Active Directory UDF

[water]

OK, I see that the new _AD_Open version delivers more information but on the other hand makes interpretation of this information a bit difficult.

To clarify it a bit:

• If _AD_Open was successful the return value is still set to 1. You don't have to bother with OS version or error codes
• Only the return value of the function has changed. You get 0, 1 and for Windows 7 an array of additional error information
• You can still check for "If Not @error Then" because nothing has changed here
• You don't have to check the OS in your script. The return value, @error and @extended should be enough to tell if _AD_Open was successful and if not, what happened.

  The problem is, that only Windows 7 (and maybe others) deliver the additional error information I return in the array

I only have Windows XP and Windows 7 available so I can't test for other operating systems.

I think I will do the following:

• Change the return value so that it no longer delivers the additional error information in an array. You then get 0 or 1.
• I will return the additional error information either in a global variable or let the user decide. If he needs the additional information he has to call function _AD_GetLastADSIError() himself.

  What would you prefer?

• Remove the OS checking in the function. If the operating system returns the needed information then the array will be filled. Else the array will be empty or contain useless information.

What do you think?

The changed function can be available in a few days.

Edited September 9, 2010 by water

[supersonic]

Hi water,

- If I connect with the same user again I'm currently logged on with (= specifying all parameters)

then _AD_Open sets the return value to "" and @error = 1317. With older version of _AD_Open it was not a problem.

If I successfully connect with a different user the return value is set to 1 and @error = 0; so, everything ok here.

Tested unter Windows 7.

- It would be nice, if there could be a globally defined array variable the extended information are passed to.

- Furthermore, the return values should always be 0 (= failure) or 1 (= success, @error = 0).

Thank you for your help; currently _AD_Open V0.39 works ok for me.

But I'm looking forward for the upcoming release.

If there is something I could test for you, let me know.

May be you're interested in Windows 2008 R2 testing?

Greets,

-supersonic.

Edited September 9, 2010 by supersonic

[water]

Hi water,

• If I connect with the same user again I'm currently logged on with (= specifying all parameters) then _AD_Open sets the return value to "" and @error = 1317. With older version of _AD_Open it was not a problem.

  If I successfully connect with a different user the return value is set to 1 and @error = 0; so, everything ok here.

  Tested unter Windows 7.

• It would be nice, if there could be a globally defined array variable the extended information are passed to.
• Furthermore, the return values should always be 0 (= failure) or 1 (= success, @error = 0).

Thank you for your help; currently _AD_Open V0.39 works ok for me.

But I'm looking forward for the upcoming release.

If there is something I could test for you, let me know.

May be you're interested in Windows 2008 R2 testing?

Greets,

-supersonic.

Ad 1. It's a bug. Please change line 381 from

Local $oAD_Temp = $oAD_OpenDS.OpenDSObject("LDAP://" & $sAD_HostServer, $sAD_UserId, $sAD_Password, $ADS_SERVER_BIND)

to

Local $oAD_Temp = $oAD_OpenDS.OpenDSObject("LDAP://" & $sAD_HostServer, $sAD_UserId, $sAD_Password, BitOR($ADS_SECURE_AUTH, $ADS_SERVER_BIND))

Ad 2. I think I will stay with the user calling an extra function to retrieve the additional error information. Global variables are not recommended with UDFs.

Ad 3. Agreed

Testing with new Windows server versions is always welcome. Feeks has done some testing with Windows 2008 already. He didn't encounter any problems so far.

I'm not sure which of the new Windows 2008 functions should be implemented in the UDF (read only domain controllers, granular password policies etc.). What functions do users need?

[water]

Hi supersonic,

here I have the modified _AD_Open function.

expandcollapse popup

Func _AD_Open($sAD_UserIdParam = "", $sAD_PasswordParam = "", $sAD_DNSDomainParam = "", $sAD_HostServerParam = "", $sAD_ConfigurationParam = "")

    ; A COM error handler will be initialised only if one does not exist.
    If ObjEvent("AutoIt.Error") = "" Then
        $oAD_MyError = ObjEvent("AutoIt.Error", "_AD_ErrorHandler") ; Creates a custom error handler
        If @error <> 0 Then Return SetError(1, @error, 0)
    EndIf

    $iAD_COMError = 0
    $oAD_Connection = ObjCreate("ADODB.Connection") ; Creates a COM object to AD
    If Not IsObj($oAD_Connection) Or @error <> 0 Then Return SetError(2, @error, 0)
    ; ConnectionString Property (ADO): http://msdn.microsoft.com/en-us/library/ms675810.aspx
    $oAD_Connection.ConnectionString = "Provider=ADsDSOObject" ; Sets Service providertype
    If $sAD_UserIdParam <> "" Then
        If $sAD_PasswordParam = "" Then Return SetError(7, 0, 0)
        $oAD_Connection.Properties("User ID") = $sAD_UserIdParam ; Authenticate User
        $oAD_Connection.Properties("Password") = $sAD_PasswordParam ; Authenticate User
        ; If userid is the Windows login name then set the flag for secure authentification
        If StringInStr($sAD_UserIdParam, "\") = 0 And StringInStr($sAD_UserIdParam, "@") = 0 Then
            $oAD_Connection.Properties("ADSI Flag") = $ADS_SECURE_AUTH
        Else
            $oAD_Connection.Properties("ADSI Flag") = 0x0
        EndIf
        $sAD_UserId = $sAD_UserIdParam
        $sAD_Password = $sAD_PasswordParam
    EndIf
    ; ADO Open Method: http://msdn.microsoft.com/en-us/library/ms676505.aspx
    $oAD_Connection.Open()  ; Open connection to AD
    If @error <> 0 Then Return SetError(3, @error, 0)
    ; Connect to another Domain if the Domain parameter is provided
    If $sAD_DNSDomainParam <> "" Then
        If $sAD_HostServerParam = "" Or $sAD_ConfigurationParam = "" Then Return SetError(6, 0, 0)
        $oAD_RootDSE = ObjGet("LDAP://" & $sAD_HostServerParam & "/RootDSE")
        If Not IsObj($oAD_RootDSE) Or @error <> 0 Then Return SetError(4, @error, 0)
        $sAD_DNSDomain = $sAD_DNSDomainParam
        $sAD_HostServer = $sAD_HostServerParam
        $sAD_Configuration = $sAD_ConfigurationParam
    Else
        $oAD_RootDSE = ObjGet("LDAP://RootDSE")
        If Not IsObj($oAD_RootDSE) Or @error <> 0 Then Return SetError(4, @error, 0)
        $sAD_DNSDomain = $oAD_RootDSE.Get("defaultNamingContext") ; Retrieve the current AD domain name
        $sAD_HostServer = $oAD_RootDSE.Get("dnsHostName") ; Retrieve the name of the connected DC
        $sAD_Configuration = $oAD_RootDSE.Get("ConfigurationNamingContext") ; Retrieve the Configuration naming context
    EndIf
    $oAD_OpenDS = ObjGet("LDAP:")
    If Not IsObj($oAD_OpenDS) Or @error <> 0 Then Return SetError(5, @error, 0)
    ; Check userid/password if provided
    If $sAD_UserIdParam <> "" Then
        ; If userid is the Windows login name then set the flag for secure authentification
        If StringInStr($sAD_UserIdParam, "\") = 0 And StringInStr($sAD_UserIdParam, "@") = 0 Then
            Local $oAD_Temp = $oAD_OpenDS.OpenDSObject("LDAP://" & $sAD_HostServer, $sAD_UserIdParam, $sAD_PasswordParam, BitOR($ADS_SECURE_AUTH, $ADS_SERVER_BIND))
        Else
            Local $oAD_Temp = $oAD_OpenDS.OpenDSObject("LDAP://" & $sAD_HostServer, $sAD_UserIdParam, $sAD_PasswordParam, $ADS_SERVER_BIND)
        EndIf
    If Not IsObj($oAD_Temp) Or @error <> 0 Then ; login error occurred - get extended information
            Local $sAD_OSVersion = RegRead(_AD_HKLM() & "\SOFTWARE\Microsoft\Windows NT\CurrentVersion", "CurrentVersion")
            $sAD_OSVersion = StringSplit($sAD_OSVersion, ".")
            If Int($sAD_OSVersion[1]) >= 6 Then     ; Delivers detailed error information for Windows 7 and later if debugging is activated
                Local $aAD_Errors = _AD_GetLastADSIError()
                If $aAD_Errors[4] <> 0 Then
                    If $iAD_Debug = 1 Then ConsoleWrite("_AD_Open: " & _ArrayToString($aAD_Errors, @CRLF, 1) & @CRLF)
                    If $iAD_Debug = 2 Then MsgBox(64, "Active Directory Functions - Debug Info - _AD_Open", _ArrayToString($aAD_Errors, @CRLF, 1))
                    If $iAD_Debug = 3 Then FileWrite("AD_Debug.txt", @YEAR & "." & @MON & "." & @MDAY & " " & @HOUR & ":" & @MIN & ":" & @SEC & " " & @CRLF & _
                        "-------------------" & @CRLF & "_AD_Open: " & _ArrayToString($aAD_Errors, @CRLF, 1) & @CRLF & _
                        "========================================================" & @CRLF)
                    Return Seterror(Dec($aAD_Errors[4]), 0, 0)
                Endif
                Return SetError(8, $iAD_COMErrorDec, 0)
            Else
                Return SetError(8, $iAD_COMErrorDec, 0)
            EndIf
    Endif
    Endif
    Return 1

EndFunc ;==>_AD_Open

Func _AD_HKLM()

    If @OSArch = "IA64" Or @OSArch = "X64" Then Return "HKLM64"
    Return "HKLM"

EndFunc

This returns 1 (success) or 0 (failure) and sets @error accordingly.

One problem I noted: If you specify the parameter $sAD_UserIdParam as Windows Login Name (<userid>) then Windows always returns "success" when _AD_GetLastADSIError() is called even when there was an error.

I'm investigating this problem.

EDIT: It seems that with secure bind (necessary with Window Login Name) you get no error information.

To get extended error information at the moment you have to specify the NetBIOS Login Name (<DOMAIN>\<userid>) or the User Principal Name (<userid>@<domain.com>).

Example script:

#include <ad.au3>
$iResult = _AD_Open("xy@microsoft.com","xyz")
If $iResult = 0 Then
    $aArray = _AD_GetLastADSIError()
    _ArrayDisplay($aArray,"ADSI Error")
Endif
_AD_Close()
Exit

What do you think?

Edited September 10, 2010 by water

[supersonic]

Hi water,

excellent, thank you very much!

For me, it works pretty well now.

Calling '_AD_GetLastADSIError()' to get extended information

seems to be handy as well.

Greets,

-supersonic.

[water]

Hi water,

excellent, thank you very much!

For me, it works pretty well now.

Calling '_AD_GetLastADSIError()' to get extended information

seems to be handy as well.

Greets,

-supersonic.

Hi supersonic,

Glad you like it

I will enhance the docu and the example script and release version 0.41 in a few days.

Greetings

water

[water]

Version 0.41 has been released.

For download please see signature.

[water]

I think the Active Directory UDF now has all features users need for their scripts. Therefore development will come to an end for the time being.

There are no new functions or enhancements in the pipeline. No new version will be released until there is a need for bug fixes.

Do you miss a function in the UDF? Do you want me to enhance the example scripts or help files? Something else?

Any suggestion is welcome!

BTW: If you like to tell me how satisfied you are with the UDF please go to page 1, move your mouse to the corresponding star in the upper right corner and click to rate.

Edited October 6, 2010 by water

[rogerd2u]

I just want to say that you have done one hell of a job in putting this together. Thank you for lending your time and expertice to this project! Well done!!

I think the Active Directory UDF now has all features users need for their scripts. Therefore development will come to an end for the time being.

There are no new functions or enhancements in the pipeline. No new version will be released until there is a need for bug fixes.

Do you miss a function in the UDF? Do you want me to enhance the example scripts or help files? Something else?

Any suggestion is welcome!

BTW: If you like to tell me how satisfied you are with the UDF please go to page 1, move your mouse to the corresponding star in the upper right corner and click to rate.

[water]

I just want to say that you have done one hell of a job in putting this together. Thank you for lending your time and expertice to this project! Well done!!

... expertice ...

When I started to work on this UDF I had more "expertice" in AutoIt then in AD. Based on the work of Johny Clelland I first just tried to convert the UDF into an AutoIt like UDF with examples, help file etc. But as users started to demand new functions I got more and more involved. Now I know a bit more about AD and AutoIt

[netegg]

hi, would you like to convert these serial funtions to the LDAP api by using activeds.dll?

[water]

What benefit do you see with the activeds.dll?

Better performance, more functions?

[ModemJunki]

I get tons of errors trying even the example scripts?

I am up too late?

E.g.,

C:\Program Files (x86)\AutoIt3\Include\AD.au3(1638,59) : ERROR: _Date_Time_SystemTimeToDateTimeStr() called with wrong number of args.
    $sAD_Now = _Date_Time_SystemTimeToDateTimeStr($sAD_Now, 1)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^

[water]

I get tons of errors trying even the example scripts?

I am up too late?

E.g.,

C:\Program Files (x86)\AutoIt3\Include\AD.au3(1638,59) : ERROR: _Date_Time_SystemTimeToDateTimeStr() called with wrong number of args.
 $sAD_Now = _Date_Time_SystemTimeToDateTimeStr($sAD_Now, 1)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^

You need the newest version of AutoIt. It comes with the newest version of the Date UDF that supports the additional parameter.

[RogFleming]

Yo Mr. Water,

I been using your Ad.udf love it but getting an error

C:\Program Files\AutoIt3\Include\AD.au3 (1071) : ==> Object referenced outside a "With" statement.:

$aAD_Membersadd = $oAD_RecordSet.fields(0).Value

$aAD_Membersadd = $oAD_RecordSet.fields(0)^ ERROR

My code:

expandcollapse popup

Func GetADgroupsMemberCount($ADDOMAIN)
    MsgBox(1,"","retrieving all Active Directory Groups, this might take a few minutes.")
    _AD_Open()
    $OUUserGrps = _AD_GetObjectsInOU($ADDOMAIN, "(objectcategory=group)",2,"name,distinguishedName")
    _GUICtrlListView_BeginUpdate($iWksList)
    For $grp = 1 to UBound($OUUserGrps) -1
        $members = _AD_GetGroupMembers($OUUserGrps[$grp][1])
        If @error Then ContinueLoop <-- I guessing it hitting a group object that is empty?
            _GUICtrlStatusBar_SetText($hStatus, $OUUserGrps[$grp][0]&"  "&"Complete:"&$grp&"/"&$OUUserGrps[0][0], 1)
            GUICtrlSetData($progress,($grp/$OUUserGrps[0][0])*100)
            GUICtrlCreateListViewItem(_NowCalcDate()&'|'&"User Group"&'|'&$OUUserGrps[$grp][0]&'|'&$members[0],$iWksList)
    Next
    _GUICtrlListView_EndUpdate($iWksList)
    _AD_Close()
EndFunc

AD_UDF section in error
Func _AD_GetGroupMembers($sAD_Group)

    If _AD_ObjectExists($sAD_Group) = 0 Then Return SetError(1, 0, "")
    If StringMid($sAD_Group, 3, 1) <> "=" Then $sAD_Group = _AD_SamAccountNameToFQDN($sAD_Group) ; sAMAccountName provided
    Local $sAD_Range, $iAD_RangeModifier, $oAD_RecordSet
    Local $oAD_Command = ObjCreate("ADODB.Command")
    $oAD_Command.ActiveConnection = $oAD_Connection
    $oAD_Command.Properties("Page Size") = 1000
    $oAD_Command.Properties("Searchscope") = 2
    Local $aAD_Members[1]
    Local $iCount1 = 0
    Local $aAD_Membersadd
    While 1
        $iAD_RangeModifier = $iCount1 * 1000
        $sAD_Range = "Range=" & $iAD_RangeModifier & "-" & $iAD_RangeModifier + 999
        $oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sAD_Group & ">;;member;" & $sAD_Range & ";base"
        $oAD_RecordSet = $oAD_Command.Execute
        $aAD_Membersadd = $oAD_RecordSet.fields(0).Value <----Here!!!!
        If $aAD_Membersadd = 0 Then ExitLoop
        ReDim $aAD_Members[UBound($aAD_Members) + 1000]
        For $iCount2 = $iAD_RangeModifier + 1 To $iAD_RangeModifier + 1000
            $aAD_Members[$iCount2] = $aAD_Membersadd[$iCount2 - $iAD_RangeModifier - 1]
        Next
        $iCount1 += 1
        $oAD_RecordSet.Close
        $oAD_RecordSet = 0
    WEnd
    $iAD_RangeModifier = $iCount1 * 1000
    $sAD_Range = "Range=" & $iAD_RangeModifier & "-*"
    $oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sAD_Group & ">;;member;" & $sAD_Range & ";base"
    $oAD_RecordSet = $oAD_Command.Execute
    $aAD_Membersadd = $oAD_RecordSet.fields(0).Value
    ReDim $aAD_Members[UBound($aAD_Members) + UBound($aAD_Membersadd)]
    For $iCount2 = $iAD_RangeModifier + 1 To $iAD_RangeModifier + UBound($aAD_Membersadd)
        $aAD_Members[$iCount2] = $aAD_Membersadd[$iCount2 - $iAD_RangeModifier - 1]
    Next
    $oAD_RecordSet.Close
    $aAD_Members[0] = UBound($aAD_Members) - 1
    Return $aAD_Members

EndFunc   ;==>_AD_GetGroupMembers

[water]

You are putting heavy load onto the DC. The error you see is a timing problem.

Instead of getting a list of groups and then get the members of every group you can do it in one go.

Replace:

$OUUserGrps = _AD_GetObjectsInOU($ADDOMAIN, "(objectcategory=group)",2,"name,distinguishedName")

with

$OUUserGrps = _AD_GetObjectsInOU($ADDOMAIN, "(objectcategory=group)",2,"name,distinguishedName,member")

$OUUserGrps[$grp][2] now contains a list of members separated by "|".

Do a stringsplit and you have what you need.

BTW: If the group has no members, _AD_GetGroupMembers returns an array with one element (row count) set to 0.

Edited November 20, 2010 by water

[RogFleming]

I completely got it thanks Water! you are the best!!

[water]

[ICANSEEYOU7687]

Just curious,

But I am trying to get an array for security groups out of active directory. Is there a function to do this or an easy way? Its been a while since I messed with some of this stuff, and I am a little unsure. THanks!

[water]

Just curious,

But I am trying to get an array for security groups out of active directory. Is there a function to do this or an easy way? Its been a while since I messed with some of this stuff, and I am a little unsure. THanks!

It depends on how you want to select the security groups: by name, by OU, by members?

You could start to have a look at function _AD_GetObjectsInOU. Something like this could get you started:

$aGroups = _AD_GetObjectsInOU("", "(objectCategory=Group)", 2, "cn,distinguishedName,info,managedBy,description,samaccounttype")

Returns an array of all groups in your AD with cn, distinguishedname etc. for every group.

Edited December 1, 2010 by water