Active Directory UDF

[water]

Looks like it isn't easy to modify the AD UDF but the web seems to offer a few solutions to do it by using Powershell,.

Example.

[ptrex]

@Water,

Yes PS is taking over control

 

ptrex

[water]

I know. But the combination of PS and AutoIt is even better

[ptrex]

@Water

Completely agree !

That's why I am still surprised that the Developers did not yet make any move towards that for AU3    

Both have their strong domains where as AU3 is much more efficient in GUI's and Windows API's.

While PS and .NET have a rich toolset for a lot of stuff that AU3 does not have.

So I am riding 2 horses since a few years 

Edited January 21, 2015 by ptrex

[jp10558]

You mean you want to extend the AD structure to support NIS?

 

I've been away a bit, but in Server 2008R2, if you have a Server 2008R2 forest, using ADSI Edit, you can create a NISobject and NISMap object without extending the schema. I just want to script calling that ADSI GUI creation, like the create user function if possible. 

[water]

Unfortunately I have never used NISobject or NISMap.

But maybe you could use function _AD_CreateOU as a template to create the needed function.

[SpinningCone]

I apologize if this has been addressed already but I wasn't able to find anything specific.

I'm having trouble with using the UDF to delete objects. I run a cleanup process in autoit that deletes unneeded users which was working fine until we made the migration to Exchange 2013. seems in 2013 Exchange is using the user object as a container for activesync items (like iphones and stuff). This causes the script to fail without error (returns sucess even though the object isn't deleted) .

When I go into ADUC to manually delete the user a warning about it containing other objects and unless you check the "Use Delete Subtree server control" it won't delete.

is there a way the UDF can be modified to envoke this subtree delete?.  I didnt see it addressed in the change log. I'd just use powershell but envoking PS from autoit is pretty clunky.

 

[water]

At the moment the UDF only deletes the specified object.

But IIRC there has been a discussion about this long time ago. I will check how we solved the problem then.

[water]

Has been discussed >here.

[water]

I have never tried it and can't test at the moment.
Could you please run:

Global $sUser = "Name of the user you want to delete"
$aResult = _AD_GetObjectsInOU($sUser)
If @error Then
    MsgBox(0, "Error", "Error " & @error & " occurred!")
Else
    _ArrayDisplay($aResult)
Endif

If it works we should get a list of objects in the users container.

[SpinningCone]

I have never tried it and can't test at the moment.

Could you please run:

Global $sUser = "Name of the user you want to delete"
$aResult = _AD_GetObjectsInOU($sUser)
If @error Then
    MsgBox(0, "Error", "Error " & @error & " occurred!")
Else
    _ArrayDisplay($aResult)
Endif

If it works we should get a list of objects in the users container.

 

Sorry for the delay, tried your code. was getting an error but wasn't putting the FQDN.  It returns an array with 6 elements. Count, the object name, and 4 blank fields.

So it sees something but won't dispaly what they are.

[water]

Do you see 6 rows or 6 columns? Maybe you could post a screenshot?

[SpinningCone]

Do you see 6 rows or 6 columns? Maybe you could post a screenshot?

 

6 rows '>(username redacted)

If I view users as containers in ADUC I can see to active sync device folders ('>) and each has the same named object under them ('>)

[water]

Fine. There seem to be 5 objects assigned to the user.
If we expand the query we should get all relevant information to delete the "sub"-objects, right?

Global $sUser = "Name of the user you want to delete" 
$aResult = _AD_GetObjectsInOU($sUser, "(distinguishedname=*)", 2, "distinguishedname") 
If @error Then 
    MsgBox(0, "Error", "Error " & @error & " occurred!") 
Else 
    _ArrayDisplay($aResult) 
Endif

[SpinningCone]

 

Fine. There seem to be 5 objects assigned to the user.

If we expand the query we should get all relevant information to delete the "sub"-objects, right?

Global $sUser = "Name of the user you want to delete" 
$aResult = _AD_GetObjectsInOU($sUser, "(distinguishedname=*)", 2, "distinguishedname") 
If @error Then 
    MsgBox(0, "Error", "Error " & @error & " occurred!") 
Else 
    _ArrayDisplay($aResult) 
Endif

 

OK i guess I don't know how to get that to work. The array now looks like this '>

So I see the DN of the folders and activesync objects.  so I tried this code to iterate through the array and call delete on them .

$aResult = _AD_GetObjectsInOU($sUser, "(distinguishedname=*)", 2, "distinguishedname,objectclass")
If @error Then
MsgBox(0, "Error", "Error " & @error & " occurred!")
Else
    _ArrayDisplay($aResult)
    Endif

    for $i = 2 to UBound($aResult) - 1
        $explode = StringSplit($aResult[$i][1],"|")
        $class = $explode[UBound($explode) - 1]
        ConsoleWrite("Deleting:" & $aResult[$i][0] & @crlf & "Class: " & $class & @crlf)
        _AD_DeleteObject($aResult[$i][0],$class)

    Next
       _AD_DeleteObject($aResult[1][0],"user")

Doing this I get some COM errors - output (condensed)

Deleting:CN=ExchangeActiveSyncDevices0ACNF:c4d72d52-287f-4a88-8bc3-a0d9a7f5fe7d,CN=[CN],OU=[OU],OU=[OU],DC=[OU],DC=[DC],DC=[DC]

Class: msExchActiveSyncDevices

[no com error here for some reason, object not deletedthough]

Deleting:CN=iPhone§ApplC8TJ6LZSDPNG,CN=ExchangeActiveSyncDevices0ACNF:c4d72d52-287f-4a88-8bc3-a0d9a7f5fe7d,CN=[CN],OU=[OU],OU=[OU],DC=[OU],DC=[DC],DC=[DC]

Class: msExchActiveSyncDevice

[no com error here for some reason, object not deletedthough]

 

Deleting:CN=ExchangeActiveSyncDevices,CN=[CN],OU=[OU],OU=[OU],DC=[OU],DC=[DC],DC=[DC]

Class: msExchActiveSyncDevices

COM Error Encountered in AD tests.au3

Description = The directory service can perform the requested operation only on a leaf object.

Deleting:CN=iPhone§ApplC8TJ6LZSDPNG,CN=ExchangeActiveSyncDevices,CN=[CN],OU=[OU],OU=[OU],DC=[OU],DC=[DC],DC=[DC]

Class: msExchActiveSyncDevice

COM Error Encountered in AD tests.au3

Description = Access is denied.

 

[user delete]

Description = The directory service can perform the requested operation only on a leaf object.

 

Might come down to an access thing. I can't delete one of the iphone objects inside one of the activesyncdevices folders. Not sure why the other ones won't delete and why the same object appears twice. Also not sure that if i had permission to delete the one that it would take care of all objects inside this user.  Also seems weird that i get an acess error since i can perform the delete via subtree in ADUC.

[water]

Unfortunately I have no ActiveSync here to play with.

As we do not know how ADUC works under the covers I would suggest to ask the web.

As Visual basic is very similar to AutoIt I would use something like this: "active directory delete user activesync visual basic" and see what I get.

If there is a VB example script it should be easy to convert to AutoIt.

[SpinningCone]

Unfortunately I have no ActiveSync here to play with.

As we do not know how ADUC works under the covers I would suggest to ask the web.

As Visual basic is very similar to AutoIt I would use something like this: "active directory delete user activesync visual basic" and see what I get.

If there is a VB example script it should be easy to convert to AutoIt.

OK , I'll look around. might just start looking at migrating to Powershell. Thanks for the help.

[flyingboz]

sample _AD_ChangePassword function, Example 1 is failing with error 2, extended -2147352567

I have tried running as a full domain admin and standard user with same results.

Any suggestions to debug?   I am running latest production version of au3; server domain is 2012r2, fully patched.

[water]

Could you please add

_AD_ErrorNotify(2)

at the top of your script?

This way we get better error information.

[heartilly]

I am having issues pulling out homeDrive and homeDirectory values even though there is one on actual AD, other properties is working fine.

_AD_Open()
$aUser = _AD_GetObjectsInOU("", "(&(objectCategory=user)(|(CN=" & $sUser & ")(sAMAccountName=" & $sUser & ")))", 2, "samaccountname, name, userPrincipalName, distinguishedName, department, description, employeeid, title, manager, mail, 
extensionAttribute1, homeDrive, homeDirectory")
_arraydisplay($auser)

 

 

As you can see on the screenshot there is no values on col11, col12 which is for homedrive and homedirectory

 

is there is something i missed?