Active Directory UDF

[nitekram]

What results do _AD_GetPasswordInfo and _AD_IsObjectLocked deliver?

_AD_GetPasswordInfo

[0]|12

[1]|60

[2]|3

[3]|6

[4]|8

[5]|0

[6]|3

[7]|30

[8]|2011/06/20 07:30:05

[9]|2011/08/19 07:30:05

[10]|2011/06/20 11:30:05

[11]|2011/08/19 11:30:05

[12]|0

_AD_IsObjectLocked

not locked - even though the account is locked

EDIT - is it a timing issue, cause give it like 15-20 mins and it does show that the account is locked?

Edited July 27, 2011 by nitekram

[water]

We solved at least one problem: Entry 5 as returned by _AD_GetPasswordInfo now returns 0 - which is correct.

I am thinking about a timing issue as well. Depending on the replication interval it can take some time before all domain controllers get the lockout information.

As I understand the authentication process we need to ask the PDC to get accurate information.

I will come up with an example in the next few days as I'm on vacation at the moment.

[nitekram]

@water

Have fun on your vacation - when you get back...before I started the thread about this, I had my script look at each one of the DC, including the PDC. The same issue accured. I have tested after changes from above and still same issue.

Func FindUser($username, $domain)
_AD_Open()
    $aDC = _AD_ListDomainControllers()
    _ArrayDisplay($aDC)
    _ArrayDelete($aDC, 0)
    _AD_Close()
    For $x = 0 To UBound($aDC) - 1
        MsgBox('', 'Domain Controller Checking...', $aDC[$x][0])
        _AD_Open('', '', '', $aDC[$x][0])
        If Not @error Then
            $oUser = ObjGet("WinNT://" & $domain & "/" & $UserName)
            If _AD_IsObjectLocked($UserName) Or $oUser.IsAccountLocked = True Then
                MsgBox('', 'LOCKED on DC', $aDC[$x][0])
            ElseIf @error = 1 Then
                MsgBox('', 'User does not exist on DC', $aDC[$x][0])
            Else
                MsgBox('', 'NOT LOCKED on DC', $aDC[$x][0])
            EndIf
        Else
            MsgBox('', 'ERROR', @error)
        EndIf
        _AD_Close()
    Next
EndFunc   ;==>FindUser

Edited July 28, 2011 by nitekram

[nitekram]

@water

Any update?

[water]

Not yet, I'm still on vacation this and the next week.

And when I return to my office my desk will be full with new tasks

I will return to your problem as soon as I find some spare minutes.

Edit:

I have a few additional questions:

• Do all domain controllers belong to the same site (element 3 (starting with 0) of the array returned by _AD_ListDomainControllers)?
• Is the group policy setting "Contact PDC on logon failure" disabled? For details please check this. If yes, then user lockout replication even to the PDC isn't done via urgent replication and therefore takes up to 15 minutes

Here you can find the following description how account lockout processing and urgent replication work:

"Active Directory replication occurs between domain controllers when directory data is updated on one domain controller and that update is replicated to all other domain controllers. When a change in directory data occurs, the source domain controller sends out a notice that its directory store now contains updated data. The domain controller's replication partners then send a request to the source domain controller to receive those updates. Typically, the source domain controller sends out a change notification after a delay. This delay is governed by a notification delay. (The Windows 2000 default notification delay is 5 minutes; the Windows Server 2003 default notification delay is 15 minutes.) However, any delay in replication can result in a security risk for certain types of changes. Urgent replication ensures that critical directory changes are immediately replicated, including account lockouts, changes in the account lockout policy, changes in the domain password policy, and changes to the password on a domain controller account. With urgent replication, an update notification is sent out immediately, regardless of the notification delay. This design allows other domain controllers to immediately request and receive the critical updates. Note, however, that the only difference between urgent replication and typical replication is the lack of a delay before the transmission of the change notification. If this does not occur, urgent replication is identical to standard replication. When replication partners request and subsequently receive the urgent changes, they receive, in addition, all pending directory updates from the source domain controller, and not only the urgent updates."

Edited August 4, 2011 by water

[nitekram]

I have a few additional questions:

• Do all domain controllers belong to the same site (element 3 (starting with 0) of the array returned by _AD_ListDomainControllers)?
• Is the group policy setting "Contact PDC on logon failure" disabled? For details please check this. If yes, then user lockout replication even to the PDC isn't done via urgent replication and therefore takes up to 15 minutes

Here you can find the following description how account lockout processing and urgent replication work:

There are a total of 12 DC (one being the primary) - 9 are for the same site i.e. starts with servername then . then *1.net, the other three are servername then . then *2.net

Assuming that your UDF has the same functions as this tool from MS shows and does what I want (infact the tool we are using today) - but I am trying to use AutoIT to do the same thing - maybe I will just have to use the command line with this tool to get it working? So, I have to assume that we have urgent replication turned on - would have to check with server team to verify, but why would this work and show updated info if it was not turned on?

Thanks again for your time...

EDIT - spacing

Edited August 4, 2011 by nitekram

[water]

@nitekram,

I used the following script to test our 5 DCs.

I locked a user at 13:46 and ran the script with the following results:

Displayed as locked at 13:46: VDC1 and VDC2 (this is the PDC) - This two DCs have the "Default-First-Site-Name" so it's an intersite replication

Displayed as locked at 13:48: IDC1 and IDC2 - This two DCs have others sites so it's an extrasite replication and therefore uses more time

Displayed as locked at 13:51: VDC3 - This DCs has another site so it's an extrasite replication and therefore uses more time

So all results seem to be fine here!

#include 

$sUserName = "test"
_AD_Open()
$aDC = _AD_ListDomainControllers()
_ArrayDisplay($aDC)
 $aFSMO = _AD_ListRoleOwners()
 ConsoleWrite("PDC is " & $aFSMO[1] & @CRLF)
_AD_Close()
For $iIndex = 1 To $aDC[0][0]
    ConsoleWrite("Connecting to: " & $aDC[$iIndex][0] & " ... ")
    _AD_Open('', '', '', $aDC[$iIndex][0])
    If Not @error Then
        ConsoleWrite("Done" & @CRLF)
        If _AD_IsObjectLocked($sUserName) Then
            ConsoleWrite("User " & $sUserName & " is locked on DC " & $aDC[$iIndex][0] & @CRLF)
        ElseIf @error = 1 Then
            ConsoleWrite("User " & $sUserName & " does not exist on DC " & $aDC[$iIndex][0] & @CRLF)
        Else
            ConsoleWrite("User " & $sUserName & " is NOT locked on DC " & $aDC[$iIndex][0] & @CRLF)
        EndIf
    Else
        ConsoleWrite("Error encountered: @error = " & @error & ", @extended = " & @extended & @CRLF)
    EndIf
    _AD_Close()
Next

Could you please run this test at your site and post the results?

Edited August 5, 2011 by water

[HaeMHuK]

Hi water!

Sometime ago you helped me with a script.

I found yesterday a bug. If I try to type "var" and search it the script shows me clean table.

Could you please try.

expandcollapse popup

#AutoIt3Wrapper_AU3Check_Parameters= -d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=Y
; *****************************************************************************
; Example 1
; Deletes an AD object.
; *****************************************************************************
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; Open Connection to the Active Directory
_AD_Open()


#region ### START Koda GUI section ### Form=
Global $Form1 = GUICreate("Search AD", 180, 50)
GUICtrlCreateLabel("Search:", 8, 10, 50, 17)
Global $IObject = GUICtrlCreateInput("", 60, 8, 100, 21)
$Dum = GUICtrlCreateDummy()
Dim $accels[1][2] = [["{ENTER}", $Dum]]
GUISetAccelerators($accels)

GUISetState(@SW_SHOW)
#endregion ### END Koda GUI section ###

While 1
    Global $nMsg = GUIGetMsg()
    Switch $nMsg
        Case $GUI_EVENT_CLOSE
            Exit
             Case $Dum
            Global $sObject = GUICtrlRead($IObject)

   
            If ControlGetFocus($Form1) Then 
            

$aObjects = _AD_GetObjectsInOU("", "(ANR=" & $sObject & ")", 2, "displayname,sAMAccountName,telephoneNumber,mobile,title,extensionAttribute11,employeeID,extensionAttribute15,employeeNumber,extensionAttribute1,extensionAttribute3", "displayname")
If @error > 0 Then
    MsgBox(64, "Active Directory search results", "No objects found")
Else
    _ArrayDisplay($aObjects, "Active Directory search results - '" & $sObject & "'", 0, 0, "", "|", "0|Display name|Account name|Telephone|Mobile|Title|Location|ID|Band|Grade|ICQ|Skype")
EndIf

; Close Connection to the Active Directory
EndIf
EndSwitch
WEnd

_AD_Close()

Edited August 5, 2011 by HaeMHuK

[water]

What do you get when you change line

$aObjects = _AD_GetObjectsInOU("", "(ANR=" & $sObject & ")", 2, "sAMAccountName")

Does your script display an empty array or do you get MsgBox "No objects found"?

When you get the MsgBox can you please display the @error as well?

Edited August 5, 2011 by water

[nitekram]

@nitekram,

I used the following script to test our 5 DCs.

Could you please run this test at your site and post the results?

@water

Do not know what is different with your script compared to mine, but yours found the account locked on both the PDC and one of the DC - right after I locked account?

I am going to have to do some more testing...as I have compared your code to mine and minus a few variable names - it looks the same.

Thanks again for your time.

[water]

I just replaced MsgBox with ConsoleWrite and removed the WINNT test.

All other changes are for cosmetic reasons.

I'm glad that our problem could be solved and that the AD function is now a bit more reliable!

[HaeMHuK]

What do you get when you change line

$aObjects = _AD_GetObjectsInOU("", "(ANR=" & $sObject & ")", 2, "sAMAccountName")

Does your script display an empty array or do you get MsgBox "No objects found"?

When you get the MsgBox can you please display the @error as well?

Please, look to attachment.

Edited August 8, 2011 by HaeMHuK

[water]

Might be a problem with _ArrayDisplay. Could you please try

_ArrayDisplay($aObjects)

[HaeMHuK]

Might be a problem with _ArrayDisplay. Could you please try

_ArrayDisplay($aObjects)

Yep! Works. What is the problem? Could it be fixed?

[water]

Seems _ArrayDisplay has a problem when the data contains the pipe character and you use the heading with pipe characters.

I've already opened a bug report some time ago.

[HaeMHuK]

Ok! Thanks. I believe it will be fixed in future.

[supersonic]

Hi water!

If I call '_AD_GetUserGroups(@UserName, 1)' and the user is a member of 'Domain Users' only no array will be returned.

If I add this user (or any other) to a second group (or more) a valid array will be returned (including 'Domain Users').

Do you have any idea to work around this?

Greets,

-supersonic.

[water]

Hi supersonic,

It's a bug in the function!

If the user isn't a member of any group no array is returned and therefore no _ArrayInsert for the primary group is possible.

Some more error checking is necessary.

I will post corrected code as soon as I return to my office.

Have a nice weekend!

[Javik]

I do not see how to register to edit the autoit wiki, so I guess I'll post this problem here.

On the wiki page for the Active Directory UDF:

http://www.autoitscript.com/wiki/Active_Directory_UDF_-_General

It looks like there is an extra double-quote after microsoft\DJ, in section 4.1 "Open a connection, to current domain":

$iResult = _AD_Open("microsoft\DJ"", "password of DJ")

[water]

Thanks - has been corrected.