDate

Function Reference

_AD_GetLastLoginDate

Returns the lastlogin information for user and computer accounts from all DCs using the SamAccountName.

#Include <AD.au3>
_AD_GetLastLoginDate([$sObject = @Username[, $sSite = ""[, $aDCList = ""]]])

Parameters

$sObject | [optional] SamAccountName of a user or computer account to get the last login date (default = @Username).
$sSite | [optional] Only query DCs that belong to this site(s) (default = all sites). This can be a single site or a list of sites separated by commas
$aDCList | [optional] one-based two dimensional array of Domain Controllers as returned by function _AD_ListDomainControllers (default = "")

Return Value

Success: Last login date returned as YYYYMMDDHHMMSS. @extended is set to the total number of Domain Controllers.
@error could be > 0 and contains the number of DCs that could not be reached or returns no data
Failure: 0, sets @error to:
1 - $sObject could not be found. @extended = 0
2 - $sObject has never logged in to the domain. @extended = 0
3 - $aDCList has to be an array or blank
4 - $aDCList has to be a 2-dimensional array
Warning: Last login date returned as YYYYMMDDHHMMSS (see Success), sets @error and @extended to:
x - Number of DCs which could not be reached. Result is returned from all available DCs. @extended is set to the total number of Domain Controllers

Remarks

If it takes (too) long to get a result either some DCs are down or you have too many DCs in your AD.
+Case one: Please check @error and @extended as described above
+Case two: Specify parameter $sSite to reduce the number of DCs to query and/or retrieve the list of DCs yourself and pass the array as parameter 3

Related

See Also

http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1
; Get last login date for current user. Returned as YYYYMMDDHHMMSS
; *****************************************************************************
Global $iLLDate = _AD_GetLastLoginDate()
MsgBox(64, "Active Directory Functions - Example 1", "Last Login Date for User '" & @UserName & "'" & @CRLF & $iLLDate)

; *****************************************************************************
; Example 2
; Get last login date for current computer. Returned as YYYYMMDDHHMMSS
; *****************************************************************************
$iLLDate = _AD_GetLastLoginDate(@ComputerName & "$")
MsgBox(64, "Active Directory Functions - Example 2", "Last Login Date for Computer '" & @ComputerName & "$'" & @CRLF & $iLLDate)


Function _AD_IsAccountExpired

Function Reference

_AD_IsAccountExpired

Returns 1 if the account (user, computer) has expired.

#Include <AD.au3>
_AD_IsAccountExpired([$sObject = @Username])

Parameters

$sObject [optional] Account (User, computer) to check (default = @Username). Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName

Return Value

Success: 1, The specified account has expired
Failure: 0, sets @error to:
0 - Account has not expired
1 - $sObject could not be found
2 - An error occurred when accessing property AccountExpirationDate. @extended is set to the error returned by LDAP

Remarks

None.

Related

_AD_GetAccountsExpired, _AD_SetAccountExpire

See Also

http://www.rlmueller.net/AccountExpires.htm

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1
; Checks if the current user account is expired.
; *****************************************************************************
Global $iResult = _AD_IsAccountExpired()
If @error Then
MsgBox(16, "Active Directory Example Skript", "Function _AD_IsAccountExpired encountered a problem. @error = " & @error & ", @extended = " & @extended)
ElseIf $iResult = 1 Then
MsgBox(64, "Active Directory Functions", "User account '" & @UserName & "' has expired")
Else
MsgBox(64, "Active Directory Functions", "User account '" & @UserName & "' has not expired")
EndIf

; *****************************************************************************
; Example 2
; Checks if the current computer account is expired.
; *****************************************************************************
$iResult = _AD_IsAccountExpired(@ComputerName & "$")
If @error Then
MsgBox(16, "Active Directory Example Skript", "Function _AD_IsAccountExpired encountered a problem. @error = " & @error & ", @extended = " & @extended)
ElseIf $iResult = 1 Then
MsgBox(64, "Active Directory Functions", "Computer account '" & @ComputerName & "$" & "' has expired")
Else
MsgBox(64, "Active Directory Functions", "Computer account '" & @ComputerName & "$" & "' has not expired")
EndIf


Function _AD_SetAccountExpire

Function Reference

_AD_SetAccountExpire

Modifies the specified user or computer account expiration date/time or sets the account to never expire.

#Include <AD.au3>
_AD_SetAccountExpire($sObject, $sDateTime)

Parameters

$sObject | User or computer account to set expiration date/time (sAMAccountName or FQDN)
$sDateTime | Expiration date/time in format: yyyy-mm-dd hh:mm:ss (local time) or "01/01/1970" to never expire

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetInfo method (Missing permission etc.)

Remarks

Use the following syntax for the date/time:
01/01/1970 = never expire
yyyy-mm-dd hh:mm:ss= "international format" - always works
xx/xx/xx = "localized format" - the format depends on the local date/time settings

Microsoft:
The date when the account expires. This value represents the number of 100-nanosecond intervals since January 1, 1601 (UTC).
A value of 0 or 0x7FFFFFFFFFFFFFFF (9223372036854775807) indicates that the account never expires.

Richard L. Mueller:
"In Active Directory Users and Computers you can specify the date when a user account expires on the "Account"
tab of the user properties dialog. This date is stored in the accountExpires attribute of the user object.
There is also a property method called AccountExpirationDate, exposed by the IADsUser interface, that can be
used to display and set this date. If you've ever compared accountExpires and AccountExpirationDate with the
date shown in ADUC, you may have wondered what's going on. It is common for the values to differ by a day,
sometimes even two days."

Related

See Also

http://www.rlmueller.net/AccountExpires.htm; https://msdn.microsoft.com/en-us/library/windows/desktop/ms675098(v=vs.85).aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Sets a user account expiration date or sets the date to never expire.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $sFQDN = _AD_SamAccountNameToFQDN()
Global $sParentOU = StringMid($sFQDN, StringInStr($sFQDN, ",OU=") + 1)
Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script sets the account expiration date for a specified user." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter user and expiration date
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 124)
GUICtrlCreateLabel("User to change (FQDN or sAMAccountName):", 8, 10, 231, 17)
GUICtrlCreateLabel("Expiration date (yyyy-mm-dd):", 8, 42, 231, 17)
Global $IUser = GUICtrlCreateInput("", 241, 8, 459, 21)
Global $IDate = GUICtrlCreateInput("", 241, 40, 459, 21)
Global $BOK = GUICtrlCreateButton("Change User", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sDate = GUICtrlRead($IDate)
Global $sUser = GUICtrlRead($IUser)
ExitLoop
EndSwitch
WEnd

; Change the expiration date
Global $iValue = _AD_SetAccountExpire($sUser, $sDate)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' successfully changed")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_AddEmailAddress

Function Reference

_AD_AddEmailAddress

Appends an SMTP email address to the 'Email Addresses' tab of an Exchange-enabled AD account.

#Include <AD.au3>
_AD_AddEmailAddress($sUser, $sNewEmail[, $bPrimary = False])

Parameters

$sUser | User account (sAMAccountName or FQDN)
$sNewEmail | Email address to add to the account
$bPrimary | [optional] if True the new email address will be set as primary address

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sUser does not exist
2 - Could not connect to $sUser. @extended is set to the error returned by LDAP
x - Error returned by GetEx or SetInfo method (Missing permission etc.)

Remarks

None.

Related

_AD_ModifyAttribute

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Add an additional SMTP email address to the 'Email Addresses' tab
; of an Exchange-enabled AD account
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script adds a SMTP mail address to an Exchange-enabled user." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter parent UserId, EMailAddress and a flag to make this address the default address
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 156)
GUICtrlCreateLabel("EMail-enabled userid (samAccountName or FQDN):", 8, 10, 331, 17)
GUICtrlCreateLabel("Address to add:", 8, 42, 231, 17)
GUICtrlCreateLabel("If set makes the new address the default address:", 8, 74, 331, 34)
Global $IUser = GUICtrlCreateInput(@UserName, 341, 8, 359, 21)
Global $IAddress = GUICtrlCreateInput("", 341, 40, 359, 21)
Global $IFlag = GUICtrlCreateCheckbox("", 341, 72, 359, 21)
Global $BOK = GUICtrlCreateButton("Add address", 8, 114, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 114, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sUser = GUICtrlRead($IUser)
Global $sAddress = GUICtrlRead($IAddress)
Global $sFlag = BitAND(GUICtrlRead($IFlag), $GUI_CHECKED)
ExitLoop
EndSwitch
WEnd

; Add a new address
Global $iValue = _AD_AddEmailAddress($sUser, $sAddress, $sFlag)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Address '" & $sAddress & "' successfully added")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' does not exist")
ElseIf @error = 2 Then
MsgBox(64, "Active Directory Functions - Example 1", "Could not connect to '" & $sUser & "'")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_CreateMailbox

Function Reference

_AD_CreateMailbox

Creates a mailbox for a user.

#Include <AD.au3>
_AD_CreateMailbox($sUser, $sStoreName[, $sStore[, $sEMailServer[, $sAdminGroup[, $sEmailDomain]]]])

Parameters

$sUser | User account (sAMAccountName or FQDN) to add mailbox to
$sStoreName | Mailbox storename
$sStore | [optional] Information store (Default = "First Storage Group")
$sEmailServer | [optional] Email server (Default = First server returned by _AD_ListExchangeServers())
$sAdminGroup | [optional] Administrative group in Exchange (Default= "First Administrative Group")
$sEmailDomain | [optional] Exchange Server Group name e.g. "My Company" (Default = Text after first DC= in $sAD_DNSDomain)

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sUser does not exist
2 - $sUser already has a mailbox
3 - _AD_ListExchangeServers() returned an error. Please see @extended for _AD_ListExchangeServers() return code
x - Error returned by CreateMailbox or SetInfo method (Missing permission etc.)

Remarks

The mailbox is created using CDOEXM. For this function to work the Exchange administration tools have to be installed on the
computer running the script.
To set rights on the mailbox you have to run at least Exchange 2000 SP2.

If the Exchange administration tools are not installed on the PC running the script you could use an ADSI only solution.
Set the mailNickname and displayName properties of the user and at least one of this: homeMTA, homeMDB or msExchHomeServerName and
the RUS (Recipient Update Service) of Exchange 2000/2003 will create the mailbox for you.
Be aware that this no longer works for Exchange 2007 and later.

Related

See Also

http://www.msxfaq.de/code/makeuser.htm

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Create a mailbox for a user.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script creates a mailbox for a user." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

Global $sUser, $sMailbox, $sIStore, $sServer, $sGroup, $sServerGroup
; Get the forms data for the current user
Global $sHomeMDB = _AD_GetObjectAttribute(@UserName, "HomeMDB")
If @error = 0 Then
Global $aTemp = StringSplit($sHomeMDB, ",")
$sMailbox = StringMid($aTemp[1], 4)
$sIStore = StringMid($aTemp[2], 4)
$sServer = StringMid($aTemp[4], 4)
$sGroup = StringMid($aTemp[6], 4)
$sServerGroup = StringMid($aTemp[8], 4)
EndIf
; Enter the necessary data
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 514, 252)
GUICtrlCreateLabel("User account (FQDN or samAccountName):", 8, 10, 231, 17)
GUICtrlCreateLabel("Mailbox storename:", 8, 42, 231, 17)
GUICtrlCreateLabel("Information store:", 8, 74, 231, 17)
GUICtrlCreateLabel("EMail server:", 8, 106, 231, 17)
GUICtrlCreateLabel("Administrative group in Exchange:", 8, 138, 231, 17)
GUICtrlCreateLabel("Exchange Server Group:", 8, 170, 231, 17)
Global $lUser = GUICtrlCreateInput(@UserName, 241, 8, 259, 21)
Global $IMailbox = GUICtrlCreateInput($sMailbox, 241, 40, 259, 21)
Global $IIStore = GUICtrlCreateInput($sIStore, 241, 72, 259, 21)
Global $IServer = GUICtrlCreateInput($sServer, 241, 104, 259, 21)
Global $IGroup = GUICtrlCreateInput($sGroup, 241, 136, 259, 21)
Global $IServerGroup = GUICtrlCreateInput($sServerGroup, 241, 168, 259, 21)
Global $BOK = GUICtrlCreateButton("Create mailbox", 8, 200, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 428, 200, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
$sUser = GUICtrlRead($lUser)
$sMailbox = GUICtrlRead($IMailbox)
$sIStore = GUICtrlRead($IIStore)
$sServer = GUICtrlRead($IServer)
$sGroup = GUICtrlRead($IGroup)
$sServerGroup = GUICtrlRead($IServerGroup)
ExitLoop
EndSwitch
WEnd

; Create Mailbox
Global $iValue = _AD_CreateMailbox($sUser, $sMailbox, $sIStore, $sServer, $sGroup, $sServerGroup)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Mailbox for User '" & $sUser & "' successfully created")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' does not exist")
ElseIf @error = 2 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' already has a mailbox defined")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_CreateMailboxPS

Function Reference

_AD_CreateMailboxPS

Creates a mailbox for a user using PowerShell

#Include <AD.au3>
_AD_CreateMailboxPS($sUser, $sURI[, $sSessionParam = Default[, $sMailboxParam = Default[, $iRunShowFlag = Default]])

Parameters

$sUser | User account (SamAccountName or FQDN) for which you want to create the mailbox
$sURI | Specifies a URI that defines the connection endpoint for the session. The URI must be fully qualified.
$sSessionParam | [optional] One or multiple additional parameters for the PowerShell "Session" command e.g. " -Authentication Kerberos"
$sMailboxParam | [optional] One or multiple additional parameters for the PowerShell "Enable-Mailbox" command (see parameter $sSessionParam)
$iRunShowFlag | [optional] Sets the show-flag parameter of the Run command. Default = Default keyword

Return Value

Success: Zero based one-dimensional array holding the StdOut messages written by PowerShell
Failure: "", sets @error to:
1 - $sUser does not exist
2 - $sUser already has a mailbox
3 - $sUser is invalid (empty)
4 - $sURI is invalid (empty)
5 - Run returned an error (PowerShell could not be started). @extended is set to the @error returned by Run
6 - Writing to StdIn returned an error. @extended is set to the @error returned by StdinWrite
Failure: Zero based one-dimensional array holding the StdErr messages written by PowerShell, sets error to:
7 - PowerShell has written some error messages to StdErr.

Remarks

The mailbox is created using PowerShell. No additional tools need to be installed on the local mchine.

Related

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Create a mailbox for a user by using PowerShell
; *****************************************************************************
#include <AD.au3>
#include <MsgBoxConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox($MB_ICONERROR, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)
; Query data needed for the function call
Global $sUser = InputBox("Active Directory Example Skript", "User account (SamAccountName or FQDN) for which you want to create the mailbox.", @Username, Default, 400, 150)
If @error Then Exit
Global $sURI = InputBox("Active Directory Example Skript", "URI of the Exchange server you want to connect to.", "http://YourExchangeServerNameGoesHere.CompanyName.com", Default, 400, 150)
If @error Then Exit
; Let the user confirm the data before creating the mailbox
If MsgBox($MB_YESNOCANCEL, "Active Directory Example Skript", "Are you sure that you want to connect to" & @CRLF & " " & $sURI & @CRLF & "and create a mailbox for user" & @CRLF & " " & $sUser) <> $IDYES Then Exit
; Create the mailbox
Global $vResult = _AD_CreateMailboxPS($sUser, $sURI)
If @error > 0 Then
If @error < 7 Then
MsgBox($MB_ICONERROR, "Error!", "_AD_CreateMailboxPS returned @error = " & @error & ", @extended = " & @extended)
Else
_ArrayDisplay($vResult, "_AD_CreateMailboxPS returned @error = " & @error & ", @extended = " & @extended)
EndIf
Else
_ArrayDisplay($vResult, "_AD_CreateMailboxPS successfully created the mailbox!")
EndIf
_AD_Close()
Exit


Function _AD_DeleteMailbox

Function Reference

_AD_DeleteMailbox

Deletes a users mailbox.

#Include <AD.au3>
_AD_DeleteMailbox($sUser)

Parameters

$sUser User account (sAMAccountName or FQDN) to delete mailbox from

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sUser does not exist
2 - $sUser doesn't have a mailbox
x - Error returned by DeleteMailbox or SetInfo method (Missing permission etc.)

Remarks

None.

Related

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Delete the mailbox of a user.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script deletes the mailbox of a user." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter the necessary data
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 514, 124)
GUICtrlCreateLabel("User account (FQDN or samAccountName):", 8, 10, 231, 17)
Global $lUser = GUICtrlCreateInput(@UserName, 241, 8, 259, 21)
Global $BOK = GUICtrlCreateButton("Delete mailbox", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 428, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sUser = GUICtrlRead($lUser)
ExitLoop
EndSwitch
WEnd

; Delete Mailbox
Global $iValue = _AD_DeleteMailbox($sUser)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Mailbox for User '" & $sUser & "' successfully created")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' does not exist")
ElseIf @error = 2 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' doesn't have a mailbox")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_ListExchangeMailboxStores

Function Reference

_AD_ListExchangeMailboxStores

Enumerates all Exchange Mailbox Stores in the Forest.

#Include <AD.au3>
_AD_ListExchangeMailboxStores()

Parameters

None.

Return Value

Success: Returns a one-based two dimensional array with the following information:
0 - name
1 - cn
2 - distinguishedName
Failure: "", sets @error to:
1 - No Exchange Mailbox Stores found. @extended is set to the error returned by LDAP

Remarks

None.

Related

_AD_ListExchangeServers

See Also

http://www.wisesoft.co.uk/scripts/vbscript_list_exchange_mailbox_stores.aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get a list of all Exchange Mailbox Stores in the Forest
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $aExServers = _AD_ListExchangeMailboxStores()
If @error > 0 Then
MsgBox(16, "Active Directory Functions", "Could not find any Exchange Mailbox Stores!")
Else
_ArrayDisplay($aExServers, "Active Directory Functions - Example 1 - All Exchange Mailbox Stores in the Forest")
EndIf


Function _AD_ListExchangeServers

Function Reference

_AD_ListExchangeServers

Enumerates all Exchange Servers in the Forest.

#Include <AD.au3>
_AD_ListExchangeServers()

Parameters

None.

Return Value

Success: Returns an one-based one dimensional array with the names of the Exchange Servers
Failure: "", sets @error to:
1 - No Exchange Servers found. @extended is set to the error returned by LDAP

Remarks

None.

Related

_AD_ListExchangeMailboxStores

See Also

http://www.wisesoft.co.uk/scripts/vbscript_list_exchange_servers.aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get a list of all Exchange Servers in the Forest
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $aExServers = _AD_ListExchangeServers()
If @error > 0 Then
MsgBox(16, "Active Directory Functions", "Could not find any Exchange Servers!")
Else
_ArrayDisplay($aExServers, "Active Directory Functions - Example 1 - All Exchange Servers in the Forest")
EndIf


Function _AD_MailEnableGroup

Function Reference

_AD_MailEnableGroup

Mail-enables a Group.

#Include <AD.au3>
_AD_MailEnableGroup($sGroup)

Parameters

$sGroup Groupname (sAMAccountName or FQDN)

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sGroup does not exist
x - Error returned by SetInfo method (Missing permission etc.)

Remarks

None.

Related

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Enables Mail for a Group.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script mail enables an AD group." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter Group to change
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 124)
GUICtrlCreateLabel("Group to change (FQDN or sAMAccountName):", 8, 10, 231, 17)
Global $IGroup = GUICtrlCreateInput("", 241, 10, 459, 21)
Global $BOK = GUICtrlCreateButton("Mail enable Group", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sGroup = GUICtrlRead($IGroup)
ExitLoop
EndSwitch
WEnd

; Change Group
Global $iValue = _AD_MailEnableGroup($sGroup)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Group '" & $sGroup & "' successfully changed")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Group '" & $sGroup & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_AddComputerToGroup

Function Reference

_AD_AddComputerToGroup

Alias for _AD_AddUserToGroup: Adds a computer to the specified group or computer.

#Include <AD.au3>
_AD_AddComputerToGroup($sTarget, $sObject)

Parameters

None.

Return Value

None.

Remarks

Please see: _AD_AddUserToGroup

Related

Please see: _AD_AddUserToGroup


Function _AD_AddGroupToGroup

Function Reference

_AD_AddGroupToGroup

Alias for _AD_AddUserToGroup: Adds a group to the specified group or computer.

#Include <AD.au3>
_AD_AddGroupToGroup($sTarget, $sObject)

Parameters

None.

Return Value

None.

Remarks

Please see: _AD_AddUserToGroup

Related

Please see: _AD_AddUserToGroup


Function _AD_AddUserToGroup

Function Reference

_AD_AddUserToGroup

Adds a user, group or computer to the specified group or computer.

#Include <AD.au3>
_AD_AddUserToGroup($sTarget, $sObject)

Parameters

$sTarget | Group or computer (FQDN or sAMAccountName) where $sObject should be added to
$sObject | User, group or computer to be added to $sTarget (FQDN or sAMAccountName)

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sTarget does not exist
2 - $sObject does not exist
3 - $sObject is already a member of $sTarget
x - Error returned by Add or SetInfo method (Missing permission etc.)

Remarks

The sAMAccountname of a computer requires a trailing "$" before converting it to a FQDN.

Related

_AD_AddComputerToGroup, _AD_AddGroupToGroup, _AD_CreateOU, _AD_CreateUser, _AD_CreateGroup, _AD_RemoveComputerFromGroup, _AD_RemoveGroupFromGroup, _AD_RemoveUserFromGroup

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Add a user to a specified group.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)
_AD_ErrorNotify(2)
Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script adds a user to a group." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter user account and group
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 514, 124)
GUICtrlCreateLabel("User account (FQDN or samAccountName):", 8, 10, 231, 17)
GUICtrlCreateLabel("Group name (without leading CN=):", 8, 42, 231, 17)
Global $lUser = GUICtrlCreateInput(@UserName, 241, 8, 259, 21)
Global $IGroup = GUICtrlCreateInput("", 241, 40, 259, 21)
Global $BOK = GUICtrlCreateButton("Assign user to group", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 428, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sUser = GUICtrlRead($lUser)
Global $sGroup = GUICtrlRead($IGroup)
ExitLoop
EndSwitch
WEnd

; Add user to group
Global $iValue = _AD_AddUserToGroup($sGroup, $sUser)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' successfully assigned to group '" & $sGroup & "'")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Group '" & $sGroup & "' does not exist")
ElseIf @error = 2 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' does not exist")
ElseIf @error = 3 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' is already a member of group '" & $sGroup & "'")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_CreateGroup

Function Reference

_AD_CreateGroup

Creates a group in the specified OU.

#Include <AD.au3>
_AD_CreateGroup($sOU, $sGroup[, $iType = $ADS_GROUP_TYPE_GLOBAL_SECURITY])

Parameters

$sOU | OU to create the group in. Form is "OU=sampleou,OU=sampleparent,DC=sampledomain1,DC=sampledomain2" (FQDN)
$sGroup | Groupname, form is SamAccountName without leading 'CN='
$iType | [optional] Group type (default = $ADS_GROUP_TYPE_GLOBAL_SECURITY). NOTE: Global security must be 'BitOr'ed with a scope.

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sGroup already exists
2 - $sOU does not exist
x - Error returned by Create or SetInfo method (Missing permission etc.)

Remarks

This function only sets sAMAccountName and grouptype. All other attributes have to be set using
function _AD_ModifyAttribute

Related

_AD_CreateOU, _AD_CreateUser, _AD_AddUserToGroup, _AD_RemoveUserFromGroup

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Create a group in the specified OU.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script creates a group in the OU you specify." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Get OU of current user
Global $sFQDN = _AD_SamAccountNameToFQDN()
Global $sParentOU = StringMid($sFQDN, StringInStr($sFQDN, ",OU=") + 1)

; Enter OU and group
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 124)
GUICtrlCreateLabel("Enter the target OU (FQDN):", 8, 10, 231, 17)
GUICtrlCreateLabel("Enter the group name (without leading CN=):", 8, 42, 231, 17)
Global $IOU = GUICtrlCreateInput($sParentOU, 241, 8, 459, 21)
Global $IGroup = GUICtrlCreateInput("", 241, 40, 459, 21)
Global $BOK = GUICtrlCreateButton("Create group", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sOU = GUICtrlRead($IOU)
Global $sGroup = GUICtrlRead($IGroup)
ExitLoop
EndSwitch
WEnd

; Create the group
Global $iValue = _AD_CreateGroup($sOU, $sGroup)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Group '" & $sGroup & "' successfully created")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Group '" & $sGroup & "' already exists")
ElseIf @error = 2 Then
MsgBox(64, "Active Directory Functions - Example 1", "OU '" & $sOU & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_GetGroupAdmins

Function Reference

_AD_GetGroupAdmins

Returns an array of the administrator sAMAccountNames for the specified group (not including the group owner/manager).

#Include <AD.au3>
_AD_GetGroupAdmins($sObject)

Parameters

$sObject group name. Can be SAMaccountName or FQDN

Return Value

Success: Returns an one-based one dimensional array with the sAMAccountNames of the administrators for the specified group
(not including the group owner/manager)
Failure: "", sets @error to:
1 - Group could not be found
2 - No administrators found

Remarks

None.

Related

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get a list of admins for the first group the current user is a member of
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get a sorted array of group names (FQDN) that the user is immediately a member of
Global $aUser
$aUser = _AD_GetUserGroups(@UserName)
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & @UserName & "' has not been assigned to any group")
Exit
Else
_ArraySort($aUser, 0, 1)
EndIf

; Check all groups the current user is a member of and display the first one with admins
Global $Found = False
Global $iCount, $aAdmins
For $iCount = 1 To $aUser[0]
$aAdmins = _AD_GetGroupAdmins($aUser[$iCount])
If @error = 0 Then
$Found = True
ExitLoop
EndIf
Next
If Not $Found Then
MsgBox(64, "Active Directory Functions - Example 1", "No admins assigned to all groups the current user is a member of")
Exit
Else
_ArrayDisplay($aAdmins, "Active Directory Functions - Example 1 - Admins for group '" & $aUser[$iCount] & "'")
EndIf


Function _AD_GetGroupMemberOf

Function Reference

_AD_GetGroupMemberOf

Returns an array of group membership.

#Include <AD.au3>
_AD_GetGroupMemberOf($sGroup)

Parameters

$sGroup Group for which membership in other groups is to be retrieved. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName

Return Value

Success: Returns an one-based one dimensional array of group names (FQDN) that the specified group is a member of
Failure: "", sets @error to:
1 - Specified group does not exist

Remarks

None.

Related

_AD_GetGroupMembers, _AD_RecursiveGetGroupMembers

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Returns a list of group membership (FQDN) for a group
; *****************************************************************************
#include <AD.au3>

Global $aGroups, $aMemberOf[1]

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get an array of group names (FQDN) that the user is immediately a member of with element 0 containing the number of groups.
$aGroups = _AD_GetUserGroups()

; Get a sorted list of membership for the first group the currently logged on user is a member of
$aMemberOf = _AD_GetGroupMemberOf($aGroups[1])
_ArraySort($aMemberOf, 0, 1)
_ArrayDisplay($aMemberOf, "Active Directory Functions - Example 1 - Membership for group '" & $aGroups[1] & "'")


Function _AD_GetGroupMembers

Function Reference

_AD_GetGroupMembers

Returns an array of group members.

#Include <AD.au3>
_AD_GetGroupMembers($sGroup)

Parameters

$sGroup Group to retrieve members from. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName

Return Value

Success: Returns an one-based one dimensional array of names (FQDN) that are members of the specified group
Failure: "", sets @error to:
1 - Specified group does not exist

Remarks

If the group has no members, _AD_GetGroupMembers returns an array with one element (row count) set to 0

Related

_AD_GetGroupMemberOf, _AD_RecursiveGetGroupMembers

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get a list of all groups the current user is a member of.
; Then get a sorted list of all group members for the first group of this array.
; *****************************************************************************
#include <AD.au3>

Global $aGroups[1], $aMembers[1]

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get an array of group names (FQDN) that the user is immediately a member of with element 0 containing the number of groups.
$aGroups = _AD_GetUserGroups()
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "The current user is not a member of any group")
Else
; Get a sorted list of members for the first group the currently logged on user is a member of
$aMembers = _AD_GetGroupMembers($aGroups[1])
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "The group '" & $aGroups[1] & "' has no members")
Else
_ArraySort($aMembers, 0, 1)
_ArrayDisplay($aMembers, "Active Directory Functions - Example 1 - List of members for group '" & $aGroups[1] & "'")
EndIf
EndIf


Function _AD_GetUserGroups

Function Reference

_AD_GetUserGroups

Returns an array of group names that the user is immediately a member of.

#Include <AD.au3>
_AD_GetUserGroups([$sUser = @UserName[, $bIncludePrimaryGroup = False]])

Parameters

$sUser | [optional] User for which the group membership is to be returned (default = @Username). Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$bIncludePrimaryGroup | [optional] include the primary group to the returned list (default = False)

Return Value

Success: Returns an one-based one dimensional array of group names (FQDN) the user is a member of
Failure: "", sets @error to:
1 - Specified user does not exist

Remarks

Works for computers or groups as well.

Related

_AD_IsMemberOf, _AD_GetUserPrimaryGroup, _AD_RecursiveGetMemberOf

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get a sorted array of group names (FQDN) that the user is immediately a
; member of.
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get a sorted array of group names (FQDN) that the user is immediately a member of
Global $aUser = _AD_GetUserGroups(@UserName)
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & @UserName & "' has not been assigned to any group")
Else
_ArraySort($aUser, 0, 1)
_ArrayDisplay($aUser, "Active Directory Functions - Example 1 - Group names user '" & @UserName & "' is immediately a member of")
EndIf


Function _AD_GetUserPrimaryGroup

Function Reference

_AD_GetUserPrimaryGroup

Returns the primary group the user is assigned to.

#Include <AD.au3>
_AD_GetUserPrimaryGroup([$sUser = @UserName])

Parameters

$sUser [optional] User for which the primary group is to be returned (default = @Username). Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName

Return Value

Success: Primary group (FQDN) the user is assigned to.
Failure: "", sets @error to:
1 - Specified user does not exist
2 - A primary group couldn't be found for the specified user

Remarks

None.

Related

_AD_IsMemberOf, _AD_GetUserGroups, _AD_RecursiveGetMemberOf, _AD_SetUserPrimaryGroup

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get the primary group for the current user
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

MsgBox(64, "Active Directory Functions - Example 1", "Primary group for user '" & @UserName & "' is '" & _AD_GetUserPrimaryGroup() & "'")


Function _AD_GroupAssignManager

Function Reference

_AD_GroupAssignManager

Assigns the user as group manager.

#Include <AD.au3>
_AD_GroupAssignManager($sGroup, $sUser)

Parameters

$sGroup | Groupname (sAMAccountName or FQDN)
$sUser | User to assign as manager (sAMAccountName or FQDN)

Return Value

Success: 1
Failure: 0, @error set
1 - $sGroup does not exist
2 - $sUser does not exist
x - Error returned by SetInfo method (Missing permission etc.)

Remarks

None.

Related

_AD_SetGroupManagerCanModify, _AD_GroupManagerCanModify, _AD_GroupRemoveManager

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Assigns a group manager (attribute "managedby") to a group.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script assigns a group manager to a group." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter group and user to assign as manager
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 124)
GUICtrlCreateLabel("Group (samAccountName or FQDN):", 8, 10, 231, 17)
GUICtrlCreateLabel("Manager for this group (samAccountName or FQDN):", 8, 42, 231, 34)
Global $IGroup = GUICtrlCreateInput("", 241, 8, 459, 21)
Global $IUser = GUICtrlCreateInput(@UserName, 241, 40, 459, 21)
Global $BOK = GUICtrlCreateButton("Assign Manager", 8, 82, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 82, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sGroup = GUICtrlRead($IGroup)
Global $sUser = GUICtrlRead($IUser)
ExitLoop
EndSwitch
WEnd

; Assign user as manager for the group
Global $iValue = _AD_GroupAssignManager($sGroup, $sUser)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' successfuly assigned as manager to group '" & $sGroup & "'")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Group '" & $sGroup & "' does not exist")
ElseIf @error = 2 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_GroupManagerCanModify

Function Reference

_AD_GroupManagerCanModify

Returns 1 if the manager of the group can modify the member list.

#Include <AD.au3>
_AD_GroupManagerCanModify($sObject)

Parameters

$sObject FQDN of the group

Return Value

Success: 1, Specified user can modify the member list
Failure: 0, @error set
1 - Group does not exist
2 - The group manager can not modify the member list
3 - There is no manager assigned to the group

Remarks

None.

Related

_AD_GroupAssignManager, _AD_GroupRemoveManager, _AD_SetGroupManagerCanModify

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get a list of users that have the attribute "manager" set
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get a list of groups that have the attribute "managedBy" set
Global $bNotFound, $bFound, $iCount, $aManager
Global $aManagedBy = _AD_GetManagedBy()
If @error > 0 Or $aManagedBy[0][0] = 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "No managed groups could be found")
$bNotFound = True
EndIf

; Check the list of groups if a manager can modify the group membership
$bFound = False
For $iCount = 1 To $aManagedBy[0][0]
$aManager = _AD_GroupManagerCanModify($aManagedBy[1][0])
If $aManager = 1 Then
$bFound = True
ExitLoop
EndIf
Next
If Not $bFound Then
MsgBox(64, "Active Directory Functions - Example 1", "No group manager can modify the group membership")
Exit
Else
MsgBox(64, "Active Directory Functions - Example 1", "Group manager can modify the group membership for group '" & $aManagedBy[$iCount][0] & "'")
EndIf


Function _AD_GroupRemoveManager

Function Reference

_AD_GroupRemoveManager

Remove the group manager from a group or only remove the manager's modify permission.

#Include <AD.au3>
_AD_GroupRemoveManager($sGroup[, $bFlag = False])

Parameters

$sGroup | Groupname (sAMAccountName or FQDN)
$bFlag | [optional] if True the function only removes the manager's modify permission

Return Value

Success: 1
Failure: 0, @error set
1 - $sGroup does not exist
2 - $sGroup does not have a manager assigned

Remarks

None.

Related

_AD_SetGroupManagerCanModify, _AD_GroupManagerCanModify, _AD_GroupAssignManager

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Removes the group manager (attribute "managedby") from a group.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script removes the group manager from a group." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter group to remove the manager from
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 124)
GUICtrlCreateLabel("Group (samAccountName or FQDN):", 8, 10, 231, 17)
Global $IGroup = GUICtrlCreateInput("", 241, 8, 459, 21)
Global $BOK = GUICtrlCreateButton("Remove Manager", 8, 82, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 82, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sGroup = GUICtrlRead($IGroup)
ExitLoop
EndSwitch
WEnd

; Remove group manager
Global $iValue = _AD_GroupRemoveManager($sGroup)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Successfuly removed the group manager from '" & $sGroup & "'")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Group '" & $sGroup & "' does not exist")
ElseIf @error = 2 Then
MsgBox(64, "Active Directory Functions - Example 1", "Group '" & $sGroup & "' does not have an assigned manager to remove")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_IsMemberOf

Function Reference

_AD_IsMemberOf

Returns 1 if the object (user, group, computer) is a member of the specified group or any contained group.

#Include <AD.au3>
_AD_IsMemberOf($sGroup[, $sObject = @Username[, $bIncludePrimaryGroup = False[, $bRecursive = False[, $iDepth = 10]]]])

Parameters

$sGroup | Group to be checked for membership. Can be specified as sAMAccountName or Fully Qualified Domain Name (FQDN)
$sObject | [optional] Object type (user, group, computer) to check for membership of $sGroup. Can be specified as sAMAccountName or Fully Qualified Domain Name (FQDN) (default = @UserName)
$bIncludePrimaryGroup | [optional] Additionally checks the primary group for object membership (default = False)
$bRecursive | [optional] Recursively check all groups of $sGroup up to the depth defined by $iDepth (default = False)
$iDepth | [optional] Maximum depth of recursion (default = 10)

Return Value

Success: 1, Specified object (user, group, computer) is a member of the specified group
Failure: 0, @error set
0 - $sObject is not a member of $sGroup
1 - $sGroup does not exist
2 - $sObject does not exist

Remarks

Determines if the object is an immediate member of the group. This function does not verify membership in any nested groups.

Related

_AD_GetUserGroups, _AD_GetUserPrimaryGroup, _AD_RecursiveGetMemberOf

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get a list of group names the current user is a member of.
; Check the group membership of the current user for the first group.
; This will always return 1.
; *****************************************************************************
#include <AD.au3>

Global $aUser, $sFQDN_Group, $sFQDN_User, $iResult

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get the Fully Qualified Domain Name (FQDN) for the current user
$sFQDN_User = _AD_SamAccountNameToFQDN()

; Get an array of group names (FQDN) that the current user is immediately a member of
$aUser = _AD_GetUserGroups(@UserName)
$sFQDN_Group = $aUser[1]

; Check the group membership of the specified user for the specified group
$iResult = _AD_IsMemberOf($sFQDN_Group, $sFQDN_User)
Select
Case $iResult = 1
MsgBox(64, "Active Directory Functions", _
"User: " & $sFQDN_User & @CRLF & _
"Group: " & $sFQDN_Group & @CRLF & _
"User is a member of the specified group!")
Case ($iResult = 0 And @error = 1)
MsgBox(64, "Active Directory Functions", _
"User: " & $sFQDN_User & @CRLF & _
"Group: " & $sFQDN_Group & @CRLF & _
"Group does not exist!")
Case ($iResult = 0 And @error = 2)
MsgBox(64, "Active Directory Functions", _
"User: " & $sFQDN_User & @CRLF & _
"Group: " & $sFQDN_Group & @CRLF & _
"User does not exist!")
Case ($iResult = 0)
MsgBox(64, "Active Directory Functions", _
"User: " & $sFQDN_User & @CRLF & _
"Group: " & $sFQDN_Group & @CRLF & _
"User is a not member of the specified group!")
EndSelect


Function _AD_RecursiveGetGroupMembers

Function Reference

_AD_RecursiveGetGroupMembers

Takes a group and recursively returns a list of groups and members of the group.

#Include <AD.au3>
_AD_RecursiveGetGroupMembers($sGroup[, $iDepth = 10[, $bListInherited = True[, $bFQDN = True]]])

Parameters

$sGroup | Group for which the members should to be returned. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$iDepth | [optional] Maximum depth of recursion (default = 10)
$bListInherited | [optional] Defines if the function returns the group it is a member of (default = True)
$bFQDN | [optional] Specifies the attribute to be returned. True = distinguishedName (FQDN), False = SamAccountName (default = True)

Return Value

Success: Returns an one-based one dimensional array of group or member names (FQDN or sAMAccountName)
Failure: "", sets @error to:
1 - Specified group does not exist

Remarks

This function traverses the groups in the specified group until the maximum depth is reached.
if $bListInherited = True the return is the FQDN or sAMAccountname of the group or member and the FQDN(s) or sAMAccountname(s) of the group it
is a member of, seperated by '|'(s) if flag $bListInherited is set to True.

If flag $bListInherited is set to False then the group/member names are sorted and only unique entries are returned.

Related

_AD_GetGroupMembers

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get a list of all groups the current user is a member of.
; Then get a recursively searched list of all group members for the first group
; Recursion level is 10, inherited group names will be returned.
; *****************************************************************************
#include <AD.au3>

Global $aGroups[1], $aMembers[1]

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get an array of group names (FQDN) that the user is immediately a member of
$aGroups = _AD_GetUserGroups()
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "The current user is not a member of any group")
Else
; Get a recursively searched list of members for the first group
$aMembers = _AD_RecursiveGetGroupMembers($aGroups[1], 10, True)
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "The group '" & $aGroups[1] & "' has no members")
Else
_ArrayDisplay($aMembers, "Active Directory Functions - Example 1 - Recursive list of members for group '" & $aGroups[1] & "'")
EndIf
EndIf


Function _AD_RecursiveGetMemberOf

Function Reference

_AD_RecursiveGetMemberOf

Takes a group, user or computer and recursively returns a list of groups the object is a member of.

#Include <AD.au3>
_AD_RecursiveGetMemberOf($sObject[, $iDepth = 10[, $bListInherited = True[, $bFQDN = True]]])

Parameters

$sObject | User, group or computer for which the group membership is to be returned. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$iDepth | [optional] Maximum depth of recursion (default = 10)
$bListInherited | [optional] Defines if the function returns the group(s) it was inherited from (default = True)
$bFQDN | [optional] Specifies the attribute to be returned. True = distinguishedName (FQDN), False = SamAccountName (default = True)

Return Value

Success: Returns an one-based one dimensional array of group names (FQDN or sAMAccountName) the user or group is a member of
Failure: "", sets @error to:
1 - Specified user, group or computer does not exist

Remarks

This function traverses the groups that the object is immediately a member of while also checking its group membership.
For groups that are inherited, the return is the FQDN or sAMAccountname of the group, user or computer, and the FQDN(s) or sAMAccountname(s) of the group(s) it
was inherited from, seperated by '|'(s) if flag $bListInherited is set to True.

If flag $bListInherited is set to False then the group names are sorted and only unique groups are returned.

Related

_AD_IsMemberOf, _AD_GetUserGroups, _AD_GetUserPrimaryGroup

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Returns a recursively searched list of groups the currently logged on user
; is a member of.
; For groups that are inherited, the FQDN of the group or user, and the FQDN(s)
; of the group(s) it was inherited from, seperated by '|'
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Returns a recursively searched list of groups the currently logged on user is a member of
Global $aUser = _AD_RecursiveGetMemberOf(@UserName, 10, 1)
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & @UserName & "' has not been assigned to any group")
Else
; For groups that are inherited, the return is the FQDN of the group or user, and the FQDN(s) of the group(s) it
; was inherited from, seperated by '|'
_ArrayDisplay($aUser, "Active Directory Functions - Example 1 - Group names user '" & @UserName & "' is a member of")
EndIf


Function _AD_RemoveComputerFromGroup

Function Reference

_AD_RemoveComputerFromGroup

Alias for _AD_RemoveUserFromGroup: Removes a computer from the specified group or computer.

#Include <AD.au3>
_AD_RemoveComputerFromGroup($sTarget, $sObject)

Parameters

None.

Return Value

None.

Remarks

Please see: _AD_RemoveUserFromGroup

Related

Please see: _AD_RemoveUserFromGroup


Function _AD_RemoveGroupFromGroup

Function Reference

_AD_RemoveGroupFromGroup

Alias for _AD_RemoveUserFromGroup: Removes a group from the specified group or computer.

#Include <AD.au3>
_AD_RemoveGroupFromGroup($sTarget, $sObject)

Parameters

None.

Return Value

None.

Remarks

Please see: _AD_RemoveUserFromGroup

Related

Please see: _AD_RemoveUserFromGroup


Function _AD_RemoveUserFromGroup

Function Reference

_AD_RemoveUserFromGroup

Removes a user, group or computer from the specified group or computer.

#Include <AD.au3>
_AD_RemoveUserFromGroup($sTarget, $sObject)

Parameters

$sTarget | Group or computer (FQDN or sAMAccountName) where $sObject should be deleted from
$sObject | Username, group or computer to be deleted from $sTarget (FQDN or sAMAccountName)

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sTarget does not exist
2 - $sObject does not exist
3 - $sObject is not a member of $sTarget
x - Error returned by Remove or SetInfo method (Missing permission etc.)

Remarks

The sAMAccountname of a computer needs a trailing "$" before converting it to a FQDN.

Related

_AD_CreateOU, _AD_CreateUser, _AD_CreateGroup, _AD_AddComputerToGroup, _AD_AddGroupToGroup, _AD_AddUserToGroup, _AD_RemoveComputerFromGroup, _AD_RemoveGroupFromGroup

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Removes a user from a specified group.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script removes a user from a group." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter user account and group
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 514, 124)
GUICtrlCreateLabel("User account (sAMAccountName or FQDN):", 8, 10, 231, 17)
GUICtrlCreateLabel("Group name (sAMAccountName or FQDN):", 8, 42, 231, 17)
Global $IUser = GUICtrlCreateInput(@UserName, 241, 8, 259, 21)
Global $IGroup = GUICtrlCreateInput("", 241, 40, 259, 21)
Global $BOK = GUICtrlCreateButton("Remove user from group", 8, 72, 130, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 428, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sUser = _AD_SamAccountNameToFQDN(GUICtrlRead($IUser))
Global $sGroup = _AD_SamAccountNameToFQDN(GUICtrlRead($IGroup))
ExitLoop
EndSwitch
WEnd

; Remove user from group
Global $iValue = _AD_RemoveUserFromGroup($sGroup, $sUser)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' successfully removed from group '" & $sGroup & "'")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Group '" & $sGroup & "' does not exist")
ElseIf @error = 2 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' does not exist")
ElseIf @error = 3 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' is not a member of group '" & $sGroup & "'")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_SetGroupManagerCanModify

Function Reference

_AD_SetGroupManagerCanModify

Sets the Group manager to be able to modify the member list.

#Include <AD.au3>
_AD_SetGroupManagerCanModify($sGroup)

Parameters

$sGroup Groupname (sAMAccountName or FQDN)

Return Value

Success: 1
Failure: 0, @error set
1 - $sGroup does not exist
2 - Group manager can already modify the member list
3 - $sGroup has no manager assigned
x - Error returned by SetInfo method (Missing permission etc.)

Remarks

None.

Related

_AD_GroupAssignManager, _AD_GroupManagerCanModify, _AD_GroupRemoveManager

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Sets the Group manager to be able to modify the member list.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script sets the Group manager to be able to modify the member list." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter group name
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 124)
GUICtrlCreateLabel("Group (samAccountName or FQDN):", 8, 10, 231, 17)
Global $IGroup = GUICtrlCreateInput("", 241, 8, 459, 21)
Global $BOK = GUICtrlCreateButton("Set Group Manager", 8, 82, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 82, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sGroup = GUICtrlRead($IGroup)
ExitLoop
EndSwitch
WEnd

; Modify group manager
Global $iValue = _AD_SetGroupManagerCanModify($sGroup)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Successfuly modified the group manager for '" & $sGroup & "'")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Group '" & $sGroup & "' does not exist")
ElseIf @error = 2 Then
MsgBox(64, "Active Directory Functions - Example 1", "Group manager can already modify the member list for group '" & $sGroup & "'")
ElseIf @error = 3 Then
MsgBox(64, "Active Directory Functions - Example 1", "Group '" & $sGroup & "' does not have an assigned manager to modify")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_SetUserPrimaryGroup

Function Reference

_AD_SetUserPrimaryGroup

Sets the users primary group.

#Include <AD.au3>
_AD_SetUserPrimaryGroup($sUser, $sGroup)

Parameters

$sUser | User for which the primary group is to be set. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$sGroup | Group to be set as the primary group for the specified user. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sUser does not exist
2 - $sGroup does not exist
3 - $sUser must be a member of $sGroup
x - Error returned by SetInfo method (Missing permission etc.)

Remarks

None.

Related

_AD_AddUserToGroup, _AD_GetUserPrimaryGroup

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Sets the users primary group.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script sets the users primary group." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter user and primary group
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 414, 124, 251, 112)
GUICtrlCreateLabel("User account (sAMAccountName or FQDN):", 8, 10, 231, 17)
GUICtrlCreateLabel("Primary group (sAMAccountName or FQDN):", 8, 42, 231, 17)
Global $IUser = GUICtrlCreateInput("", 241, 8, 159, 21)
Global $IGroup = GUICtrlCreateInput("", 241, 40, 159, 21)
Global $BOK = GUICtrlCreateButton("Set Primary Group", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 328, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sUser = GUICtrlRead($IUser)
$sUser = _AD_SamAccountNameToFQDN($sUser)
Global $sGroup = GUICtrlRead($IGroup)
ExitLoop
EndSwitch
WEnd

; Set the primary group
Global $iValue = _AD_SetUserPrimaryGroup($sUser, $sGroup)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Primary group for user '" & $sUser & "' successfully changed to '" & $sGroup & "'")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' does not exist")
ElseIf @error = 2 Then
MsgBox(64, "Active Directory Functions - Example 1", "Group '" & $sGroup & "' does not exist")
ElseIf @error = 3 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' is no member of group '" & $sGroup & "'")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_CreateComputer

Function Reference

_AD_CreateComputer

Creates and enables a computer account. A specific, authenticated user/group can then use this account to add his or her workstation to the domain.

#Include <AD.au3>
_AD_CreateComputer($sOU, $sComputer, $sUser)

Parameters

$sOU | OU to create the computer in. Form is "OU=sampleou,OU=sampleparent,DC=sampledomain1,DC=sampledomain2" (FQDN)
$sComputer | Computername, form is SamAccountName without trailing "$"
$sUser | User or group that will be allowed to add the computer to the domain (SamAccountName)

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sOU does not exist
2 - $sComputer already defined in $sOU
3 - $sUser does not exist
x - Error returned by Create or SetInfo method (Missing permission etc.)

Remarks

By default, any authenticated user can create up to 10 computer accounts in the domain (machine account quota).
(see: http://technet.microsoft.com/en-us/library/cc780195(WS.10).aspx)
To create the Access Control List you need certain permissions. If this permissions are missing you might be able to add the
computer to the domain but the function will exit with failure and the ACL is not set.

Creating a computer object in AD does not permit a user to join a computer to the domain.
Certain permissions have to be granted so that the user has rights to modify the computer object.
When you create a computer account using the ADUC snap-in you have the option to select a
user or group to manage the computer object and join a computer to the domain using that object.

When you use that method, the following access control entries (ACEs) are added to the
access control list (ACL) of the computer object:
* List Contents, Read All Properties, Delete, Delete Subtree, Read Permissions, All
Extended Rights (i.e., Allowed to Authenticate, Change Password, Send As, Receive As, Reset Password)
* Write Property for description
* Write Property for sAMAccountName
* Write Property for displayName
* Write Property for Logon Information
* Write Property for Account Restrictions
* Validate write to DNS host name
* Validated write for service principal name

Related

_AD_CreateOU, _AD_JoinDomain

See Also

http://www.wisesoft.co.uk/scripts/vbscript_create_a_computer_account_for_a_specific_user.aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Creates and activates a computer in a particular OU.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $sFQDN = _AD_SamAccountNameToFQDN()
Global $sParentOU = StringMid($sFQDN, StringInStr($sFQDN, ",OU=") + 1)
Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script creates a new computer account in the specified OU." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter parent OU and computer to create
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 156)
GUICtrlCreateLabel("OU to create the computer in (FQDN):", 8, 10, 231, 17)
GUICtrlCreateLabel("Computer account to create (samAccountName):", 8, 42, 231, 17)
GUICtrlCreateLabel("User/group to use this computer (samAccountName or FQDN):", 8, 74, 231, 34)
Global $IOU = GUICtrlCreateInput($sParentOU, 241, 8, 459, 21)
Global $IComputer = GUICtrlCreateInput("", 241, 40, 459, 21)
Global $IUser = GUICtrlCreateInput("", 241, 72, 459, 21)
Global $BOK = GUICtrlCreateButton("Create Computer", 8, 114, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 114, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sOU = GUICtrlRead($IOU)
Global $sComputer = GUICtrlRead($IComputer)
Global $sUser = GUICtrlRead($IUser)
ExitLoop
EndSwitch
WEnd

; Create a new computer account
Global $iValue = _AD_CreateComputer($sOU, $sComputer, $sUser)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Computer '" & $sComputer & "' in OU '" & $sOU & "' successfully created")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "OU '" & $sOU & "' does not exist")
ElseIf @error = 2 Then
MsgBox(64, "Active Directory Functions - Example 1", "Computer '" & $sComputer & "' already exists")
ElseIf @error = 3 Then
MsgBox(64, "Active Directory Functions - Example 1", "User/group '" & $sOU & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_CreateOU

Function Reference

_AD_CreateOU

Creates a child OU in the specified parent OU.

#Include <AD.au3>
_AD_CreateOU($sParentOU, $sOU)

Parameters

$sParentOU | Parent OU where the new OU will be created (FQDN)
$sOU | OU to create in the the parent OU (Name without leading "OU=")

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sParentOU does not exist
2 - $sOU in $sParentOU already exists
3 - $sOU is missing
x - Error returned by Create or SetInfo method (Missing permission etc.)

Remarks

This does not create any attributes for the OU. Use function _AD_ModifyAttribute.

Related

_AD_CreateUser, _AD_CreateGroup, _AD_AddUserToGroup, _AD_RemoveUserFromGroup

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Creates a new OU in the specified parent OU.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $sFQDN = _AD_SamAccountNameToFQDN()
Global $sParentOU = StringMid($sFQDN, StringInStr($sFQDN, ",OU=") + 1)
Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script creates a new OU (Organizational Unit) in the specified parent OU." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter parent OU and OU to create
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 124)
GUICtrlCreateLabel("Enter the parent OU (FQDN):", 8, 10, 231, 17)
GUICtrlCreateLabel("Enter the OU to create (without leading OU=):", 8, 42, 231, 17)
Global $IParentOU = GUICtrlCreateInput($sParentOU, 241, 8, 459, 21)
Global $IOU = GUICtrlCreateInput("Test-OU", 241, 40, 459, 21)
Global $BOK = GUICtrlCreateButton("Create OU", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
$sParentOU = GUICtrlRead($IParentOU)
Global $sOU = GUICtrlRead($IOU)
ExitLoop
EndSwitch
WEnd

; Create a new OU
Global $iValue = _AD_CreateOU($sParentOU, $sOU)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "OU '" & $sOU & "' in Parent OU '" & $sParentOU & "' successfully created")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Parent OU '" & $sParentOU & "' does not exist")
ElseIf @error = 2 Then
MsgBox(64, "Active Directory Functions - Example 1", "OU '" & $sOU & "' in Parent OU '" & $sParentOU & "' already exists")
ElseIf @error = 3 Then
MsgBox(64, "Active Directory Functions - Example 1", "Value for OU is missing")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_DeleteObject

Function Reference

_AD_DeleteObject

Deletes the specified object.

#Include <AD.au3>
_AD_DeleteObject($sObject, $sClass)

Parameters

$sObject | Object (user, group, computer, OU etc.) to delete (FQDN or sAMAccountName)
$sClass | The schema class object to delete ("user", "computer", "group", "contact" etc). Can be derived using _AD_GetObjectClass().

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sObject does not exist
x - Error returned by Delete function (Missing permission etc.)

Remarks

The function can only delete leaf objects. If you want to delete an object containing other objects you first have to delete the contained objects.

Related

_AD_RenameObject, _AD_MoveObject, _AD_DeleteSubTree

See Also

http://msdn.microsoft.com/en-us/library/aa705988(v=VS.85).aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Deletes an AD object.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script deletes an AD object." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter object to delete
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 814, 124)
GUICtrlCreateLabel("Object to delete (FQDN or sAMAcccountName):", 8, 10, 231, 17)
Global $IObject = GUICtrlCreateInput("", 241, 8, 559, 21)
Global $BOK = GUICtrlCreateButton("Delete object", 8, 72, 130, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 728, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sObject = GUICtrlRead($IObject)
ExitLoop
EndSwitch
WEnd

; Check if object exists
If Not _AD_ObjectExists() Then Exit MsgBox(16, "Active Directory Functions - Example 1", "Object '" & $sObject & "' does not exist")
; Delete object
Global $iValue = _AD_DeleteObject($sObject, _AD_GetObjectClass($sObject))
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Object '" & $sObject & "' successfully deleted")
ElseIf @error = 1 Then
MsgBox(16, "Active Directory Functions - Example 1", "Object '" & $sObject & "' does not exist")
Else
MsgBox(16, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_DeleteSubtree

Function Reference

_AD_DeleteSubtree

Deletes the specified object including all child objects of this object.

#Include <AD.au3>
_AD_DeleteSubtree($sObject[, $iFlag = 0])

Parameters

$sObject | Object (user, group, computer, OU etc.) to delete (FQDN or sAMAccountName)
$iFlag | [optional] Specifies how to process child objects. Can be: 0 - Deletes $sObject, all child containers and all leaf objects (default) 1 - Only deletes leaf objects. $sObject and all child containers remain active. Means: The subtree will be cleared. 2 - Deletes child leaf and container objects. Means: The subtree will be deleted, only $sObject remains.

Return Value

Success: 1
Failure: The distinguishedName of the object raising the error, sets @error to:
1 - $sObject does not exist
2 - Error returned by DeleteObject method for an object (Missing permission etc.). @extended holds the COM error code.
3 - Error returned by DeleteObject method for an OU (Missing permission etc.). @extended holds the COM error code.

Remarks

Leaf: An object without child objects
Container: An object that can hold child objects (leafs or containers)

Related

_AD_RenameObject, _AD_MoveObject, _AD_DeleteObject

Example

#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $sObject = InputBox("Active Directory Example Skript - _AD_DeleteSubtree", "Please specify the object (OU) to be deleted:", default, "", 400, 130)
If @error Then Exit

; Delete Subtree
Global $sReturn = _AD_DeleteSubtree($sObject)
If @error Then
Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_DeleteSubtree encountered a problem. @error = " & @error & ", @extended = " & @extended & ", return value = " & $sReturn)
Else
MsgBox(16, "Active Directory Example Skript", "Function _AD_DeleteSubtree deleted " & $sObject & " and all contained OUs and all leaf objects")
EndIf
; Close Connection to the Active Directory
_AD_Close()

Exit


Function _AD_DisableObject

Function Reference

_AD_DisableObject

Disables an AD object (user account, computer account).

#Include <AD.au3>
_AD_DisableObject($sObject)

Parameters

$sObject User account or computer account to disable (sAMAccountName or FQDN)

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetInfo method (Missing permission etc.)

Remarks

None.

Related

_AD_IsObjectDisabled, _AD_EnableObject, _AD_GetObjectsDisabled

See Also

http://www.wisesoft.co.uk/scripts/vbscript_enable-disable_user_account_1.aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Disables an AD object (user account, computer account).
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script disables the specified object (user account, computer account)." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter object to disable
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 124)
GUICtrlCreateLabel("Object to disable (FQDN or sAMACccountName):", 8, 10, 231, 34)
Global $IObject = GUICtrlCreateInput("", 241, 10, 459, 21)
Global $BOK = GUICtrlCreateButton("Disable object", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sObject = GUICtrlRead($IObject)
ExitLoop
EndSwitch
WEnd

; Change Object
Global $iValue = _AD_DisableObject($sObject)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Object '" & $sObject & "' successfully changed")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Object '" & $sObject & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_EnableObject

Function Reference

_AD_EnableObject

Enables an AD object (user account, computer account).

#Include <AD.au3>
_AD_EnableObject($sObject)

Parameters

$sObject User account or computer account to enable (sAMAccountName or FQDN)

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetInfo method (Missing permission etc.)

Remarks

None.

Related

_AD_IsObjectDisabled, _AD_DisableObject, _AD_GetObjectsDisabled

See Also

http://www.wisesoft.co.uk/scripts/vbscript_enable-disable_user_account_1.aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Enables an AD object (user account, computer account).
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script enables the specified object (user account, computer account)." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter object to enable
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 124)
GUICtrlCreateLabel("Object to enable (FQDN or sAMAccountName):", 8, 10, 231, 17)
Global $IObject = GUICtrlCreateInput("", 241, 10, 459, 21)
Global $BOK = GUICtrlCreateButton("Enable object", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sObject = GUICtrlRead($IObject)
ExitLoop
EndSwitch
WEnd

; Change Object
Global $iValue = _AD_EnableObject($sObject)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Object '" & $sObject & "' successfully changed")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Object '" & $sObject & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_GetAllOUs

Function Reference

_AD_GetAllOUs

Retrieves an array of OUs. The paths are separated by the '\' character.

#Include <AD.au3>
_AD_GetAllOUs([$sRoot = ""[, $sSeparator = "\"[, $iSelect = 0[, $iSearchScope = 2]]]])

Parameters

$sRoot | [optional] OU (FQDN) where to start in the AD tree (default = "", equals "start at the AD root")
$sSeparator | [optional] Single character to separate the OU names (default = "\")
$iSelect | [optional] Which objects should be returned in the result (default = 0) 0 - Return OUs (Organizational Units) (default) 1 - Return CNs (Containers) 2 - Return OUs + CNs
$iSearchScope | [optional] 0 = base, 1 = one-level, 2 = sub-tree (default)

Return Value

Success: One-based two dimensional array of OUs starting with the given OU. The paths are separated by "\"
0 - ... \name of grandfather OU\name of father OU\name of son OU
1 - Distinguished Name (FQDN) of the son OU
Failure: "", sets @error to:
1 - No OUs found
2 - Specified $sRoot does not exist
3 - $iSelect is not an integer or < 0 or > 2

Remarks

If an OU contains spaces the sorting is wrong and might lead to problems in further processing.
Please have a look at http://www.autoitscript.com/forum/topic/106163-active-directory-udf/page__view__findpost__p__943892

Related

_AD_GetObjectsInOU

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1
; Get a list of all OUs in the Active Directory
; *****************************************************************************
Global $aOUs = _AD_GetAllOUs()
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "No OUs could be found " & @error)
Else
_ArrayDisplay($aOUs, "Active Directory Functions - Example 1 - All OUs found in the Active Directory")
EndIf


Function _AD_GetManagedBy

Function Reference

_AD_GetManagedBy

Retrieves all groups that are managed by any or the specified user.

#Include <AD.au3>
_AD_GetManagedBy([$sManagedBy = "*"])

Parameters

$sManagedBy [optional] Manager to filter the list of groups (default = *). Can be a SAMAccountname or a FQDN

Return Value

Success: Returns a one-based two dimensional array with the following information:
0 - distinguished name of the group
1 - distinguished name of the manager for this group
Failure: "", sets @error to:
1 - $sManagedBy is unknown
2 - No groups found. @extended is set to the error returned by LDAP

Remarks

This query returns all groups that have the attribute "managedBy" set or set to the specified manager.

To get a list of all groups that manager x manages (by querying just the user object) use:
$Result = _AD_GetObjectAttribute("samAccountName of the manager","managedObjects")
_ArrayDisplay($Result)

To return managers for OUs change "objectCategory=group" to "objectClass=organizationalUnit".

Related

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $aManagedBy[1][2]
Global $bNotFound = False
; *****************************************************************************
; Example 1
; Get a list of groups that have the attribute "managedBy" set
; *****************************************************************************
$aManagedBy = _AD_GetManagedBy()
If @error > 0 Or $aManagedBy[0][0] = 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "No managed groups could be found")
$bNotFound = True
Else
_ArrayDisplay($aManagedBy, "Active Directory Functions - Example 1 - groups managed by")
EndIf

; *****************************************************************************
; Example 2
; Get a list of groups that are managed by the first manager found in example 1
; *****************************************************************************
If $bNotFound Then
MsgBox(64, "Active Directory Functions - Example 2", "Can't run example 2 because example 1 returned no data")
Exit
EndIf
Global $Result = _AD_GetObjectAttribute(_AD_FQDNToSamAccountName($aManagedBy[1][1]), "managedObjects")
_ArrayDisplay($Result, "Active Directory Functions - Example 2 - groups managed by '" & $aManagedBy[1][1] & "'")


Function _AD_GetManager

Function Reference

_AD_GetManager

Retrieves all users that are managed by any or the specified user.

#Include <AD.au3>
_AD_GetManager([$sManager = "*"])

Parameters

$sManager [optional] Manager to filter the list of users (default = *). Can be sAMAccountName or FQDN

Return Value

Success: Returns a one-based two dimensional array with the following information:
0 - distinguished name of the user
1 - distinguished name of the manager for this user
Failure: "", sets @error to:
1 - $sManager is unknown
2 - No users found. @extended is set to the error returned by LDAP

Remarks

This query returns all users that have the attribute "Manager" set or set to the specified manager.

To get a list of all users that manager x manages (by querying just the user object) use:
$Result = _AD_GetObjectAttribute("samAccountName of the manager","directReports")
_ArrayDisplay($Result)

Related

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $aManager[1][2]
Global $bNotFound = False
; *****************************************************************************
; Example 1
; Get a list of users that have the attribute "manager" set
; *****************************************************************************
$aManager = _AD_GetManager()
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "No managed users could be found")
$bNotFound = True
Else
_ArrayDisplay($aManager, "Active Directory Functions - Example 1 - managed users")
EndIf

; *****************************************************************************
; Example 2
; Get a list of users that are managed by the first manager found in example 1
; *****************************************************************************
If $bNotFound Then
MsgBox(64, "Active Directory Functions - Example 2", "Can't run example 2 because example 1 returned no data")
Exit
EndIf
Global $Result = _AD_GetObjectAttribute(_AD_FQDNToSamAccountName($aManager[1][1]), "directReports")
_ArrayDisplay($Result, "Active Directory Functions - Example 2 - users managed by '" & $aManager[1][1] & "'")


Function _AD_GetObjectAttribute

Function Reference

_AD_GetObjectAttribute

Returns the specified attribute for the named object.

#Include <AD.au3>
_AD_GetObjectAttribute($sObject, $sAttribute)

Parameters

$sObject | sAMAccountName or FQDN of the object the attribute should be retrieved from
$sAttribute | Attribute to be retrieved

Return Value

Success: Value for the given attribute
Failure: "", sets @error to:
1 - $sObject does not exist
2 - $sAttribute does not exist for $sObject. @Extended is set to the error returned by LDAP

Remarks

If the attribute is a single-value the function returns a string otherwise it returns an array.
To get decrypted attributes (GUID, SID, dates etc.) please see _AD_GetObjectProperties.

Related

_AD_ModifyAttribute, _AD_GetObjectProperties

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1
; Test for a multi-value attribute
; *****************************************************************************
Global $aResult = _AD_GetObjectAttribute(@UserName, "proxyAddresses")
If @error Then
MsgBox(64, "Active Directory Functions - Example 1", "Attribute 'proxyAddresses' for user '" & @UserName & "' could not be found")
Else
_ArrayDisplay($aResult, "Active Directory Functions - Example 1 - User '" & @UserName & "', Attribute 'proxyAddresses'")
EndIf

; *****************************************************************************
; Example 2
; Test for a single-value attribute
; *****************************************************************************
$aResult = _AD_GetObjectAttribute(@UserName, "mail")
If @error Then
MsgBox(64, "Active Directory Functions - Example 2", "Attribute 'mail' for user '" & @UserName & "' could not be found")
Else
MsgBox(64, "Active Directory Functions - Example 2", _
"String returned for User '" & @UserName & "', Attribute 'mail': " & $aResult)
EndIf


Function _AD_GetObjectClass

Function Reference

_AD_GetObjectClass

Returns the main class (also called structural class) of an object ("user", "group" etc.).

#Include <AD.au3>
_AD_GetObjectClass($sObject[, $bAll = False])

Parameters

$sObject | Object for which the main class should be returned. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$bAll | [optional] Returns the main class plus the superior classes from which the main class is deduced hierarchically (default = False)

Return Value

Success: Main class of the specified object if $bAll = False or an zero-based array of the main plus the superior classes if $bAll = True
Failure: "", sets @error to:
1 - Specified object does not exist
2 - The LDAP query returned no record. @extended is set to the error returned by LDAP

Remarks

None.

Related

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Displays the class for the logged on user and local computer.
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Return class for the logged on user and local computer
MsgBox(64, "Active Directory Functions - Example 1", _
"Class for logged on user: " & _AD_GetObjectClass(@UserName) & @CRLF & _
"Class for local computer: " & _AD_GetObjectClass(@ComputerName & "$"))


Function _AD_GetObjectOU

Function Reference

_AD_GetObjectOU

Returns the OU (Organizational Unit) of an object ("user", "group" etc.).

#Include <AD.au3>
_AD_GetObjectOU($sObject[, $sReturn = "distinguishedName"])

Parameters

$sObject | Object for which the main class should be returned. Can be specified as Fully Qualified Domain Name (FQDN), sAMAccountName or ADsPath
$sReturn | [optional] Property to return. Must be "distinguishedName" or "Name" (default = "distinguishedName")

Return Value

Success: FQDN of the object's OU.
Failure: "", sets @error to:
1 - Specified object does not exist
2 - The LDAP query returned no record. @extended is set to the error returned by LDAP
3 - Parameter $sReturn is wrong. Must be "distinguishedName" or "Name"

Remarks

None.

Related

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Displays FQDN and OU of the current user and local computer.
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Return class for the logged on user and local computer
MsgBox(64, "Active Directory Functions - Example 1", _
"Logged on user: " & @CRLF & " FQDN: " & _AD_GetObjectAttribute(@UserName, "distinguishedname") & @CRLF & " OU: " & _AD_GetObjectOU(@UserName) & @CRLF & _
"Local computer: " & @CRLF & " FQDN: " & _AD_GetObjectAttribute(@ComputerName & "$", "distinguishedname") & @CRLF & " OU: " & _AD_GetObjectOU(@ComputerName & "$"))


Function _AD_GetObjectProperties

Function Reference

_AD_GetObjectProperties

Returns a two-dimensional array of all or selected properties and their values of an object in readable form.

#Include <AD.au3>
_AD_GetObjectProperties([$vObject = @UserName[, $sProperties = ""[, $bSort = True]]])

Parameters

$vObject | [optional] SamAccountName, FQDN or ADSPath of the object to retrieve properties from (e.g. computer, user, group ...) (default = @Username) Can be of type object as well. Useful to get properties for a schema or configuration object (see _AD_ListRootDSEAttributes)
$sProperties | [optional] Comma separated list of properties to return (default = "" = return all properties)
$bSort | [optional] True specifies that the array will be sorted on property name (default = True)

Return Value

Success: Returns a one based two-dimensional array with all properties and their values of an object in readable form
Failure: "" or property name, sets @error to:
1 - $vObject could not be found
2 - No values for the specified property. The name of the property in error is returned as the function result
3 - Error retrieving $vObject. @Extended is set to the error returned by LDAP

Remarks

Dates are returned in format: YYYY/MM/DD HH:MM:SS local time of the calling user (AD stores all dates in UTC - Universal Time Coordinated)
Exception: AD internal dates like "whenCreated", "whenChanged" and "dSCorePropagationData". They are returned as UTC
NT Security Descriptors are returned as: Control:nn, Group:Domain\Group, Owner:Domain\Group, Revision:nn
No error is returned if there are properties in $sProperties that are not available for the selected object

Properties are returned in alphabetical order. If $sProperties is set to "samaccountname,displayname" the returned array will contain
displayname as the first and samaccountname as the second row.

Related

See Also

http://www.autoitscript.com/forum/index.php?showtopic=49627&view=findpost&p=422402, http://msdn.microsoft.com/en-us/library/ms675090(VS.85).aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $aProperties[1][2]

; *****************************************************************************
; Example 1
; Displays properties for the current user
; *****************************************************************************
$aProperties = _AD_GetObjectProperties(@UserName)
_ArrayDisplay($aProperties, "Active Directory Functions - Example 1 - Properties for user '" & @UserName & "'")

; *****************************************************************************
; Example 2
; Display only selected properties for the current user
; *****************************************************************************
$aProperties = _AD_GetObjectProperties(@UserName, "displayname,distinguishedName")
_ArrayDisplay($aProperties, "Active Directory Functions - Example 2 - Properties for user '" & @UserName & "'")

; *****************************************************************************
; Example 3
; Displays properties for the current computer
; *****************************************************************************
$aProperties = _AD_GetObjectProperties(@ComputerName & "$")
_ArrayDisplay($aProperties, "Active Directory Functions - Example 3 - Properties for computer '" & @ComputerName & "'")

; *****************************************************************************
; Example 4
; Get an array of group names the user is immediately a member of.
; Then display the properties of the first group.
; *****************************************************************************
Global $aUser
$aUser = _AD_GetUserGroups(@UserName)
If $aUser[0] = 0 Then
MsgBox(64, "Active Directory Functions - Example 4", "User '" & @UserName & "' is not a member of any group")
Else
Global $sGroup = _AD_FQDNToSamAccountName($aUser[1])
$aProperties = _AD_GetObjectProperties($sGroup)
_ArrayDisplay($aProperties, "Active Directory Functions - Example 4 - Properties for group '" & $sGroup & "'")
EndIf

; *****************************************************************************
; Example 5
; Display the properties of the OU the group of example 4 is assigned to.
; *****************************************************************************
Global $sOU = StringTrimLeft($aUser[1], StringInStr($aUser[1], ","))
$aProperties = _AD_GetObjectProperties($sOU)
_ArrayDisplay($aProperties, "Active Directory Functions - Example 5 - Properties for OU '" & $sOU & "'")


Function _AD_GetObjectsDisabled

Function Reference

_AD_GetObjectsDisabled

Returns an array with FQDNs of disabled objects (user accounts, computer accounts).

#Include <AD.au3>
_AD_GetObjectsDisabled([$sClass = "user"[, $sRoot = ""]])

Parameters

$sClass | [optional] Specifies if disabled user accounts or computer accounts should be returned (default = "user"). "user" - Returns objects of category "user" "computer" - Returns objects of category "computer"
$sRoot | [optional] FQDN of the OU where the search should start (default = "" = search the whole tree)

Return Value

Success: array of user or computer account FQDNs
Failure: "", sets @error to:
1 - $sClass is invalid. Values can be "computer" or "user"
2 - Specified $sRoot does not exist

Remarks

None.

Related

_AD_IsObjectDisabled, _AD_DisableObject, _AD_EnableObject

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $aDisabled[1]
; *****************************************************************************
; Example 1
; Get a list of disabled accounts
; *****************************************************************************
$aDisabled = _AD_GetObjectsDisabled()
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "No disabled user accounts could be found")
Else
_ArrayDisplay($aDisabled, "Active Directory Functions - Example 1 - Disabled User Accounts")
EndIf

; *****************************************************************************
; Example 2
; Get a list of disabled computers
; *****************************************************************************
$aDisabled = _AD_GetObjectsDisabled("computer")
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 2", "No disabled computers could be found")
Else
_ArrayDisplay($aDisabled, "Active Directory Functions - Example 2 - Disabled Computers")
EndIf


Function _AD_GetObjectsInOU

Function Reference

_AD_GetObjectsInOU

Returns a filtered array of objects and attributes for a given OU or just the number of records if $bCount is True.

#Include <AD.au3>
_AD_GetObjectsInOU($sOU[, $sFilter = "(name=*)"[, $iSearchScope = 2[, $sDataToRetrieve = "sAMAccountName"[, $sSortBy = "sAMAccountName"[, $bCount = False[, $vReturnNull = True]]]]])

Parameters

$sOU | The OU to retrieve from (FQDN) (default = "", equals "search the whole AD tree")
$sFilter | [optional] An additional LDAP filter if required (default = "(name=*)")
$iSearchScope | [optional] 0 = base, 1 = one-level, 2 = sub-tree (default)
$sDataToRetrieve | [optional] A comma-seperated list of attributes to retrieve (default = "sAMAccountName"). More than one attribute will create a 2-dimensional array
$sSortBy | [optional] name of the attribute the resulting array will be sorted upon (default = "sAMAccountName"). To completely suppress sorting (even the default sort) set this parameter to "". This improves performance when doing large queries
$bCount | [optional] If set to True only returns the number of records returned by the query (default = False)
$vReturnNull | [optional] If set to any other value but True Null values (occur when the property has never been set) are returned as this value (default = True)

Return Value

Success: Number of records retrieved or a one or two dimensional one-based array of objects and attributes in the given OU. First entry is for the given OU itself
Failure: "", sets @error to:
1 - Specified OU does not exist
2 - No records returned from Active Directory. $sDataToRetrieve is invalid (attribute may not exist). @extended is set to the error returned by LDAP
3 - No records returned from Active Directory. $sFilter didn't return a record

Remarks

Multi-value attributes are returned as string with the pipe character (|) as separator.

The default filter returns an array including one record for the OU itself. To exclude the OU use a different filter that doesn't include the OU
e.g. "(&(objectcategory=person)(objectclass=user)(name=*))"

To make sure that all properties you specify in $sDataToRetrieve exist in the AD you can use _AD_ObjectExistsInSchema.

The following examples illustrate the use of the escaping mechanism in the LDAP filter:
(o=Parens R Us \28for all your parenthetical needs\29)
(cn=*\2A*)
(filename=C:\5cMyFile)
(bin=\00\00\00\04)
(sn=Lu\c4\8di\c4\87)
The first example shows the use of the escaping mechanism to represent parenthesis characters.
The second shows how to represent a "*" in a value, preventing it from being interpreted as a substring indicator.
The third illustrates the escaping of the backslash character.
The fourth example shows a filter searching for the four-byte value 0x00000004, illustrating the use of the escaping mechanism to
represent arbitrary data, including NUL characters.
The final example illustrates the use of the escaping mechanism to represent various non-ASCII UTF-8 characters.

Related

_AD_GetAllOUs

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get FQDN for the currently logged on user
Global $sFQDN = _AD_SamAccountNameToFQDN()

; Strip off the CN
Global $iPos = StringInStr($sFQDN, ",")
Global $sOU = StringMid($sFQDN, $iPos + 1)

Global $aObjects[1][1]

; *****************************************************************************
; Example 1
; Get the OU the current user is assigned to.
; Then get an unfiltered list of all objects in this OU.
; *****************************************************************************
$aObjects = _AD_GetObjectsInOU($sOU, "(name=*)", 2, "sAMAccountName,distinguishedName,displayname")
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "No OUs could be found")
Else
_ArrayDisplay($aObjects, "Active Directory Functions - Example 1 - Objects in OU '" & $sOU & "'")
Global $iResult = _AD_GetObjectsInOU($sOU, "(name=*)", 2, "sAMAccountName,distinguishedName,displayname", "", True)
MsgBox(64, "Active Directory Functions - Example 1", "This example returned " & $iResult & " records")
EndIf

; *****************************************************************************
; Example 2
; Get the OU the current user is assigned to.
; Then get a filtered list of all users in this OU that start with the first
; letter of the current user. Sort the result by displayname.
; *****************************************************************************
Global $sUser = StringLeft(@UserName, 1)
$aObjects = _AD_GetObjectsInOU($sOU, "(&(objectcategory=person)(objectclass=user)(cn=" & $sUser & "*))", 2, "sAMAccountName,distinguishedName,displayname", "displayname")
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 2", "No OUs could be found")
Else
_ArrayDisplay($aObjects, "Active Directory Functions - Example 2 - Objects in OU '" & $sOU & "'")
EndIf

; *****************************************************************************
; Example 3
; Use ANR (Ambigous Name Resolution) to get all objects with the same given Name
; as the current user in the ANR-supported attribute fields.
; Searches the whole domain.
; *****************************************************************************
Global $sGivenName = _AD_GetObjectAttribute(@UserName, "GivenName")
$aObjects = _AD_GetObjectsInOU("", "(ANR=" & $sGivenName & ")", 2, "sAMAccountName,distinguishedName,displayname", "displayname")
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 3", "No objects found")
Else
_ArrayDisplay($aObjects, "Active Directory Functions - Example 3 - Ambigous Name Resolution. Search for '" & $sGivenName & "'")
EndIf

If MsgBox(36, "Active Directory Functions", "Would you like to see further examples using extended LDAP queries?") <> 7 Then
$sOU = ""
; ********************************
; User accounts that do not expire
; ********************************
_Examples("(&(objectCategory=person)(objectClass=user)(|(accountExpires=9223372036854775807)(accountExpires=0)))", "sAMAccountName,distinguishedName,displayname", "User accounts that do not expire")
; ****************************
; User accounts that do expire
; ****************************
_Examples("(&(objectCategory=person)(objectClass=user)(!accountExpires=9223372036854775807)(!accountExpires=0))", "sAMAccountName,distinguishedName,displayname,accountexpires", "User accounts that do expire")
; ***************************************
; User accounts that already have expired
; ***************************************
Global $sAD_DTExpire = _Date_Time_GetSystemTime() ; Get current date/time
$sAD_DTExpire = _Date_Time_SystemTimeToDateTimeStr($sAD_DTExpire, 1) ; convert to system time
Global $iAD_DTExpire = Int(_DateDiff("s", "1601/01/01 00:00:00", $sAD_DTExpire) * 10000000) ; convert to Integer8
_Examples("(&(objectCategory=person)(objectClass=user)(!accountExpires=9223372036854775807)(!accountExpires=0)(accountExpires<=" & $iAD_DTExpire & ")", "sAMAccountName,distinguishedName,displayname", "Expired user accounts")
; *************************************
; Users not required to have a password
; *************************************
_Examples("(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))", "sAMAccountName,distinguishedName,displayname", "Users not required to have a password")
; **********************************************************************************
; Users with any group other than "Domain Users" designated as their "primary" group
; **********************************************************************************
_Examples("(&(objectCategory=person)(objectClass=user)(!primaryGroupID=513))", "sAMAccountName,distinguishedName,displayname", "Users with any group other than 'Domain Users' designated as their 'primary group'")
; **************************************************************
; Users that must change their password the next time they logon
; **************************************************************
_Examples("(&(objectCategory=person)(objectClass=user)(pwdLastSet=0))", "sAMAccountName,distinguishedName,displayname", "Users that must change their password the next time they logon")
; *********************************
; Users that never logged on before
; *********************************
_Examples("(&(&(objectCategory=person)(objectClass=user))(|(lastLogon=0)(!(lastLogon=*))))", "sAMAccountName,distinguishedName,displayname", "Users that never logged on before")
; **************************
; List of all Group Policies
; **************************
_Examples("(objectClass=groupPolicyContainer)", "displayName,gPCFileSysPath", "List of Group Policies")
EndIf

; Close Connection to the Active Directory
_AD_Close()

; **********************************************************
; Executes LDAP queries and displays the results in an Array
; **********************************************************
Func _Examples($query, $fields, $description)

Local $aObjects[1][1]
$aObjects = _AD_GetObjectsInOU($sOU, $query, 2, $fields)
If @error <> 0 Then
MsgBox(64, "Active Directory Functions - Extended Example", "No entries found for LDAP query " & @CRLF & $query & @CRLF & $description & @CRLF & "Error: " & @error)
Else
_ArrayDisplay($aObjects, "LDAP query - " & $description & " - " & $query)
EndIf

EndFunc ;==>_Examples


Function _AD_GetObjectsLocked

Function Reference

_AD_GetObjectsLocked

Returns an array of FQDNs of locked (user and/or, computer accounts), lockout time and minutes remaining in locked state.

#Include <AD.au3>
_AD_GetObjectsLocked([$sClass = "user"[, $sRoot = ""]])

Parameters

$sClass | [optional] Specifies if locked user accounts or computer accounts should be returned (default = "user"). "user" - Returns objects of category "user" "computer" - Returns objects of category "computer"
$sRoot | [optional] FQDN of the OU where the search should start (default = "" = search the whole tree)

Return Value

Success: Returns a one-based two dimensional array with the following information:
0 - FQDN of the locked object
1 - lockout time YYYY/MM/DD HH:MM:SS in local time of the calling user
2 - Minutes until the object will be unlocked
Failure: "", sets @error to:
1 - $sClass is invalid. Should be "computer" or "user"
2 - No locked objects found
3 - Specified $sRoot does not exist

Remarks

LockoutTime contains the timestamp when the object was locked. This value is not reset until the user/computer logs on again.
LockoutTime could be > 0 even when the lockout has already expired.

Related

_AD_IsObjectLocked, _AD_UnlockObject

See Also

http://technet.microsoft.com/en-us/library/cc780271%28WS.10%29.aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $aLocked[1][2]
; *****************************************************************************
; Example 1
; Get a list of locked accounts
; *****************************************************************************
$aLocked = _AD_GetObjectsLocked()
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "No locked user accounts have been found. Error: " & @error)
Else
_ArrayDisplay($aLocked, "Active Directory Functions - Example 1 - Locked User Accounts")
EndIf

; *****************************************************************************
; Example 2
; Get a list of locked computers
; *****************************************************************************
$aLocked = _AD_GetObjectsLocked("computer")
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 2", "No locked computers have been found")
Else
_ArrayDisplay($aLocked, "Active Directory Functions - Example 2 - Locked Computers")
EndIf


Function _AD_IsObjectDisabled

Function Reference

_AD_IsObjectDisabled

Returns 1 if the object (user account, computer account) is disabled.

#Include <AD.au3>
_AD_IsObjectDisabled([$sObject = @Username])

Parameters

$sObject [optional] Object to check (default = @Username). Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName

Return Value

Success: 1, Specified object is disabled
Failure: 0, sets @error to:
0 - $sObject is not disabled
1 - $sObject could not be found

Remarks

A $ sign must be appended to the computer name to create a correct sAMAccountName e.g. @ComputerName & "$"

Related

_AD_DisableObject, _AD_EnableObject, _AD_GetObjectsDisabled

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1
; Checks if the account for the current user is disabled.
; *****************************************************************************
If _AD_IsObjectDisabled() Then
MsgBox(64, "Active Directory Functions", "User account '" & @UserName & "' is disabled")
Else
MsgBox(64, "Active Directory Functions", "User account '" & @UserName & "' is not disabled")
EndIf

; *****************************************************************************
; Example 2
; Get a list of disabled accounts and checks the first entry
; *****************************************************************************
Global $aDisabled = _AD_GetObjectsDisabled()

If $aDisabled[0] > 0 Then
Global $sUser = _AD_FQDNToSamAccountName($aDisabled[1])
If _AD_IsObjectDisabled($sUser) Then
MsgBox(64, "Active Directory Functions", "User account '" & $sUser & "' is disabled")
Else
MsgBox(64, "Active Directory Functions", "User account '" & $sUser & "' is not disabled")
EndIf
Else
MsgBox(64, "Active Directory Functions", "No disabled users accounts found")
EndIf


Function _AD_IsObjectLocked

Function Reference

_AD_IsObjectLocked

Returns 1 if the object (user account, computer account) is locked.

#Include <AD.au3>
_AD_IsObjectLocked([$sObject = @Username])

Parameters

$sObject [optional] Object to check (default = @Username). Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName

Return Value

Success: 1, Specified object is locked, sets @error to:
x - number of minutes till the account is unlocked. -1 means the account has to be unlocked manually by an admin
Failure: 0, sets @error to:
0 - $sObject is not locked
1 - $sObject could not be found

Remarks

A $ sign must be appended to the computer name to create a correct sAMAccountName e.g. @ComputerName & "$"
LockoutTime contains the timestamp when the object was locked. This value is not reset until the user/computer logs on again.
LockoutTime could be > 0 even when the lockout already has expired.

Related

_AD_GetObjectsLocked, _AD_UnlockObject

See Also

http://www.pcreview.co.uk/forums/thread-1350048.php, http://www.rlmueller.net/IsUserLocked.htm, http://technet.microsoft.com/en-us/library/cc780271%28WS.10%29.aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1
; Checks if the account for the current user is locked.
; *****************************************************************************
If _AD_IsObjectLocked() Then
MsgBox(64, "Active Directory Functions", "User account '" & @UserName & "' is locked. Will be unlocked in " & @error & " minutes.")
Else
MsgBox(64, "Active Directory Functions", "User account '" & @UserName & "' is not locked")
EndIf

; *****************************************************************************
; Example 2
; Get a list of locked accounts and checks the first entry
; *****************************************************************************
Global $aLocked = _AD_GetObjectsLocked()

If $aLocked[0] > 0 Then
Global $sUser = _AD_FQDNToSamAccountName($aLocked[1])
If _AD_IsObjectLocked($sUser) Then
MsgBox(64, "Active Directory Functions", "User account '" & $sUser & "' is locked")
Else
MsgBox(64, "Active Directory Functions", "User account '" & $sUser & "' is not locked")
EndIf
Else
MsgBox(64, "Active Directory Functions", "No locked users accounts found")
EndIf


Function _AD_ModifyAttribute

Function Reference

_AD_ModifyAttribute

Modifies an attribute of the given object to the value specified.

#Include <AD.au3>
_AD_ModifyAttribute($sObject, $sAttribute[, $sValue = ""[, $iOption = 1]])

Parameters

$sObject | Object (user, group ...) to add/delete/modify an attribute (sAMAccountName or FQDN)
$sAttribute | Attribute to add/delete/modify
$sValue | [optional] Value to modify the attribute to. Use a blank string ("") to delete the attribute (default). $sValue can be a single value (as a string) or a multi-value (as a one-dimensional zero based array)
$iOption | [optional] Indicates the mode of modification: 1 - CLEAR: remove all the property value(s) from the object (default when $sValue = "") 2 - UPDATE: replace the current value(s) with the specified value(s) 3 - APPEND: append the specified value(s) to the existing values(s) 4 - DELETE: delete the specified value(s) from the object

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetInfo method (Missing permission etc.)

Remarks

None.

Related

_AD_GetObjectAttribute, _AD_GetObjectProperties, _AD_AddEmailAddress

See Also

http://msdn.microsoft.com/en-us/library/aa746353(VS.85).aspx (ADS_PROPERTY_OPERATION_ENUM Enumeration)

Example

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#AutoIt3Wrapper_AU3Check_Parameters=-d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_Run_Obfuscator=y
#Obfuscator_Parameters=/cs 0 /cn 0
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
; *****************************************************************************
; Example 1
; Modify the description of the current user.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script changes the attribute 'description' for a user." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter user account and description
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 514, 124)
GUICtrlCreateLabel("User account (samAccountName or sAMAccountName):", 8, 10, 231, 34)
GUICtrlCreateLabel("New description:", 8, 42, 231, 17)
Global $IUser = GUICtrlCreateInput(@UserName, 241, 8, 259, 21)
Global $IDescription = GUICtrlCreateInput("", 241, 40, 259, 21)
Global $BOK = GUICtrlCreateButton("Change description", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 428, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sUser = GUICtrlRead($IUser)
Global $sDescription = GUICtrlRead($IDescription)
ExitLoop
EndSwitch
WEnd

; Change attribute
Global $iValue = _AD_ModifyAttribute($sUser, "description", $sDescription)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Description for user '" & $sUser & "' successfully changed")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_MoveObject

Function Reference

_AD_MoveObject

Moves an object to another OU.

#Include <AD.au3>
_AD_MoveObject($sOU, $sObject[, $sCN = ""])

Parameters

$sOU | Target OU for the object move (FQDN)
$sObject | Object (user, group, computer) to move (FQDN or sAMAccountName)
$sCN | [optional] New Name of the object in the target OU. Common Name or RDN (Relative Distinguished Name) like "Lastname Firstname" without leading "CN="

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sOU does not exist
2 - $sObject does not exist
3 - Object already exists in the target OU
x - Error returned by MoveHere function (Missing permission etc.)

Remarks

You must escape commas in $sObject with a backslash. E.g. "CN=Lastname\, Firstname,OU=..."
If you want to move an OU you have to specify $sObject as FQDN. OUs do not have a SamAccountName

Related

_AD_RenameObject, _AD_DeleteObject, _AD_DeleteSubTree

See Also

http://msdn.microsoft.com/en-us/library/aa705991(v=VS.85).aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Moves an AD object to another OU.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script moves an object to another OU." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter object to move and target OU
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 814, 124)
GUICtrlCreateLabel("Object to move (FQDN or sAMAccountName):", 8, 10, 231, 17)
GUICtrlCreateLabel("OU where to move to (FQDN):", 8, 42, 231, 17)
Global $IObject = GUICtrlCreateInput(_AD_SamAccountNameToFQDN(@UserName), 241, 8, 559, 21)
Global $ITargetOU = GUICtrlCreateInput("", 241, 40, 559, 21)
Global $BOK = GUICtrlCreateButton("Move object", 8, 72, 130, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 728, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sObject = GUICtrlRead($IObject)
Global $sTargetOU = GUICtrlRead($ITargetOU)
ExitLoop
EndSwitch
WEnd

; Move object
Global $iValue = _AD_MoveObject($sTargetOU, $sObject)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Object '" & $sObject & "' successfully moved to '" & $sTargetOU & "'")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Target OU '" & $sTargetOU & "' does not exist")
ElseIf @error = 2 Then
MsgBox(64, "Active Directory Functions - Example 1", "Object '" & $sObject & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_ObjectExists

Function Reference

_AD_ObjectExists

Returns 1 if exactly one object exists for the given property in the local Active Directory Tree.

#Include <AD.au3>
_AD_ObjectExists([$sObject = @UserName[, $sProperty = ""]])

Parameters

$sObject | [optional] Object (user, computer, group, OU) to check (default = @UserName)
$sProperty | [optional] Property to check. If omitted the function tries to determine whether to use sAMAccountname or FQDN

Return Value

Success: 1, Exactly one object exists for the given property in the local Active Directory Tree
Failure: 0, sets @error to:
1 - No object found for the specified property
x - More than one object found for the specified property. x is the number of objects found

Remarks

Checking on a computer account requires a "$" (dollar) appended to the sAMAccountName.
To check the existence of an OU use the FQDN of the OU as first parameter because an OU has no SamAccountName.

Related

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1 - Process the current user.
; In the first step get some attributes of the current user.
; In the second step check the user for this attributes.
; *****************************************************************************

; Get some information for the current logged on user we later can test
Global $asProperties[8] = ["sAMAccountName", "cn", "mail", "userPrincipalName", "name", "mailNickname", "displayName", "dNSHostName"]
Global $asObjects[8], $iCount

For $iCount = 0 To UBound($asObjects) - 1
$asObjects[$iCount] = _AD_GetObjectAttribute(@UserName, $asProperties[$iCount])
Next

; Test for the information we gathered above
Global $sOutput = "Get Attributes for User: " & @UserName & @CRLF & @CRLF
For $iCount = 0 To UBound($asObjects) - 1
If _AD_ObjectExists($asObjects[$iCount], $asProperties[$iCount]) Then
$sOutput &= "Object '" & $asObjects[$iCount] & "' for property '" & $asProperties[$iCount] & "' exists" & @CRLF
ElseIf @error = 1 Then
$sOutput &= "Object '" & $asObjects[$iCount] & "' for property '" & $asProperties[$iCount] & "' does not exist" & @CRLF
Else
$sOutput &= "Object '" & $asObjects[$iCount] & "' for property '" & $asProperties[$iCount] & "' is not unique: >=" & @error & " records found" & @CRLF
EndIf
Next
MsgBox(64, "Active Directory Functions", $sOutput)

; *****************************************************************************
; Example 2 - Process the computer running the script.
; In the first step get some attributes of the computer.
; In the second step check the computer for this attributes.
; *****************************************************************************

; Get some information for the computer running the script
Global $asProperties[7] = ["sAMAccountName", "operatingSystem", "operatingSystemVersion", "operatingSystemServicePack", "name", "dNSHostName", "displayName"]

For $iCount = 0 To UBound($asProperties) - 1
$asObjects[$iCount] = ""
$asObjects[$iCount] = _AD_GetObjectAttribute(@ComputerName & "$", $asProperties[$iCount])
Next

; Test for the information we gathered above
$sOutput = "Get Attributes for Computer: " & @ComputerName & @CRLF & @CRLF
For $iCount = 0 To UBound($asProperties) - 1
If _AD_ObjectExists($asObjects[$iCount], $asProperties[$iCount]) Then
$sOutput &= "Object '" & $asObjects[$iCount] & "' for property '" & $asProperties[$iCount] & "' exists" & @CRLF
ElseIf @error = 1 Then
$sOutput &= "Object '" & $asObjects[$iCount] & "' for property '" & $asProperties[$iCount] & "' does not exist" & @CRLF
Else
$sOutput &= "Object '" & $asObjects[$iCount] & "' for property '" & $asProperties[$iCount] & "' is not unique: >=" & @error & " records found" & @CRLF
EndIf
Next
MsgBox(64, "Active Directory Functions", $sOutput)

; *****************************************************************************
; Example 3 - Checks an Organizational Unit (OU) for existance.
; Get the primary group for the current user and then check for existance.
; *****************************************************************************
Global $sOU = _AD_GetUserPrimaryGroup()
If _AD_ObjectExists($sOU, "distinguishedName") Then
MsgBox(64, "Active Directory Functions", "OU '" & $sOU & "' exists")
Else
MsgBox(64, "Active Directory Functions", "OU '" & $sOU & "' does not exist")
EndIf


Function _AD_RenameObject

Function Reference

_AD_RenameObject

Renames an object within an OU.

#Include <AD.au3>
_AD_RenameObject($sObject, $sCN)

Parameters

$sObject | Object (user, group, computer) to rename (FQDN or sAMAccountName)
$sCN | New Name (relative name) of the object in the current OU without CN=

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sObject does not exist
x - Error returned by MoveHere function (Missing permission etc.)

Remarks

Renames an object within the same OU. You can not move objects to another OU with this function.

Related

_AD_MoveObject, _AD_DeleteObject

See Also

http://msdn.microsoft.com/en-us/library/aa705991(v=VS.85).aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Renames an AD object.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script renames an object in the AD (user, group ...)." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter object to rename and new name
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 814, 124)
GUICtrlCreateLabel("Object to rename (FQDN or sAMAccountName):", 8, 10, 231, 17)
GUICtrlCreateLabel("New name (without leading CN=):", 8, 42, 231, 17)
Global $IObject = GUICtrlCreateInput(_AD_SamAccountNameToFQDN(@UserName), 241, 8, 559, 21)
Global $INewName = GUICtrlCreateInput("", 241, 40, 559, 21)
Global $BOK = GUICtrlCreateButton("Rename object", 8, 72, 130, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 728, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sObject = GUICtrlRead($IObject)
Global $sNewName = GUICtrlRead($INewName)
ExitLoop
EndSwitch
WEnd

; Rename object
Global $iValue = _AD_RenameObject($sObject, $sNewName)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Object '" & $sObject & "' successfully renamed")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Object '" & $sObject & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_UnlockObject

Function Reference

_AD_UnlockObject

Unlocks an AD object (user account, computer account).

#Include <AD.au3>
_AD_UnlockObject($sObject)

Parameters

$sObject User account or computer account to unlock (sAMAccountName or FQDN)

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetInfo method (Missing permission etc.)

Remarks

None.

Related

_AD_IsObjectLocked, _AD_GetObjectsLocked

See Also

http://www.rlmueller.net/Programs/IsUserLocked.txt

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Unlocks an AD object (user account, computer account).
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script unlocks the specified object (user account, computer account)." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter object to unlock
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 124)
GUICtrlCreateLabel("Object to unlock (FQDN or sAMAccountName):", 8, 10, 231, 17)
Global $IObject = GUICtrlCreateInput("", 241, 10, 459, 21)
Global $BOK = GUICtrlCreateButton("Unlock object", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sObject = GUICtrlRead($IObject)
ExitLoop
EndSwitch
WEnd

; Change Object
Global $iValue = _AD_UnlockObject($sObject)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Object '" & $sObject & "' successfully changed")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Object '" & $sObject & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_ChangePassword

Function Reference

_AD_ChangePassword

Changes the password for the currently logged on user.

#Include <AD.au3>
_AD_ChangePassword($sOldPW, $sNewPW)

Parameters

$sOldPW | Old password of the user
$sNewPW | New password to be set for the user

Return Value

Success: 1
Failure: 0, sets @error to:
1 - Error accessing the current user object
2 - Error returned by ChangePassword method (Missing permission etc.)

Remarks

This allows a logged on user without elevated permissions to change his password.

Related

_AD_IsPasswordExpired, _AD_GetPasswordExpired, _AD_GetPasswordDontExpire, _AD_DisablePasswordExpire, _AD_EnablePasswordExpire, _AD_EnablePasswordChange, _AD_DisablePasswordChange, _AD_GetPasswordInfo, _AD_SetPassword

Example

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_AU3Check_Parameters=-d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6 -w 7
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
; *****************************************************************************
; Example 1
; Sets the password for the currently logged on user
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>
#include <EditConstants.au3>
#include <MsgBoxConstants.au3>

Global $bShow = False

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script changes the password for the current user." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter user and password to change
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 414, 156, 251, 112)
GUICtrlCreateLabel("Old (current) password:", 8, 10, 231, 17)
GUICtrlCreateLabel("New password:", 8, 42, 121, 17)
GUICtrlCreateLabel("New password:", 8, 72, 121, 17)
Global $IOldPW = GUICtrlCreateInput("", 241, 8, 159, 21, $ES_PASSWORD)
Global $INewPW1 = GUICtrlCreateInput("", 241, 40, 159, 21, $ES_PASSWORD)
Global $INewPW2 = GUICtrlCreateInput("", 241, 72, 159, 21, $ES_PASSWORD)
Global $BOK = GUICtrlCreateButton("Change Password", 8, 104, 121, 33)
Global $BShowPW = GUICtrlCreateButton("Show Passwords", 200, 104, 110, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 328, 104, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

Global $sDefaultPassChar = GUICtrlSendMsg($IOldPW, $EM_GETPASSWORDCHAR, 0, 0)
While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BShowPW
If $bShow = False Then
GUICtrlSendMsg($IOldPW, $EM_SETPASSWORDCHAR, 0, 0)
GUICtrlSendMsg($INewPW1, $EM_SETPASSWORDCHAR, 0, 0)
GUICtrlSendMsg($INewPW2, $EM_SETPASSWORDCHAR, 0, 0)
GUICtrlSetData($BShowPW, "Hide Passwords")
$bShow = True
Else
GUICtrlSendMsg($IOldPW, $EM_SETPASSWORDCHAR, $sDefaultPassChar, 0)
GUICtrlSendMsg($INewPW1, $EM_SETPASSWORDCHAR, $sDefaultPassChar, 0)
GUICtrlSendMsg($INewPW2, $EM_SETPASSWORDCHAR, $sDefaultPassChar, 0)
GUICtrlSetData($BShowPW, "Show Passwords")
$bShow = False
EndIf
GUICtrlSetState($IOldPW, $GUI_FOCUS) ;Input needs focus to redraw characters
GUICtrlSetState($INewPW1, $GUI_FOCUS)
GUICtrlSetState($INewPW2, $GUI_FOCUS)
Case $BOK
Global $sOldPW = GUICtrlRead($IOldPW)
Global $sNewPW1 = GUICtrlRead($INewPW1)
Global $sNewPW2 = GUICtrlRead($INewPW2)
if $sNewPW1 = $sNewPW2 Then ExitLoop
MsgBox($MB_ICONERROR, "Active Directory - Change Password", "New passwords don't match!")
EndSwitch
WEnd

; Change the password
Global $iValue = _AD_ChangePassword($sOldPW, $sNewPW1)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Password for the current user successfully changed")
ElseIf @error = 1 Then
MsgBox(16, "Active Directory Functions - Example 1", "Error occurred when accessing the current user object!" & @LF & "@error = " & @error & ", @extended = " & @extended)
Else
MsgBox(16, "Active Directory Functions - Example 1", "Error occurred when changing the password!" & @LF & "@error = " & @error & ", @extended = " & @extended)
EndIf


Function _AD_DisablePasswordChange

Function Reference

_AD_DisablePasswordChange

Enables the 'User Cannot Change Password' option, preventing the user from changing their password.

#Include <AD.au3>
_AD_DisablePasswordChange($sObject)

Parameters

$sObject User account to disallow changing his password (SAMAccountNmae or FQDN)

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetInfo method (Missing permission etc.)

Remarks

None.

Related

_AD_IsPasswordExpired, _AD_GetPasswordExpired, _AD_GetPasswordDontExpire, _AD_SetPassword, _AD_DisablePasswordExpire, _AD_EnablePasswordExpire, _AD_EnablePasswordChange, _AD_GetPasswordInfo

See Also

How to set the "User Cannot Change Password" option by using a program. See: http://support.microsoft.com/kb/301287/en-us -

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Denies user to change their password.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script denies ability to change the password for the specified user." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter user to change
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 124)
GUICtrlCreateLabel("User to change (FQDN or sAMAccountName):", 8, 10, 231, 17)
Global $IUser = GUICtrlCreateInput("", 241, 10, 459, 21)
Global $BOK = GUICtrlCreateButton("Change User", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sUser = GUICtrlRead($IUser)
ExitLoop
EndSwitch
WEnd

; Change user
Global $iValue = _AD_DisablePasswordChange($sUser)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' successfully changed")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_DisablePasswordExpire

Function Reference

_AD_DisablePasswordExpire

Modifies specified users password to not expire.

#Include <AD.au3>
_AD_DisablePasswordExpire($sObject)

Parameters

$sObject User account to disable password expiration (sAMAccountName or FQDN)

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sObject does not exist
x - Error returned by Put or SetInfo method (Missing permission etc.)

Remarks

None.

Related

_AD_IsPasswordExpired, _AD_GetPasswordExpired, _AD_GetPasswordDontExpire, _AD_SetPassword, _AD_EnablePasswordChange, _AD_DisablePasswordChange, _AD_GetPasswordInfo, _AD_EnablePasswordExpire

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Sets users password not to expire.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script sets the password for the specified user to not expire." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter user to change
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 124)
GUICtrlCreateLabel("User to change (FQDN or sAMAccountName):", 8, 10, 231, 17)
Global $IUser = GUICtrlCreateInput("", 241, 10, 459, 21)
Global $BOK = GUICtrlCreateButton("Change User", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sUser = GUICtrlRead($IUser)
ExitLoop
EndSwitch
WEnd

; Change user
Global $iValue = _AD_DisablePasswordExpire($sUser)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' successfully changed")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_EnablePasswordChange

Function Reference

_AD_EnablePasswordChange

Disables the 'User Cannot Change Password' option, allowing the user to change their password.

#Include <AD.au3>
_AD_EnablePasswordChange($sObject)

Parameters

$sObject User account to enable changing the password (sAMAccountName or FQDN)

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetInfo method (Missing permission etc.)

Remarks

None.

Related

_AD_IsPasswordExpired, _AD_GetPasswordExpired, _AD_GetPasswordDontExpire, _AD_SetPassword, _AD_DisablePasswordExpire, _AD_EnablePasswordExpire, _AD_DisablePasswordChange, _AD_GetPasswordInfo

See Also

Example VBS see: http://gallery.technet.microsoft.com/ScriptCenter/en-us/ced14c6c-d16a-4cd8-b7d1-90d716c0445f or How to use Visual Basic and ADsSecurity.dll to properly order ACEs in an ACL. See: http://support.microsoft.com/kb/269159/en-us -

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Allows user to change their password.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script enables the specified user to change their password." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter user to change
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 124)
GUICtrlCreateLabel("User to change (FQDN or sAMAccountName):", 8, 10, 231, 17)
Global $IUser = GUICtrlCreateInput("", 241, 10, 459, 21)
Global $BOK = GUICtrlCreateButton("Change User", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sUser = GUICtrlRead($IUser)
ExitLoop
EndSwitch
WEnd

; Change user
Global $iValue = _AD_EnablePasswordChange($sUser)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' successfully changed")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_EnablePasswordExpire

Function Reference

_AD_EnablePasswordExpire

Sets users password to expire.

#Include <AD.au3>
_AD_EnablePasswordExpire($sObject)

Parameters

$sObject User account to enable password expiration (sAMAccountName or FQDN)

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetInfo method (Missing permission etc.)

Remarks

None.

Related

_AD_IsPasswordExpired, _AD_GetPasswordExpired, _AD_GetPasswordDontExpire, _AD_SetPassword, _AD_EnablePasswordChange, _AD_DisablePasswordChange, _AD_GetPasswordInfo, _AD_DisablePasswordExpire

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Sets users password to expire.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script sets the password for the specified user to expire." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter user to change
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 124)
GUICtrlCreateLabel("User to change (FQDN or sAMAccountName):", 8, 10, 231, 17)
Global $IUser = GUICtrlCreateInput("", 241, 10, 459, 21)
Global $BOK = GUICtrlCreateButton("Change User", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sUser = GUICtrlRead($IUser)
ExitLoop
EndSwitch
WEnd

; Change user
Global $iValue = _AD_EnablePasswordExpire($sUser)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' successfully changed")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_GetPasswordDontExpire

Function Reference

_AD_GetPasswordDontExpire

Returns an array of user account FQDNs where the password does not expire.

#Include <AD.au3>
_AD_GetPasswordDontExpire([$sRoot = ""])

Parameters

$sRoot [optional] FQDN of the OU where the search should start (default = "" = search the whole tree)

Return Value

Success: Array with FQDNs of user accounts for which the password does not expire
Failure: "", sets @error to:
1 - No user accounts for which the password does not expire. @extended is set to the error returned by LDAP
2 - Specified $sRoot does not exist

Remarks

None.

Related

_AD_IsPasswordExpired, _AD_GetPasswordExpired, _AD_SetPassword, _AD_DisablePasswordExpire, _AD_EnablePasswordExpire, _AD_EnablePasswordChange, _AD_DisablePasswordChange, _AD_GetPasswordInfo

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Returns an array of user accounts for which the password will not expire
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Returns an array of user accounts for which the password will not expire
Global $aNotExpire[1]
$aNotExpire = _AD_GetPasswordDontExpire()
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "No user accounts for which the password will not expire could be found")
Else
_ArrayDisplay($aNotExpire, "Active Directory Functions - Example 1 - User accounts for which the password will not expire")
EndIf


Function _AD_GetPasswordExpired

Function Reference

_AD_GetPasswordExpired

Returns an array of FQDNs of user or computer accounts with expired passwords.

#Include <AD.au3>
_AD_GetPasswordExpired([$sRoot = ""[, $bNeverChanged = False]])

Parameters

$sRoot | [optional] FQDN of the OU where the search should start (default = "" = search the whole tree)
$bNeverChanged | [optional] If set to True returns all accounts who have never changed their password as well (default = False)
$iPasswordAge | [optional] Takes the max. password age from the AD or uses this value if > 0
$bComputer | [optional] If True queries computer accounts, if False queries user accounts (default = False)

Return Value

Success: One-based two dimensional array of FQDNs of accounts with expired passwords
0 - FQDNs of accounts with expired password
1 - password last set YYYY/MM/DD HH:NMM:SS UTC
2 - password last set YYYY/MM/DD HH:NMM:SS local time of calling user
Failure: "", sets @error to:
1 - No expired passwords found. @extended is set to the error returned by LDAP
2 - Specified $sRoot does not exist
3 - $iPasswordAge is not numeric

Remarks

None.

Related

_AD_IsPasswordExpired, _AD_GetPasswordDontExpire, _AD_SetPassword, _AD_DisablePasswordExpire, _AD_EnablePasswordExpire, _AD_EnablePasswordChange, _AD_DisablePasswordChange, _AD_GetPasswordInfo

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get a list of user accounts with expired password
; *****************************************************************************
#include <AD.au3>
#include <Debug.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get a list of user accounts with expired password
Global $aExpired[1]
$aExpired = _AD_GetPasswordExpired()
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "No users with expired passwords could be found")
Else
_DebugArrayDisplay($aExpired, "Active Directory Functions - Example 1 - User accounts with expired password")
EndIf


Function _AD_GetPasswordInfo

Function Reference

_AD_GetPasswordInfo

Returns password information retrieved from the domain policy and the specified user or computer account.

#Include <AD.au3>
_AD_GetPasswordInfo([$sSamAccountName = @UserName])

Parameters

$sObject [optional] User or computer account to get password info for (default = @UserName). Format is sAMAccountName or FQDN

Return Value

Success: Returns a one-based array with the following information:
1 - Maximum Password Age (days)
2 - Minimum Password Age (days)
3 - Enforce Password History (# of passwords remembered)
4 - Minimum Password Length
5 - Account Lockout Duration (minutes). 0 means the account has to be unlocked manually by an administrator
6 - Account Lockout Threshold (invalid logon attempts)
7 - Reset account lockout counter after (minutes)
8 - Password last changed (YYYY/MM/DD HH:MM:SS in local time of the calling user) or "1601/01/01 00:00:00" (means "Password has never been set")
9 - Password expires (YYYY/MM/DD HH:MM:SS in local time of the calling user) or empty when password has not been set before or never expires
10 - Password last changed (YYYY/MM/DD HH:MM:SS in UTC) or "1601/01/01 00:00:00" (means "Password has never been set")
11 - Password expires (YYYY/MM/DD HH:MM:SS in UTC) or empty when password has not been set before or never expires
12 - Password properties. Part of Domain Policy. A bit field to indicate complexity / storage restrictions
1 - DOMAIN_PASSWORD_COMPLEX
2 - DOMAIN_PASSWORD_NO_ANON_CHANGE
4 - DOMAIN_PASSWORD_NO_CLEAR_CHANGE
8 - DOMAIN_LOCKOUT_ADMINS
16 - DOMAIN_PASSWORD_STORE_CLEARTEXT
32 - DOMAIN_REFUSE_PASSWORD_CHANGE
13 - Calculated password expiration date/time. Identical with element 9 of this array.
Returns a value even when fine grained password policy is in use; which means that most of the other elements of this array are blank or 0.
This is a Virtual Attribute (aka "Pseudo Attribute", "Constructed Attribute" or "Back-link") where the value is calculated by the LDAP Server Implementation and is not actually part of the LDAP Entry.
Failure: "", sets @error to:
1 - $sObject not found
2 - Error accessing the userAccountControl property. Might be caused by missing permissions. @extended is set to the COM error code
Warning: Returns a one-based array (see Success), sets @extended to one of the following values (can be a combination of the following values e.g. 3 = 1 (Password does not expire) + 2 (Password has never been set)
1 - Password does not expire (User Access Control - UAC - is set)
2 - Password has never been set
4 - The Maximum Password Age is set to 0 in the domain. Therefore, the password does not expire
8 - The version of the accessed DC (needs to be >= 2008) does not support property MSDS-UserPasswordExpiryTimeComputed. Element 13 of the returned array is set to element 9.
16 - Function _AD_GetObjectProperties returned an error when querying property MSDS-UserPasswordExpiryTimeComputed. The error is ignored and element 13 of the returned array is set to element 9.

Remarks

For details about password properties please check: http://msdn.microsoft.com/en-us/library/aa375371(v=vs.85).aspx

Related

_AD_IsPasswordExpired, _AD_GetPasswordExpired, _AD_GetPasswordDontExpire, _AD_SetPassword, _AD_DisablePasswordExpire, _AD_EnablePasswordExpire, _AD_EnablePasswordChange, _AD_DisablePasswordChange

See Also

http://www.autoitscript.com/forum/index.php?showtopic=86247&view=findpost&p=619073, http://windowsitpro.com/article/articleid/81412/jsi-tip-8294-how-can-i-return-the-domain-password-policy-attributes.html

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get the domain password policy and the password info for the current user
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get the password info
Global $aAD_PwdInfo[14][2] = [[13],["Maximum Password Age (days)"],["Minimum Password Age (days)"],["Enforce Password History (# of passwords remembered)"], _
["Minimum Password Length"],["Account Lockout Duration (minutes)"],["Account Lockout Threshold (invalid logon attempts)"],["Reset account lockout counter after (minutes)"], _
["Password last changed (YYYY/MM/DD HH:MM:SS local time)"],["Password expires (YYYY/MM/DD HH:MM:SS local time)"],["Password last changed (YYYY/MM/DD HH:MM:SS UTC)"], _
["Password expires (YYYY/MM/DD HH:MM:SS UTC)"],["Password properties"],["Password expires - virtual property (YYYY/MM/DD HH:MM:SS local time)"]]

Global $aTemp = _AD_GetPasswordInfo()
For $iCount = 1 To $aTemp[0]
$aAD_PwdInfo[$iCount][1] = $aTemp[$iCount]
Next
$aAD_PwdInfo[0][0] = $aTemp[0]

_ArrayDisplay($aAD_PwdInfo, "Active Directory Functions - Example 1")


Function _AD_IsPasswordExpired

Function Reference

_AD_IsPasswordExpired

Returns 1 if the password of the user or computer account has expired.

#Include <AD.au3>
_AD_IsPasswordExpired([$sAccount = @Username])

Parameters

$sAccount [optional] User or computer account to check (default = @Username). Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName

Return Value

Success: 1, The password of the specified account has expired
Failure: 0, sets @error to:
0 - Password for $sAccount has not expired
1 - $sAccount could not be found
x - Error as returned by function _AD_GetPasswordInfo

Remarks

Correctly works with fine-grained passwort policy

Related

_AD_GetPasswordExpired, _AD_GetPasswordDontExpire, _AD_SetPassword, _AD_DisablePasswordExpire, _AD_EnablePasswordExpire, _AD_EnablePasswordChange, _AD_DisablePasswordChange, _AD_GetPasswordInfo

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1
; Checks if the password for the current user is expired.
; *****************************************************************************
If _AD_IsPasswordExpired() Then
MsgBox(64, "Active Directory Functions", "Password for user '" & @UserName & "' has expired")
Else
MsgBox(64, "Active Directory Functions", "Password for user '" & @UserName & "' has not expired")
EndIf

; *****************************************************************************
; Example 2
; Get a list of accounts for which the password has expired and check the first entry
; *****************************************************************************
Global $aExpired = _AD_GetPasswordExpired()
If @error = 0 Then
Global $sUser = _AD_FQDNToSamAccountName($aExpired[1])
If _AD_IsPasswordExpired($sUser) Then
MsgBox(64, "Active Directory Functions", "Password for user '" & $sUser & "' has expired")
Else
MsgBox(64, "Active Directory Functions", "Password for user '" & $sUser & "' has not expired")
EndIf
Else
MsgBox(64, "Active Directory Functions", "No expired user passwords found")
EndIf


Function _AD_SetPassword

Function Reference

_AD_SetPassword

Sets or clears the password for a user or computer.

#Include <AD.au3>
_AD_SetPassword($sObject[, $sAD_Password=""[, $iExpired = 0]])

Parameters

$sObject | User or computer for which to set the password (FQDN or sAMAccountName)
$sAD_Password | [optional] Password to be set for $sObject. If $sAD_Password is "" then the password will be cleared (default)
$iExpired | [optional] 1 = the password has to be changed at next logon (Default = 0)

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetPassword or SetInfo method (Missing permission etc.)

Remarks

Changing the password for a computer does a "reset" so the computer can be rejoined to the domain with the same SID.

Related

_AD_IsPasswordExpired, _AD_GetPasswordExpired, _AD_GetPasswordDontExpire, _AD_DisablePasswordExpire, _AD_EnablePasswordExpire, _AD_EnablePasswordChange, _AD_DisablePasswordChange, _AD_GetPasswordInfo, _AD_ChangePassword

See Also

http://answers.yahoo.com/question/index?qid=20070105110051AAib6G7

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Queries the sAMACccountName and the password and tries to change the password.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

Global $nMsg, $sUser, $sPassword, $iValue, $iReply
; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

$iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script sets the password for a user you specify." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter user and password to change
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 414, 124, 251, 112)
GUICtrlCreateLabel("User account (sAMAccountName or FQDN):", 8, 10, 231, 17)
GUICtrlCreateLabel("New password:", 8, 42, 121, 17)
Global $IUser = GUICtrlCreateInput("", 241, 8, 159, 21)
Global $IPassword = GUICtrlCreateInput("", 241, 40, 159, 21)
Global $BOK = GUICtrlCreateButton("Change Password", 8, 72, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 328, 72, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
$nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
$sUser = GUICtrlRead($IUser)
$sUser = _AD_SamAccountNameToFQDN($sUser)
$sPassword = GUICtrlRead($IPassword)
ExitLoop
EndSwitch
WEnd

; Set the password
$iValue = _AD_SetPassword($sUser, $sPassword)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Password for user '" & $sUser & "' successfully changed")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $sUser & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_SetPasswordExpire

Function Reference

_AD_SetPasswordExpire

Sets user's password as expired or not expired.

#Include <AD.au3>
_AD_SetPasswordExpire($sUser[, $iFlag = 0])

Parameters

$sUser | User account (sAMAccountName or FQDN)
$iFlag | [optional] Sets the user's password as expired ($iFlag = 0) or as not expired ($iFlag = -1) (Default = 0)

Return Value

Success: 1
Failure: 0, sets @error to:
1 - $sUser does not exist
2 - $iFlag has an invalid value
x - Error returned by SetInfo method (Missing permission etc.)

Remarks

When the user's password is set to expired he has to change the password at next logon

Related

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Sets user's password as expired or not expired.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
;#include <EditConstants.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script sets the password for a user you specify as expired or not expired." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

#region ### START Koda GUI section ### Form=
Global $Form = GUICreate("Active Directory Functions - Example 1", 515, 162, 251, 112)
GUICtrlCreateLabel("UserId", 8, 12, 39, 21)
Global $IUserId = GUICtrlCreateInput(@UserName, 241, 8, 259, 21)
GUICtrlCreateLabel("Set password expired:", 8, 44, 131, 21)
Global $IRadio1 = GUICtrlCreateRadio("", 241, 40, 17, 21)
GUICtrlSetState(-1, $GUI_CHECKED)
GUICtrlCreateLabel("Set password not expired:", 8, 76, 131, 21)
Global $IRadio2 = GUICtrlCreateRadio("", 241, 72, 17, 21)
Global $BOK = GUICtrlCreateButton("Set Password Expiration", 8, 118, 130, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 428, 118, 73, 33)
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

Global $iFunction = 0
While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $SUserId = GUICtrlRead($IUserId)
If GUICtrlRead($IRadio1) = $GUI_CHECKED Then $iFunction = 0
If GUICtrlRead($IRadio2) = $GUI_CHECKED Then $iFunction = -1
ExitLoop
EndSwitch
WEnd

; Change the Password Expiration
Global $iValue = _AD_SetPasswordExpire($SUserId, $iFunction)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $SUserId & "' successfully changed")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "User '" & $SUserId & "' does not exist")
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_HasFullRights

Function Reference

_AD_HasFullRights

Returns 1 if the given user has full rights over the given group or user.

#Include <AD.au3>
_AD_HasFullRights($sObject[, $sUser = @UserName])

Parameters

$sObject | Group or User to be checked. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$sUser | [optional] User to be checked. Can be specified as Fully Qualified Domain Name (FQDN) or SamAccountName (default = @UserName)

Return Value

Success: 1, Specified user has full rights over the given group or user
Failure: 0, @error set
0 - $sUser does not have full rights over $sObject
1 - $sUser does not exist
2 - $sObject does not exist

Remarks

None.

Related

_AD_HasUnlockResetRights, _AD_HasRequiredRights, _AD_HasGroupUpdateRights

See Also

http://msdn.microsoft.com/en-us/library/aa772285(VS.85).aspx (ADS_RIGHTS_ENUM Enumeration)

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get a list of groups the current user is a member of. Then check for the
; first group in the array if the current user has full rights for the group.
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get a list of groups the current user is a member of
Global $aMemberOf = _AD_GetUserGroups()

; Check if the current user has full rights on the first group in the array
Global $sUser = @UserName
If _AD_HasFullRights($aMemberOf[1], $sUser) Then
MsgBox(64, "Active Directory Functions", "User '" & $sUser & "' has full rights on group '" & $aMemberOf[1] & "'")
Else
MsgBox(64, "Active Directory Functions", "User '" & $sUser & "' does not have full rights on group '" & $aMemberOf[1] & "'")
EndIf


Function _AD_HasGroupUpdateRights

Function Reference

_AD_HasGroupUpdateRights

Returns 1 if the given user has rights to update the group membership of the object.

#Include <AD.au3>
_AD_HasGroupUpdateRights($sObject[, $sUser = @UserName])

Parameters

$sObject | Group to be checked. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$sUser | [optional] User to be checked. Can be specified as Fully Qualified Domain Name (FQDN) or SamAccountName (default = @UserName)

Return Value

Success: 1, Specified user has the rights to update the group membership on the given group
Failure: 0, @error set
0 - $sUser does not have the rights to update the group membership on $sObject
1 - $sUser does not exist
2 - $sObject does not exist

Remarks

None.

Related

_AD_HasFullRights, _AD_HasUnlockResetRights, _AD_HasRequiredRights

See Also

http://msdn.microsoft.com/en-us/library/aa772285(VS.85).aspx (ADS_RIGHTS_ENUM Enumeration)

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get a list of groups the current user is a member of. Then check for the
; first group in the array if the current user has update rights.
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get a list of groups the current user is a member of
Global $aMemberOf = _AD_GetUserGroups()

; Check if the current user has the rights to update the group membership on the first group in the array
Global $sUser = @UserName
If _AD_HasGroupUpdateRights($aMemberOf[1], $sUser) Then
MsgBox(64, "Active Directory Functions", "User '" & $sUser & "' has update rights on group '" & $aMemberOf[1] & "'")
Else
MsgBox(64, "Active Directory Functions", "User '" & $sUser & "' does not have update rights on group '" & $aMemberOf[1] & "'")
EndIf


Function _AD_HasRequiredRights

Function Reference

_AD_HasRequiredRights

Returns 1 if the given user has the required rights on the object.

#Include <AD.au3>
_AD_HasRequiredRights($sObject[, $iRight = $ADS_FULL_RIGHTS[, $sUser = @UserName]])

Parameters

$sObject | Group or User to be checked. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$sRight | [optional] Access mask constant to be checked (default = $ADS_FULL_RIGHTS (Full rights)). Full rights is the combination of the following rights: ADS_RIGHT_DELETE = 0x10000 ADS_RIGHT_READ_CONTROL = 0x20000 ADS_RIGHT_WRITE_DAC = 0x40000 ADS_RIGHT_WRITE_OWNER = 0x80000 ADS_RIGHT_DS_CREATE_CHILD = 0x1 ADS_RIGHT_DS_DELETE_CHILD = 0x2 ADS_RIGHT_ACTRL_DS_LIST = 0x4 ADS_RIGHT_DS_SELF = 0x8 ADS_RIGHT_DS_READ_PROP = 0x10 ADS_RIGHT_DS_WRITE_PROP = 0x20 ADS_RIGHT_DS_DELETE_TREE = 0x40 ADS_RIGHT_DS_LIST_OBJECT = 0x80 ADS_RIGHT_DS_CONTROL_ACCESS = 0x100
$sUser | [optional] User to be checked. Can be specified as Fully Qualified Domain Name (FQDN) or SamAccountName (default = @UserName)

Return Value

Success: 1, Specified user has the required rights over the given group or user
Failure: 0, @error set
0 - $sUser does not have the required rights over $sObject
1 - $sUser does not exist
2 - $sObject does not exist

Remarks

None.

Related

_AD_HasFullRights, _AD_HasUnlockResetRights, _AD_HasGroupUpdateRights

See Also

http://msdn.microsoft.com/en-us/library/aa772285(VS.85).aspx (ADS_RIGHTS_ENUM Enumeration)

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get a list of groups the current user is a member of. Then check for the
; first group in the array if the current user has delete right for the group.
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get a list of groups the current user is a member of
Global $aMemberOf = _AD_GetUserGroups()

; Check if the current user has the delete right on the first group in the array
Global $sUser = @UserName
If _AD_HasRequiredRights($aMemberOf[1], 65536, $sUser) Then
MsgBox(64, "Active Directory Functions", "User '" & $sUser & "' has the delete right on group '" & $aMemberOf[1] & "'")
Else
MsgBox(64, "Active Directory Functions", "User '" & $sUser & "' does not have the delete right on group '" & $aMemberOf[1] & "'")
EndIf


Function _AD_HasUnlockResetRights

Function Reference

_AD_HasUnlockResetRights

Returns 1 if the given user has unlock and password reset rights on the object.

#Include <AD.au3>
_AD_HasUnlockResetRights($sObject[, $sUser = @UserName])

Parameters

$sObject | Group or User to be checked. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$sUser | [optional] User to be checked. Can be specified as Fully Qualified Domain Name (FQDN) or SamAccountName (default = @UserName)

Return Value

Success: 1, Specified user has unlock and password reset rights over the given group or user
Failure: 0, @error set
0 - $sUser does not have unlock and password reset rights over $sObject
1 - $sUser does not exist
2 - $sObject does not exist

Remarks

None.

Related

_AD_HasFullRights, _AD_HasRequiredRights, _AD_HasGroupUpdateRights

See Also

http://msdn.microsoft.com/en-us/library/aa772285(VS.85).aspx (ADS_RIGHTS_ENUM Enumeration)

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get a list of groups the current user is a member of. Then check for the
; first group in the array if the current user has unlock and password reset
; rights for the group.
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get a list of groups the current user is a member of
Global $aMemberOf = _AD_GetUserGroups()

; Check if the current user has unlock and password reset rights on the first group in the array
Global $sUser = @UserName
If _AD_HasUnlockResetRights($aMemberOf[1], $sUser) Then
MsgBox(64, "Active Directory Functions", "User '" & $sUser & "' has unlock and password reset rights on group '" & $aMemberOf[1] & "'")
Else
MsgBox(64, "Active Directory Functions", "User '" & $sUser & "' does not have unlock and password reset rights on group '" & $aMemberOf[1] & "'")
EndIf


Function _AD_GetADOProperties

Function Reference

_AD_GetADOProperties

Retrieves all properties of an ADO object (Connection, Command).

#Include <AD.au3>
_AD_GetADOProperties($sADOobject[, $sProperties = ""])

Parameters

$sADOobject | ADO object for which to retrieve the properties. Can be either "Connection" or "Command"
$sProperties | [optional] Comma separated list of properties to return (default = "" = return all properties)

Return Value

Success: Returns a one based two-dimensional array with all properties and their values of the specified object
Failure: "", sets @error to:
1 - $sADOObject is invalid. Should either be "Command" or "Connection"

Remarks

None.

Related

See Also

ADO Command: http://msdn.microsoft.com/en-us/library/ms675022(v=VS.85).aspx, ADO Connection: http://msdn.microsoft.com/en-us/library/ms681546(v=VS.85).aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1
; Display all properties of the ADO Connection Object
; *****************************************************************************
Global $aResult = _AD_GetADOProperties("Conn")
_ArrayDisplay($aResult, "ADO Connection Object")

; *****************************************************************************
; Example 2
; Display all properties of the ADO Command Object
; *****************************************************************************
$aResult = _AD_GetADOProperties("Com")
_ArrayDisplay($aResult, "ADO Command Object")

; *****************************************************************************
; Example 3
; Display three properties of the ADO Command Object
; *****************************************************************************
$aResult = _AD_GetADOProperties("Command", "SearchScope,Column Names only,sort on")
_ArrayDisplay($aResult, "ADO Command Object")


Function _AD_GetLastADSIError

Function Reference

_AD_GetLastADSIError

Retrieve the calling thread's last ADSI error code value.

#Include <AD.au3>
_AD_GetLastADSIError()

Parameters

None.

Return Value

Success: A one-based array containing the following values:
1 - ADSI error code (decimal)
2 - Unicode string that describes the error
3 - name of the provider that raised the error
4 - Win32 error code extracted from element[2]
5 - description of the Win32 error code as returned by _WinAPI_FormatMessage
Failure: "", sets @error to the return value of DLLCall

Remarks

This and more errors will be handled (error codes are in hex):
525 - user not found
52e - invalid credentials
530 - not permitted to logon at this time
532 - password expired
533 - account disabled
701 - account expired
773 - user must reset password

Related

See Also

http://msdn.microsoft.com/en-us/library/cc231199(PROT.10).aspx (Win32 Error Codes), http://forums.sun.com/thread.jspa?threadID=703398


Function _AD_GetSchemaAttributes

Function Reference

_AD_GetSchemaAttributes

Enumerates attributes from the AD Schema (those replicated to the Global Catalog, indexed attributes or all).

#Include <AD.au3>
_AD_GetSchemaAttributes([$iSelect = 1])

Parameters

$iSelect [optional] Specifies the attributes to be returned:
1 - Return all attributes. This includes constructed attributes (default)
2 - Return all attributes that are replicated to the Global Catalog
3 - Return all attributes that are indexed
4 - Return all constructed attributes

Return Value

Success: One-based two dimensional array with the following information for all selected attributes:
0 - ldapDisplayName of the attribute
1 - True if the attribute is replicated to the Global Catalog, False or "" of not
2 - True if the attribute is indexed. Indexed attributes give better performance
3 - True if the attribute is constructed
Failure: "", sets @error to:
1 - The LDAP query returned no records or another error occurred

Remarks

None.

Related

See Also

Constructed attributes: https://www.powershellmagazine.com/2013/04/25/pstip-list-all-active-directory-constructed-attributes/

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1
; Return all attributes
; *****************************************************************************
Global $aResult = _AD_GetSchemaAttributes(1)
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 1", "Error getting attributes. @error = " & @error & ", @extended = " & @extended)
Else
_ArrayDisplay($aResult, "Active Directory Functions - Example 1 - All attributes")
EndIf

; *****************************************************************************
; Example 2
; Return all attributes that get propagated to the Global Catalog
; *****************************************************************************
$aResult = _AD_GetSchemaAttributes(2)
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 2", "Error getting attributes. @error = " & @error & ", @extended = " & @extended)
Else
_ArrayDisplay($aResult, "Active Directory Functions - Example 2 - Attributes propagated to the Global Catalog")
EndIf

; *****************************************************************************
; Example 3
; Return all attributes that are indexed (and therefore give better search performance)
; *****************************************************************************
$aResult = _AD_GetSchemaAttributes(3)
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 3", "Error getting attributes. @error = " & @error & ", @extended = " & @extended)
Else
_ArrayDisplay($aResult, "Active Directory Functions - Example 3 - Indexed attributes")
EndIf

; *****************************************************************************
; Example 4
; Return all attributes that are indexed (and therefore give better search performance)
; *****************************************************************************
$aResult = _AD_GetSchemaAttributes(4)
If @error > 0 Then
MsgBox(64, "Active Directory Functions - Example 4", "Error getting attributes. @error = " & @error & ", @extended = " & @extended)
Else
_ArraySort($aResult)
_ArrayDisplay($aResult, "Active Directory Functions - Example 4 - Constructed attributes")
EndIf


Function _AD_GetSystemInfo

Function Reference

_AD_GetSystemInfo

Retrieves data describing the local computer if it is a member of a (at least) Windows 2000 domain.

#Include <AD.au3>
_AD_GetSystemInfo()

Parameters

None.

Return Value

Success: Returns an one-based one dimensional array with the following information:
1 - distinguished name of the local computer
2 - DNS name of the local computer domain
3 - short name of the local computer domain
4 - DNS name of the local computer forest
5 - Local computer domain status: native mode (True) or mixed mode (False)
6 - distinguished name of the NTDS-DSA object for the DC that owns the primary domain controller role in the local computer domain
7 - distinguished name of the NTDS-DSA object for the DC that owns the schema role in the local computer forest
8 - site name of the local computer
9 - distinguished name of the current user
Failure: "", sets @error to:
1 - Creation of object "ADSystemInfo" returned an error. See @extended

Remarks

None.

Related

See Also

http://msdn.microsoft.com/en-us/library/aa705962(VS.85).aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Retrieve data about the local computer if it is a member of a Windows domain.
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get the ADSystemInfo
Global $aInfo[10][2] = [[""],["distinguished name of the local computer"],["DNS name of the local computer domain"], _
["short name of the local computer domain"],["DNS name of the local computer forest"],["Is local computer domain in native mode (TRUE) or mixed mode (FALSE)"], _
["name of the NTDS-DSA object for the DC that owns the primary domain controller role in the local computer domain"], _
["name of the NTDS-DSA object for the DC that owns the schema role in the local computer forest"],["site name of the local computer"], _
["distinguished name of the current user"]]

Global $aTemp = _AD_GetSystemInfo()
For $iCount = 1 To $aTemp[0]
$aInfo[$iCount][1] = $aTemp[$iCount]
Next
$aInfo[0][0] = $aTemp[0]
_ArrayDisplay($aInfo, "Active Directory Functions - Example 1")


Function _AD_JoinDomain

Function Reference

_AD_JoinDomain

Joins a computer to a domain.

#Include <AD.au3>
_AD_JoinDomain([$sComputer = @ComputerName[, $sUserParam = "", $sPasswordParam = ""[, $sOU = ""[, $iFlag = 1[, $sNewName = ""]]]]])

Parameters

$sComputer | [optional] Name of the computer to be joined to the domain (Default = @ComputerName)
$sUserParam | [optional] Domain user with admin rights to join the computer to the domain. Supported are NetBIOSName (domain\user), user principal name (user@domain) or Windows login name (user). (Default = credentials from _AD_Open or - if not used - of the user running the script)
$sPasswordParam | [optional] Password for $sUserParam (Default = credentials from _AD_Open or - if not used - of the user running the script)
$sOU | [optional] FQDN of the OU where the computer will be placed. (Default = Keyword Default = Computers container)
$iFlag | [optional] A set of bit flags (means: add the numbers for any valid combination) that specify options for joining a domain. Some of the possible flags: 1 - Joins a computer to a domain. Computer account must already exist in the domain (Default) 2 - Creates an account on a domain 32 - Allows a join to a new domain even if the computer is already joined to a domain
$sNewname | [optional] Name to change the computer to after joining to the domain.

Return Value

Success: 1, sets @extended to the return value of the JoinDomainOrWorkgroup method:
0 - indicates successful completion. No reboot required.
1 - indicates successful completion with reboot required.
Failure: 0, @error set
1 - $sComputer account does not exist in the domain and $iFlag <> 2
2 - $sUserParam does not exist in the domain
3 - WMI object could not be created. See @extended for error code. See remarks for further information
4 - The computer is already a member of the domain
5 - Joining the domain was not successful. @extended holds the Win32 error code (see: http://msdn.microsoft.com/en-us/library/ms681381(v=VS.85).aspx)
6 - $sNewName account already exists. You can't rename $sComputer to $sNewName
7 - Computer could not be renamed. See @extended for the COM error code.

Remarks

This function allows to join the computer the script is running on or any other computer to be joined to a domain.
The domain the computer is joined to is the domain the user logged on to by using AD_Open.
If no credentials are passed to this function but have been used with _AD_Open() then the _AD_Open credentials will be used.
Using default credentials of the user running the script is only sensible when you are logged on to the domain and try to join another computer.
You have to make sure to use a valid $iFlag. The function does not check it. Most used are 1 (join) and 3 (create computer account and join).
You have to reboot the computer after a successful join to the domain.
The JoinDomainOrWorkgroup method is available only on Windows XP computer and Windows Server 2003 or later.

Related

_AD_CreateComputer

See Also

http://technet.microsoft.com/en-us/library/ee692588.aspx, http://msdn.microsoft.com/en-us/library/aa392154(VS.85).aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Joins a computer to the domain - the computer account has to be created
; in advance using _AD_CreateComputer.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script joins a computer to the domain." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter the computer to join
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 156)
GUICtrlCreateLabel("Computer to join (NetBIOSName):", 8, 10, 231, 17)
Global $IComputer = GUICtrlCreateInput("", 241, 8, 459, 21)
Global $BOK = GUICtrlCreateButton("Join Computer", 8, 114, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 114, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sComputer = GUICtrlRead($IComputer)
ExitLoop
EndSwitch
WEnd

; Join the computer to the domain
Global $iValue = _AD_JoinDomain($sComputer)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Computer '" & $sComputer & "' successfully joined. Please reboot the computer")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Computer account for '" & $sComputer & "' does not exist in the domain")
ElseIf @error = 3 Then
MsgBox(64, "Active Directory Functions - Example 1", "WMI object could not be created. @extended=" & @extended)
ElseIf @error = 4 Then
MsgBox(64, "Active Directory Functions - Example 1", "Computer '" & $sComputer & "' is already a member of the domain")
ElseIf @error = 5 Then
MsgBox(64, "Active Directory Functions - Example 1", "Joining computer '" & $sComputer & "' to the domain was not successful. @extended=" & @extended)
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_ListDomainControllers

Function Reference

_AD_ListDomainControllers

Enumerates all Domain Controllers (returns information about: Domain Controller, site, subnet and Global Catalog).

#Include <AD.au3>
_AD_ListDomainControllers([$bListRO = False[, $bListGC = False]])

Parameters

$bListRO | [optional] If set to True only returns RODC (read only domain controllers) (default = False)
$bListGC | [optional] If set to True queries the DC for a Global Catalog. Disabled for performance reasons (default = False)

Return Value

Success: One-based two dimensional array with the following information:
0 - Domain Controller: Name
1 - Domain Controller: Distinguished Name (FQDN)
2 - Domain Controller: DNS host name
3 - Site: Name
4 - Site: Distinguished Name (FQDN)
5 - Site: List of subnets that can connect to the site using this DC in the format x.x.x.x/mask - multiple subnets are separated by comma
6 - Global Catalog: Set to True if the DC is a Global Catalog (only if flag $bListGC = True. If False then "" is returned)
Failure: "", sets @error to:
1 - No Domain Controllers found. @extended is set to the error returned by LDAP

Remarks

This function only lists writeable DCs (default). To list RODC (read only DCs) use parameter $bListRO

Related

See Also

http://www.rlmueller.net/Enumerate%20DCs.htm

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1
; Get a list of all Domain Controllers in the Active Directory
; *****************************************************************************
Global $aDC = _AD_ListDomainControllers()
_ArrayDisplay($aDC, "Active Directory Functions - Example 1 - All Domain Controllers, distinguished name, DNS host name, and the site name")

; *****************************************************************************
; Example 2
; Get a list of all Sites Names
; *****************************************************************************
_ArraySort($aDC, 0, 1, 0, 3)
Global $aSite = _ArrayUnique($aDC, 4, 1)
_ArrayDisplay($aSite, "Active Directory Functions - Example 2 - All Site Names")

; *****************************************************************************
; Example 3
; Get a list of all Read Only Domain Controllers in the Active Directory
; *****************************************************************************
$aDC = _AD_ListDomainControllers(True)
If @error <> 0 Then
MsgBox(16, "Active Directory Functions - Example 3 - All Read Only Domain Controllers", "No RODCs found!")
Else
_ArrayDisplay($aDC, "Active Directory Functions - Example 3 - All Read Only Domain Controllers, distinguished name, DNS host name, and the site name")
EndIf

; *****************************************************************************
; Example 4
; Get a list of all Domain Controllers inlcuding Global Catalogs
; *****************************************************************************
$aDC = _AD_ListDomainControllers(False, True)
If @error <> 0 Then
MsgBox(16, "Active Directory Functions - Example 4 - All Domain Controllers including Global Catalogs", "No DCs found!")
Else
_ArrayDisplay($aDC, "Active Directory Functions - Example 4 - All Domain Controllers, distinguished name, DNS host name, and the site name")
EndIf


Function _AD_ListPrintQueues

Function Reference

_AD_ListPrintQueues

Enumerates all PrintQueues in the AD tree, the specified spool server or OU.

#Include <AD.au3>
_AD_ListPrintQueues([$sServername="*"[, $sOU = ""[, $iSearchScope = 2, [$sPrintQueues="*"]]])

Parameters

$sServername | [optional] Short name of the spool server to process. LDAP wildcards apply (default = "*", equals "search all servers")
$sOU | [optional] The OU to retrieve from (FQDN) (default = "", equals "search the whole AD tree")
$iSearchScope | [optional] 0 = base, 1 = one-level, 2 = sub-tree (default)
$sPrintQueues | [optional] Short name of the printqueues to search for. LDAP wildcards apply (default = "*", equals "search all print queues")

Return Value

Success: One-based two dimensional array with the following information:
0 - PrinterName: Short name of the PrintQueue
1 - ServerName: SpoolServerName.Domain
2 - DistinguishedName: FQDN of the PrintQueue
Failure: "", @error set
1 - There is no PrintQueue available. @extended is set to the error returned by LDAP
2 - Specified OU does not exist

Remarks

To get more (including multi-valued) attributes of a printqueue use _AD_GetObjectProperties

Related

See Also

http://msdn.microsoft.com/en-us/library/aa706091(VS.85).aspx, http://www.activxperts.com/activmonitor/windowsmanagement/scripts/printing/printerport/#LAPP.htm

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1
; Get a list of all PrintQueues in the AD tree
; *****************************************************************************
Global $aPrintQueues = _AD_ListPrintQueues()
If @error > 0 Then
MsgBox(16, "Active Directory Functions", "Could not find any print queues!")
Exit
Else
_ArrayDisplay($aPrintQueues, "AD - Example 1 - All print queues")
EndIf

; *****************************************************************************
; Example 2
; Get a list of all PrintQueues for a specified spool server
; *****************************************************************************
Global $sSpoolServer = StringSplit($aPrintQueues[1][1], ".")
$aPrintQueues = _AD_ListPrintQueues($sSpoolServer[1])
If @error > 0 Then
MsgBox(16, "Active Directory Functions", "Could not find any print queues for server '" & $sSpoolServer[1] & "'")
Exit
Else
_ArrayDisplay($aPrintQueues, "Active Directory Functions - Example 2 - All print queues for spool server '" & $sSpoolServer[1] & "'")
EndIf

; *****************************************************************************
; Example 3
; List all properties for the first print queue
; *****************************************************************************
Global $aPrinterDetails = _AD_GetObjectProperties($aPrintQueues[1][2])
_ArrayDisplay($aPrinterDetails, "Active Directory Functions - Example 3 - All properties for print queue '" & $aPrintQueues[1][2] & "'")


Function _AD_ListRoleOwners

Function Reference

_AD_ListRoleOwners

Returns a one-based array of FSMO (Flexible Single Master Operation) Role Owners.

#Include <AD.au3>
_AD_ListRoleOwners()

Parameters

None.

Return Value

Success: Returns an one-based one dimensional array of FSMO Role Owners. The array contains:
1 - Domain PDC FSMO
2 - Domain Rid FSMO
3 - Domain Infrastructure FSMO
4 - Forest-wide Schema FSMO
5 - Forest-wide Domain naming FSMO

Remarks

None.

Related

See Also

http://www.tools4net.de/doc/ad2.htm

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get a list of all FSMO Role Owners
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get a list of all FSMO Role Owners plus description
Global $aFSMO[6][2] = [[""],["Domains PDC Emulator"],["Domains RID (Relative-Identifierer) master"],["Domains Infrastructure master"],["Forest-wide Schema master"],["Forest-wide Domain naming master"]]
Global $aTemp = _AD_ListRoleOwners()
Global $iCount
For $iCount = 1 To $aTemp[0]
$aFSMO[$iCount][1] = $aTemp[$iCount]
Next
$aFSMO[0][0] = $aTemp[0]
_ArrayDisplay($aFSMO, "Active Directory Functions - Example 1"); , -1, 0, "<")


Function _AD_ListRootDSEAttributes

Function Reference

_AD_ListRootDSEAttributes

Returns a one-based array of the RootDSE Atributes.

#Include <AD.au3>
_AD_ListRootDSEAttributes()

Parameters

None.

Return Value

Success: Returns an one-based one dimensional array of the following RootDSE attributes. Multi-valued attributes are as multiple lines.
1 - configurationNamingContext: Specifies the distinguished name for the configuration container.
2 - currentTime: Specifies the current time set on this directory server in Coordinated Universal Time format.
3 - defaultNamingContext: Specifies the distinguished name of the domain that this directory server is a member.
4 - dnsHostName: Specifies the DNS address for this directory server.
5 - domainControllerFunctionality: Specifies the functional level of this domain controller. Values can be:
0: Windows 2000 Mode
2: Windows Server 2003 Mode
3: Windows Server 2008 Mode
4: Windows Server 2008 R2 Mode
5: Windows Server 2012 Mode
6: Windows Server 2012 R2 Mode
7: Windows Server 2016 Mode
6 - domainFunctionality: Specifies the functional level of the domain. Values can be:
0: Windows 2000 Domain Mode
1: Windows Server 2003 Interim Domain Mode
2: Windows Server 2003 Domain Mode
3: Windows Server 2008 Domain Mode
4: Windows Server 2008 R2 Domain Mode
5: Windows Server 2012 Domain Mode
6: Windows Server 2012 R2 Domain Mode
7: Windows Server 2016 Domain Mode
7 - dsServiceName: Specifies the distinguished name of the NTDS settings object for this directory server.
8 - forestFunctionality: Specifies the functional level of the forest. Values can be:
0: Windows 2000 Forest Mode
1: Windows Server 2003 Interim Forest Mode
2: Windows Server 2003 Forest Mode
3: Windows Server 2008 Forest Mode
4: Windows Server 2008 R2 Forest Mode
5: Windows Server 2012 Forest Mode
6: Windows Server 2012 R2 Forest Mode
7: Windows Server 2016 Forest Mode
9 - highestCommittedUSN: Specifies the highest update sequence number (USN) on this directory server. Used by directory replication.
10 - isGlobalCatalogReady: Specifies Global Catalog operational status. Values can be either True or False.
11 - isSynchronized: Specifies directory server synchronisation status. Values can be either True or False.
12 - LDAPServiceName: Specifies the Service Principal Name (SPN) for the LDAP server. Used for mutual authentication.
13 - namingContexts: A multi-valued attribute that specifies the distinguished names for all naming contexts stored on this directory server. By default, a Windows 2000 domain controller has at least three naming contexts: Schema, Configuration, and the domain which the server is a member of.
14 - rootDomainNamingContext: Specifies the distinguished name for the first domain in the forest that this directory server is a member of.
15 - schemaNamingContext: Specifies the distinguished name for the schema container.
16 - serverName: Specifies the distinguished name of the server object for this directory server in the configuration container.
17 - subschemaSubentry: Specifies the distinguished name for the subSchema object. The subSchema object specifies properties that expose the supported attributes (in the attributeTypes property) and classes (in the objectClasses property).
18 - supportedCapabilities: multi-valued attribute that specifies the capabilities supported by this directory server.
19 - supportedControl: A multi-valued attribute that specifies the extension control OIDs supported by this directory server.
20 - supportedLDAPPolicies: A multi-valued attribute that specifies the names of the supported LDAP management policies.
21 - supportedLDAPVersion: A multi-valued attribute that specifies the LDAP versions (specified by major version number) supported by this directory server.
22 - supportedSASLMechanisms: Specifies the security mechanisms supported for SASL negotiation (see LDAP RFCs). By default, GSSAPI is supported.

Remarks

In LDAP 3.0, rootDSE is defined as the root of the directory data tree on a directory server.
The rootDSE is not part of any namespace. The purpose of the rootDSE is to provide data about the directory server.

Related

See Also

https://msdn.microsoft.com/en-us/library/cc223273.aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Get a list of all RootDSE attributes
; http://msdn.microsoft.com/en-us/library/cc223273.aspx
;
; domainControllerFunctionality: Specifies the functional level of this domain controller. Values can be:
; 0 - Windows 2000 Mode
; 2 - Windows Server 2003 Mode
; 3 - Windows Server 2008 Mode
; 4 - Windows Server 2008 R2 Mode
; 5 - Windows Server 2012 Mode
; 6 - Windows Server 2012 R2 Mode
; 7 - Windows Server 2016 Mode
; domainFunctionality: Specifies the functional level of the domain. Values can be:
; 0 - Windows 2000 Domain Mode
; 1 - Windows Server 2003 Interim Domain Mode
; 2 - Windows Server 2003 Domain Mode
; 3 - Windows Server 2008 Domain Mode
; 4 - Windows Server 2008 R2 Domain Mode
; 5 - Windows Server 2012 Domain Mode
; 6 - Windows Server 2012 R2 Domain Mode
; 7 - Windows Server 2016 Domain Mode
; forestFunctionality: Specifies the functional level of the forest. Values can be:
; 0 - Windows 2000 Forest Mode
; 1 - Windows Server 2003 Interim Forest Mode
; 2 - Windows Server 2003 Forest Mode
; 3 - Windows Server 2008 Forest Mode
; 4 - Windows Server 2008 R2 Forest Mode
; 5 - Windows Server 2012 Forest Mode
; 6 - Windows Server 2012 R2 Forest Mode
; 7 - Windows Server 2016 Forest Mode
; *****************************************************************************
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get a list of all RootDSE attributes
Global $aTemp = _AD_ListRootDSEAttributes()
_ArrayDisplay($aTemp, "Active Directory Functions - Example 1")


Function _AD_ListSchemaVersions

Function Reference

_AD_ListSchemaVersions

Returns information about the AD Schema versions.

#Include <AD.au3>
_AD_ListSchemaVersions()

Parameters

None.

Return Value

Success: Returns an one-based one dimensional array of the following Schema versions.
1 - Active Directory Schema version. This can be one of the following values:
13: Windows 2000 Server
30: Windows Server 2003 RTM / Service Pack 1 / Service Pack 2
31: Windows Server 2003 R2
44: Windows Server 2008 RTM
47: Windows Server 2008 R2
2 - Exchange Schema version. This can be one of the following values:
4397: Exchange Server 2000 RTM
4406: Exchange Server 2000 With Service Pack 3
6870: Exchange Server 2003 RTM
6936: Exchange Server 2003 With Service Pack 3
10628: Exchange Server 2007
11116: Exchange 2007 With Service Pack 1
14622: Exchange 2007 With Service Pack 2, Exchange 2010 RTM
14625: Exchange 2007 SP3
14720: Exchange 2010 SP1 (beta)
14726: Exchange 2010 SP1
3 - Exchange 2000 Active Directory Connector version. This can be one of the following values:
4197: Exchange Server 2000 RTM
4 - Office Communications Server Schema version. This can be one of the following values:
1006: LCS 2005 SP1
1007: OCS 2007
1008: OCS 2007 R2
1100: Lync Server 2010

Remarks

RTM stands for "Release to Manufacturing"

Related

See Also

http://blog.dikmenoglu.de/Die+AD+Und+Exchange+Schemaversion+Abfragen.aspx, http://www.msxfaq.de/admin/build.htm

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Returns information about the AD Schema versions
; *****************************************************************************
#include <AD.au3>

Global $aSchema_AD[5][2] = [[13, "Windows 2000 Server"],[30, "Windows Server 2003 RTM / Service Pack 1 / Service Pack 2"],[31, "Windows Server 2003 R2"], _
[44, "Windows Server 2008 RTM"],[47, "Windows Server 2008 R2"]]
Global $aSchema_Ex[10][2] = [[4397, "Exchange Server 2000 RTM"],[4406, "Exchange Server 2000 With Service Pack 3"],[6870, "Exchange Server 2003 RTM"], _
[6936, "Exchange Server 2003 With Service Pack 3"],[10628, "Exchange Server 2007"],[11116, "Exchange 2007 With Service Pack 1"], _
[14622, "Exchange 2007 With Service Pack 2, Exchange 2010 RTM"],[14625, "Exchange 2007 SP3"],[14720, "Exchange 2010 SP1 (beta)"], _
[14726, "Exchange 2010 SP1"]]
Global $aSchema_ExAD[1][2] = [[4197, "Exchange Server 2000 RTM"]]
Global $aSchema_OCS[4][2] = [[1006, "LCS 2005 SP1"],[1007, "OCS 2007"],[1008, "OCS 2007 R2"],[1100, "Lync Server 2010"]]

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; Get a list of versions for the Schemas and Schema extensions in the AD
Global $aSchemaVersion[5][3] = [[""],["Active Directory Schema version"],["Exchange Schema version"],["Exchange 2000 Active Directory Connector version"],["Office Communications Server Schema version"]]
Global $aTemp = _AD_ListSchemaVersions()
Global $iCount
For $iCount = 1 To $aTemp[0]
$aSchemaVersion[$iCount][1] = $aTemp[$iCount]
Next
$aSchemaVersion[0][0] = $aTemp[0]

; AD Schema - add description
For $iCount = 0 To UBound($aSchema_AD, 1) - 1
If $aSchema_AD[$iCount][0] = $aSchemaVersion[1][1] Then $aSchemaVersion[1][2] = $aSchema_AD[$iCount][1]
Next
; Exchange Schema - add description
For $iCount = 0 To UBound($aSchema_Ex, 1) - 1
If $aSchema_Ex[$iCount][0] = $aSchemaVersion[2][1] Then $aSchemaVersion[2][2] = $aSchema_Ex[$iCount][1]
Next
; Exchange 2000 Active Directory Connector - add description
For $iCount = 0 To UBound($aSchema_ExAD, 1) - 1
If $aSchema_ExAD[$iCount][0] = $aSchemaVersion[3][1] Then $aSchemaVersion[3][2] = $aSchema_ExAD[$iCount][1]
Next
; Office Communications Server Schema - add description
For $iCount = 0 To UBound($aSchema_OCS, 1) - 1
If $aSchema_OCS[$iCount][0] = $aSchemaVersion[4][1] Then $aSchemaVersion[4][2] = $aSchema_OCS[$iCount][1]
Next

_ArrayDisplay($aSchemaVersion, "Active Directory Functions - Example 1", -1, 0, "<")


Function _AD_ObjectExistsInSchema

Function Reference

_AD_ObjectExistsInSchema

Returns 1 if exactly one object exists for the given property in the Active Directory Schema.

#Include <AD.au3>
_AD_ObjectExistsInSchema($sObject [, $sProperty = "LDAPDisplayName"])

Parameters

$sObject | [optional] Object to check
$sProperty | [optional] Property to check (default = LDAPDisplayName)

Return Value

Success: 1, Exactly one object exists for the given property in the Active Directory Schema
Failure: 0, sets @error to:
1 - No object found for the specified property
x - More than one object found for the specified property. x is the number of objects found

Remarks

None.

Related

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1 - Process the Windows Schema.
; Check a property that is part of the Windows Schema and exists for every user.
; *****************************************************************************
Global $sProperty = "displayname"
If _AD_ObjectExistsInSchema($sProperty) Then
MsgBox(64, "Active Directory Functions", "Property '" & $sProperty & "' does exist in the Windows AD Schema")
Else
MsgBox(64, "Active Directory Functions", "Property '" & $sProperty & "' does not exist in the Windows AD Schema")
EndIf

; *****************************************************************************
; Example 2 - Process the Exchange Schema.
; Check a property that is part of the Exchange Schema and exists for every user.
; *****************************************************************************
$sProperty = "mailNickname"
If _AD_ObjectExistsInSchema($sProperty) Then
MsgBox(64, "Active Directory Functions", "Property '" & $sProperty & "' does exist in the Exchange AD Schema")
Else
MsgBox(64, "Active Directory Functions", "Property '" & $sProperty & "' does not exist in the Exchange AD Schema")
EndIf

; *****************************************************************************
; Example 3 - Query a non existent property.
; *****************************************************************************
$sProperty = "non-existing-property"
If _AD_ObjectExistsInSchema($sProperty) Then
MsgBox(64, "Active Directory Functions", "Property '" & $sProperty & "' does exist in the AD Schema")
Else
MsgBox(64, "Active Directory Functions", "Property '" & $sProperty & "' does not exist in the AD Schema")
EndIf


Function _AD_SetADOProperties

Function Reference

_AD_SetADOProperties

Sets properties of an ADO command object.

#Include <AD.au3>
_AD_SetADOProperties($sP1 = ""[, $sP2 = ""[, $sP3 = ""[, $sP4 = ""[, $sP5 = ""[, $sP6 = ""[, $sP7 = ""[, $sP8 = ""[, $sP9 = ""[, $sP10 = ""]]]]]]]]])

Parameters

$sP1 | Property to set. This can be a string with the format propertyname=value OR a zero based one-dimensional array with unlimited number of strings in the format propertyname=value
$sP2 | [optional] Same as $sP1 but no array is allowed
$sP3 | [optional] Same as $sP2
$sP4 | [optional] Same as $sP2
$sP5 | [optional] Same as $sP2
$sP6 | [optional] Same as $sP2
$sP7 | [optional] Same as $sP2
$sP8 | [optional] Same as $sP2
$sP9 | [optional] Same as $sP2
$sP10 | [optional] Same as $sP2

Return Value

Success: 1
Failure: 0, sets @error to:
1 - Invalid format of the parameter. Has to be propertyname=value. @extended = number of the invalid parameter (zero based)
x - Error setting the specified property. @extended = number of the invalid parameter (zero based)

Remarks

You can query the properties of the ADO connection and command object but you can only set the properties of the command object.
+After the connection is opened by _AD_Open the properties of the connection object are read only.

Related

See Also

ADO Command: http://msdn.microsoft.com/en-us/library/ms675022(v=VS.85).aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1
; Set a single property of the ADO Command Object
; *****************************************************************************
Global $aResult = _AD_SetADOProperties("Page Size = 200")
If @error <> 0 Then
MsgBox(16, "Active Directory Functions - Example 1", "Error setting properties of the ADO command object. @error = " & @error & ", @extended = " & @extended)
Else
$aResult = _AD_GetADOProperties("Com", "Page Size")
_ArrayDisplay($aResult, "ADO Command Object")
EndIf


Function _AD_UnJoinDomain

Function Reference

_AD_UnJoinDomain

Unjoins the computer from its current domain and disables the computer account.

#Include <AD.au3>
_AD_UnJoinDomain([$sComputer = @ComputerName[, $sWorkgroup = ""[,$sUserParam, = "", $sPasswordParam = ""]]])

Parameters

$sComputer | [optional] Computername to unjoin from the domain (Default = @ComputerName)
$sWorkgroup | [optional] Workgroup the unjoined computer is assigned to (Default = Workgroup named like the domain the computer was unjoined from)
$sUserParam | [optional] Domain user with admin rights to unjoin the computer from the domain. Supported are NetBIOSName (domain\user), user principal name (user@domain) or Windows login name (user). (Default = credentials from _AD_Open or - if not used - of the user running the script)
$sPasswordParam | [optional] Password for $sUserParam (Default = credentials from _AD_Open or - if not used - of the user running the script)

Return Value

Success: 1
Failure: 0, @error set
1 - $sComputer account does not exist in the domain
2 - $sUserParam does not exist in the domain
3 - WMI object could not be created. See @extended for the COM error code. See remarks for further information
4 - The computer is a member of another or no domain
5 - Unjoining the domain was not successful. See @extended for the COM error code. See remarks for further information
6 - Joining the Computer to the specified workgroup was not successful. See @extended for the COM error code

Remarks

This function allows to unjoin the computer the script is running on or any other computer from a domain.
The domain the computer is unjoined from is the domain the user logged on to by using AD_Open.
If no credentials are passed to this function but have been used with _AD_Open() then the _AD_Open credentials will be used.
If no workgroup is specified then the computer is assigned to a workgroup named like the domain the computer was unjoined from.
You have to reboot the computer after a successful unjoin from the domain.
The JoinDomainOrWorkgroup method is available only on Windows XP computer and Windows Server 2003 or later.

Related

See Also

http://gallery.technet.microsoft.com/ScriptCenter/en-us/c2025ace-cb51-4136-9de9-db8871f79f62, http://technet.microsoft.com/en-us/library/ee692588.aspx, http://msdn.microsoft.com/en-us/library/aa393942(VS.85).aspx

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#RequireAdmin
; *****************************************************************************
; Example 1
; Unjoins a computer from the domain.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

Global $iReply = MsgBox(308, "Active Directory Functions - Example 1", "This script unjoins a computer from the domain and joins it to a workgroup." & @CRLF & @CRLF & _
"Are you sure you want to change the Active Directory?")
If $iReply <> 6 Then Exit

; Enter the computer to unjoin
#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Active Directory Functions - Example 1", 714, 156)
GUICtrlCreateLabel("Computer to unjoin (NetBIOSName):", 8, 10, 231, 17)
Global $IComputer = GUICtrlCreateInput("", 241, 8, 459, 21)
GUICtrlCreateLabel("Workgroup to join the computer:", 8, 42, 231, 17)
Global $IWorkgroup = GUICtrlCreateInput("", 241, 40, 459, 21)
Global $BOK = GUICtrlCreateButton("Unjoin Computer", 8, 114, 121, 33)
Global $BCancel = GUICtrlCreateButton("Cancel", 628, 114, 73, 33, BitOR($GUI_SS_DEFAULT_BUTTON, $BS_DEFPUSHBUTTON))
GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
Global $nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE, $BCancel
Exit
Case $BOK
Global $sComputer = GUICtrlRead($IComputer)
Global $sWorkgroup = GUICtrlRead($IWorkgroup)
ExitLoop
EndSwitch
WEnd

; Unjoin the computer from the domain
Global $iValue = _AD_UnjoinDomain($sComputer, $sWorkgroup)
If $iValue = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Computer '" & $sComputer & "' successfully unjoined. Please reboot the computer")
ElseIf @error = 1 Then
MsgBox(64, "Active Directory Functions - Example 1", "Computer account for '" & $sComputer & "' does not exist in the domain")
ElseIf @error = 3 Then
MsgBox(64, "Active Directory Functions - Example 1", "WMI object could not be created. @extended=" & @extended)
ElseIf @error = 4 Then
MsgBox(64, "Active Directory Functions - Example 1", "Computer '" & $sComputer & "' is a member of another or no domain")
ElseIf @error = 5 Then
MsgBox(64, "Active Directory Functions - Example 1", "Unjoining computer '" & $sComputer & "' from the domain was not successful. @extended=" & @extended)
ElseIf @error = 6 Then
MsgBox(64, "Active Directory Functions - Example 1", "Joining the Computer '" & $sComputer & "' to workgroup '" & $sWorkgroup & "' was not successful. @extended=" & @extended)
Else
MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")
EndIf


Function _AD_FixSpecialChars

Function Reference

_AD_FixSpecialChars

Escapes or unescapes special characters in Distinguished Names or LDAP filters.

#Include <AD.au3>
_AD_FixSpecialChars($sText[, $iOption = 0[, $sEscapeChar = '"\/#,+<>;=']])

Parameters

$sText | Text to add / remove escape characters
$iOption | [optional] Defines whether to escape (Default) or unescape special characters for DN or LDAP filters. Can be one of the following: 0 = Escape special characters in a Distinguished Name (default) 1 = Unescape special characters in a Distinguished Name 3 = Escape special characters in a LDAP filter
$sEscapeChar | [optional] List of characters to escape or unescape in a DN (default = '"\/#,+<>;=')

Return Value

None.

Remarks

Leading or trailing spaces have to be escaped by the user.
$sEscapeChar is ignored when $iOption = 3.

Related

See Also

http://www.rlmueller.net/CharactersEscaped.htm

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>
Global $sString
Global $sEscapedString, $sUnEscapedString

; *****************************************************************************
; Example 1
; Escape all special characters from a string
; *****************************************************************************
$sString = "Firstname, Lastname (Alias=xxx) (Department/Team)"
$sEscapedString = _AD_FixSpecialChars($sString)
MsgBox(16, "Active Directory Functions - Example 1", "Unescaped string: " & $sString & @CRLF & "Escaped string: " & $sEscapedString)

; *****************************************************************************
; Example 2
; Escape only some characters from a string
; *****************************************************************************
$sString = "Firstname, Lastname (Alias=xxx) (Department/Team)"
$sEscapedString = _AD_FixSpecialChars($sString, 0, ",/")
MsgBox(16, "Active Directory Functions - Example 2", "Unescaped string: " & $sString & @CRLF & "Escaped string: " & $sEscapedString)

; *****************************************************************************
; Example 3
; UnEscape all special characters from a string
; *****************************************************************************
$sString = "Firstname\, Lastname (Alias\=xxx) (Department\/Team)"
$sUnEscapedString = _AD_FixSpecialChars($sString, 1)
MsgBox(16, "Active Directory Functions - Example 3", "Escaped string: " & $sString & @CRLF & "UnEscaped string: " & $sUnEscapedString)

; *****************************************************************************
; Example 4
; UnEscape only some characters from a string
; *****************************************************************************
$sString = "Firstname\, Lastname (Alias\=xxx) (Department\/Team)"
$sUnEscapedString = _AD_FixSpecialChars($sString, 1, ",/")
MsgBox(16, "Active Directory Functions - Example 4", "Escaped string: " & $sString & @CRLF & "UnEscaped string: " & $sUnEscapedString)


Function _AD_FQDNToDisplayname

Function Reference

_AD_FQDNToDisplayname

Returns the Display Name of a Fully Qualified Domain Name (FQDN) object.

#Include <AD.au3>
_AD_FQDNToDisplayname($sFQDN)

Parameters

$sFQDN Fully Qualified Domain Name (FQDN)

Return Value

Success: Display Name
Failure: "", sets @error to:
x - @error as set by function _AD_GetObjectAttribute

Remarks

You must escape commas in $sFQDN with a backslash. E.g. "CN=Lastname\, Firstname,OU=..."
All other special characters (# and /) are escaped by the function.
The function removes all escape characters (\) from the returned value.

Related

_AD_FQDNToSamAccountName

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1 - Process the current user.
; Get the FQDN from the SamAccountname. Then get the displayname from the FQDN.
; *****************************************************************************
; Get the Fully Qualified Domain Name (FQDN) for the current User
Global $sFQDN = _AD_SamAccountNameToFQDN()

; Get the Display Name for the current User
Global $sDisplayName = _AD_FQDNToDisplayname($sFQDN)
Switch @error
Case 0
MsgBox(64, "Active Directory Functions - Example 1", _
"The Fully Qualified Domain Name (FQDN) for the currently logged on user is: " & @CRLF & $sFQDN & @CRLF & @CRLF & _
"The Display Name for the currently logged on user is: " & @CRLF & $sDisplayName)
Case 1
MsgBox(48, "Active Directory Functions - Example 1", _
"Object: " & @CRLF & $sFQDN & @CRLF & @CRLF & "could not be found!" & @CRLF & @CRLF & _
"Error / Extended Error: " & @error & " / " & @extended)
Case 2
MsgBox(48, "Active Directory Functions - Example 1", _
"Object: " & @CRLF & $sFQDN & @CRLF & @CRLF & "has no property 'displayname'." & @CRLF & @CRLF & _
"Error / Extended Error: " & @error & " / " & @extended)
Case Else
MsgBox(48, "Active Directory Functions - Example 1", _
"Unknown error returned for object: " & @CRLF & $sFQDN & @CRLF & @CRLF & _
"Error / Extended Error: " & @error & " / " & @extended)
EndSwitch

; *****************************************************************************
; Example 2 - Process the computer running the script.
; Get the FQDN from the SamAccountname. Then get the displayname from the FQDN.
; *****************************************************************************
; Get the Fully Qualified Domain Name (FQDN) for the computer running this script
; A $ sign has to be appended to the computer name to create a correct sAMAccountName
$sFQDN = _AD_SamAccountNameToFQDN(@ComputerName & "$")

; Get the Display Name for the computer running this script
$sDisplayName = _AD_FQDNToDisplayname($sFQDN)
Switch @error
Case 0
MsgBox(64, "Active Directory Functions - Example 1", _
"The Fully Qualified Domain Name (FQDN) for the currently logged on user is: " & @CRLF & $sFQDN & @CRLF & @CRLF & _
"The Display Name for the currently logged on user is: " & @CRLF & $sDisplayName)
Case 1
MsgBox(48, "Active Directory Functions - Example 1", _
"Object: " & @CRLF & $sFQDN & @CRLF & @CRLF & "could not be found!" & @CRLF & @CRLF & _
"Error / Extended Error: " & @error & " / " & @extended)
Case 2
MsgBox(48, "Active Directory Functions - Example 1", _
"Object: " & @CRLF & $sFQDN & @CRLF & @CRLF & "has no property 'displayname'." & @CRLF & @CRLF & _
"Error / Extended Error: " & @error & " / " & @extended)
Case Else
MsgBox(48, "Active Directory Functions - Example 1", _
"Unknown error returned for object: " & @CRLF & $sFQDN & @CRLF & @CRLF & _
"Error / Extended Error: " & @error & " / " & @extended)
EndSwitch


Function _AD_FQDNToSamAccountName

Function Reference

_AD_FQDNToSamAccountName

Returns the SamAccountName of a Fully Qualified Domain Name (FQDN).

#Include <AD.au3>
_AD_FQDNToSamAccountName($sFQDN)

Parameters

$sFQDN Fully Qualified Domain Name (FQDN)

Return Value

Success: SamAccountName
Failure: "", sets @error to:
1 - No record returned from Active Directory. $sFQDN not found

Remarks

You have to escape commas in $sFQDN with a backslash. E.g. "CN=Lastname\, Firstname,OU=..."
All other special characters (# and /) are escaped by the function.
If $sFQDN is already a SamAccountName then the function returns $sFQDN unchanged and without raising an error.

Related

_AD_SamAccountNameToFQDN, _AD_FQDNToDisplayname

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; ********************************************************************************
; Example 1 - Process the current user.
; Get the FQDN from the SamAccountname. Then get the SamAccountName from the FQDN.
; ********************************************************************************
; Get the Fully Qualified Domain Name (FQDN) for the current User
Global $sFQDN = _AD_SamAccountNameToFQDN()

; Get the sAMAccountName from the Fully Qualified Domain Name (FQDN) for the current User
Global $sSamAccountName = _AD_FQDNToSamAccountName($sFQDN)

MsgBox(64, "Active Directory Functions - Example 1", "The Fully Qualified Domain Name (FQDN) for the currently logged on user is: " & @CRLF & $sFQDN & @CRLF & @CRLF & _
"The Security Accounts Manager (SAM) Account Name (SamAccountName) for the current logged on user is: " & @CRLF & $sSamAccountName)

; ********************************************************************************
; Example 2 - Process the computer running the script.
; Get the FQDN from the SamAccountname. Then get the SamAccountName from the FQDN.
; ********************************************************************************
; Get the Fully Qualified Domain Name (FQDN) for the computer running the script
$sFQDN = _AD_SamAccountNameToFQDN(@ComputerName & "$")

; Get the sAMAccountName from the Fully Qualified Domain Name (FQDN) for the computer running the script
$sSamAccountName = _AD_FQDNToSamAccountName($sFQDN)

MsgBox(64, "Active Directory Functions - Example 2", "The Fully Qualified Domain Name (FQDN) for this computer is: " & @CRLF & $sFQDN & @CRLF & @CRLF & _
"The Security Accounts Manager (SAM) Account Name (SamAccountName) for this computer is: " & @CRLF & $sSamAccountName)


Function _AD_SamAccountNameToFQDN

Function Reference

_AD_SamAccountNameToFQDN

Returns a Fully Qualified Domain Name (FQDN) from a SamAccountName.

#Include <AD.au3>
_AD_SamAccountNameToFQDN([$sSamAccountName = @UserName])

Parameters

$sSamAccountName [optional] Security Accounts Manager (SAM) account name (default = @UserName)

Return Value

Success: Fully Qualified Domain Name (FQDN)
Failure: "", sets @error to:
1 - No record returned from Active Directory. $sSamAccountName not found

Remarks

A $ sign must be appended to the computer name to generate the FQDN for a sAMAccountName e.g. @ComputerName & "$".
The function escapes the following special characters (# and /). Commas in CN= or OU= have to be escaped by you.
If $sSamAccountName is already a FQDN then the function returns $sSamAccountName unchanged and without raising an error.

Related

_AD_FQDNToSamAccountName

Example

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
#include <AD.au3>

; Open Connection to the Active Directory
_AD_Open()
If @error Then Exit MsgBox(16, "Active Directory Example Skript", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

; *****************************************************************************
; Example 1
; Get the Fully Qualified Domain Name (FQDN) for the current User
; *****************************************************************************
Global $sFQDN = _AD_SamAccountNameToFQDN()
MsgBox(64, "Active Directory Functions - Example 1", "The Fully Qualified Domain Name (FQDN) for the currently logged on user is: " & @CRLF & $sFQDN)

; *****************************************************************************
; Example 2
; Get the Fully Qualified Domain Name (FQDN) for the computer running this script
; A $ sign has to be appended to the computer name to create a correct sAMAccountName
; *****************************************************************************
$sFQDN = _AD_SamAccountNameToFQDN(@ComputerName & "$")
MsgBox(64, "Active Directory Functions - Example 2", "The Fully Qualified Domain Name (FQDN) for this computer is: " & @CRLF & $sFQDN)