Active Directory UDF

[water]

Thanks a lot for this information!

I will try as soon as possbile!

[JLogan3o13]

I'm pretty sure I know the answer to this, but figured if there is a way to do it that I don't know about this is the thread to ask in. I have a customer that has a number of security groups they've added users to, and just realized they had no auditing turned on. With no audit trail, they are asking if there is a property on each user object, or on the security group itself, that would tell them when a user was added. I do not believe so; the only way I have ever done it is through auditing. But, I'm constantly amazed with what I can do with this UDF, so I thought I would throw it out there

[water]

Unfortunately the AD UDF can only retrieve data that is stored in the AD. No data, nothing to retrieve.

What you can retrieve is the "last changed" property of the group. But you can't tell what kind of change happened (adding a user, removing, setting some ther group property ...)

[JLogan3o13]

I figured as much. I will tell them they are S.O.L. but wanted to do my due diligence Thanks as always.

[water]

BTW in some earlier post I think you said you didn't have an AD system at home to test things on. I setup a VM running a Resara server, basically a Linux Ubuntu preconfigure with Samba 4 and an throttled down near clone of the AD we have have work. It took a little while to get everthing to play well together, but it's handy and works for me.

Hi lewisg,

just wanted to tell you that I have Resara up and running now and successfully connected a Windows 7 VM to the AD.

The AD example scripts run fine now (as far as I could test them)!

That will make testing of my AD scripts much easier!

Thanks a lot!

I hope I can now provide even better support for the AD!

[lewisg]

Hi lewisg,

just wanted to tell you that I have Resara up and running now and successfully connected a Windows 7 VM to the AD.

The AD example scripts run fine now (as far as I could test them)!

That will make testing of my AD scripts much easier!

Thanks a lot!

I hope I can now provide even better support for the AD!

With bugs crawling all over most my scripts I would be months getting proper working code without it. Glad it worked out.

[water]

Just another question:

In your first post you were talking about a "throttled down near clone of the AD we have at work". How did you create the clone and move it to Resara?

[lewisg]

Water

I created and populated it manually, really just the branches I figured I needed. Perhaps "throttled down near clone of the AD we have at work" was a little extravagant in it's description. Maybe there is a import or copy feature in Resara that I'm not aware off. I was just happy to have a trial AD at home to test scripts with. Sorry for the confustion.

[water]

Thanks for the reply.

I will do the same, add the subjects I need manually.

Again, thanks for pointing me to Resara!

[water]

@ltran

Still interested in creating a contact object in AD?

[willichan]

Very strange. I just tested with Windows 7 64 bit and this script works fine when compiled as 32 or 64 bit with Autoit 3.3.8.1 or 3.3.9.4.

What's different on your system?

Sorry for the late response. I have been out of commission for a while.

I am not sure what is different between your system and mine, but the script you provided returns the following debugging info and errors if I run it as 32 bit on any of my Win7 64 bit boxes.

COM Error Encountered in test.au3
AD UDF version = 1.3.0
@AutoItVersion = 3.3.9.4
@AutoItX64 = 0
@Compiled = 0
@OSArch = X64
@OSVersion = WIN_7
Scriptline = 257
NumberHex = 80040154
Number = -2147221164
WinDescription = Class not registered
Description =
Source =
HelpFile =
HelpContext = 0
LastDllError = 126

Error: in_AD_Open: 2--2147221164

COM Error Encountered in test.au3
AD UDF version = 1.3.0
@AutoItVersion = 3.3.9.4
@AutoItX64 = 0
@Compiled = 0
@OSArch = X64
@OSVersion = WIN_7
Scriptline = 540
NumberHex = 000000A9
Number = 169
WinDescription = Variable must be of type 'Object'.
Description =
Source =
HelpFile =
HelpContext = 0
LastDllError = 0

Line 541 (File "c:\Au3Includes\AD.au3"):
Local $oAD_RecordSet = $__oAD_Command.Execute
Local $oAD_RecordSet = $__oAD_Command^ ERROR
Error: Variable must be of type "Object".

As a workaround, I am compiling both 32 bit and 64 bit versions, and including the following code at the top of the script.

Global Const $MyName = StringLeft(@ScriptName, StringInStr(@ScriptName, ".", 0, -1) - 1) ;get just the name portion of the script/exe name
If (StringUpper(@OSArch) <> "X86") And (@AutoItX64 <> 1) Then
;not 32-bit OS - Run 64 bit version
If FileExists(@ScriptDir & "\" & $MyName & "64.exe") Then Run(@ScriptDir & "\" & $MyName & "64.exe " & $CmdLineRaw)
Exit
EndIf

[water]

Looks still very strange to me because I can run 32 and 64 bit programs without problems on my 64 bit box.

But it looks like you've found a solution that works for you.

[Ivo]

Hi.

Great udf. I uses it a lot!!!!

I am unable to retrieve the profile path of a user.

I do it like this:

$UserProf = _AD_GetObjectAttribute(@UserName, "profilePath")

other attributes I am able to retrieve like: maIl.

Br. Ivo

[water]

What's the value of @error after the function call?

[Ivo]

HI Water

The return value of @error = 2

[water]

This means: $sAD_Attribute does not exist for $sAD_Object. @Extended is set to the error returned by LDAP

Run the _AD_GetobjectProperties.au3 example script. The first example displays all properties of the current user. Does he have the property "profilePatch" set?

[Ivo]

Thanks, you solved it.

My test user didn’t have a profile path set.

I expected to get an empty string back when there is no profile set.

Wrong thinking

Thanks for your help!

[water]

You get an empty string ("") back plus @error set to 2.

Glad the problem could be solved

[Biggs]

Howdy all, I am very new at Autoit and know nothing about AD, but have the task of writing an Autoit script to add files to a directory based on the persons User ID, easy except they have to exist in AD prior to adding the file. Again I know zero about AD. I know only the domain name, that they are users, and the users name. Can you tell me which of your ad examples to use and how to do it? All i need from AD is a exists or not.

[water]

If you use my AD UDF (for download please check my signature) a script to check for existance of a user would look like:

#include <AD.au3>
_AD_Open()
$iResult = _AD_ObjectExists($username)
If $iResult = 1 Then
     ; User exists, copy your files
Endif