Active Directory UDF

[water]

Is this the only error message that pops up? Because in your first post it was line #1434 and in the screenshot it was line #4361 (which is a Endfunc statement in version 1.1.0)

[water]

According to google:

0x8007203a - LDAP_SERVER_DOWN
This error code occurs when the addressed server is unreachable during a BIND authentication in the directory.
This can occur due to underlying network problems. A firewall may block the used LDAP port, or the LDAP
service isn't active on the destination host.

Could you please try to connect to another Domain Controller?

Edited November 17, 2011 by water

[supersonic]

Hi water,

sorry, it was my fault!

The affected dom. contr. was rebooted - now it work's...

Greets,

-supersonic.

[water]

Glad that the problem could be solved!

Edited November 17, 2011 by water

[supersonic]

Hi water,

is there a way to determine if an user object was changed - e. g. due to changes of group membership(s)?

I found the attribute "uSNChanged" but it does not seem to change...

Any ideas about this issue?

Alternatively I could determine group memberships before/after with the help of '_AD_GetUserGroups()' and compare the results of there two arrays - but this will be rather slooow...

Greets,

-supersonic.

[water]

Hi supersonic,

a user object isn't changed if his group membership is changed. The group is changed and the "MemberOf" property of the user account is just a "calculated" property.

To see what changed on AD you need to check logging/auditing.

Edited November 22, 2011 by water

[supersonic]

Hi water,

I have found a solution to my problem: The attribute "memberOf" reflects the the current groups the user is member of.

Furthermore it's small and fast.

Greets,

-supersonic.

[water]

Hi supersonic,

glad you found a solution

Function _AD_GetUserGroups() does just what you do when you access the "memberof" property (plus some additional overhead for error checking).

[HaeMHuK]

Hi water!

I have problem with _AD_GetOUTreeView.

There are 4 OUs visible in attachment.

All objects from "Partners" are shown in "Partners.Inactive - Migrated From Media" and all objects from "Partners.Disabled" are shown in "Partners.Disabled Never Used". In fact, script shows Partners and Partners.Disabled as empty OUs, but it' not true.

Could you please suggest the reason.

Thanks in advance.

Edited November 23, 2011 by HaeMHuK

[water]

An empty OU as _AD_GetOUTreeView sees it is an OU which doesn't contain an OUs.

Do the OUs "Partners" and "Partners.Disabled" contain any OUs or just user, computer or group objects?

[HaeMHuK]

Sure. All 4 OUs contain different objects.

Edited November 23, 2011 by HaeMHuK

[water]

Yes, but _AD_GetOUTreeView only displays OUs. So do all 4 OUs contain OUs themselves?

[HaeMHuK]

MMC screenshot

The script shows all OUs from "Partners" in "Partners.Inactive - Migrated From Media" and all OUs from "Partners.Disabled" in "Partners.Disabled Never Used".

Edited November 23, 2011 by HaeMHuK

[water]

Does function _AD_GetAllOUs list the missing sub-OUs?

[HaeMHuK]

Yes. _AD_GetAllOUs show correct SubOUs in each OU.

[water]

OK, I will have to check this tomorrow - now I have to leave for a beer (or two ...)

[water]

Just for the records. Do the missing sub-OUs have any unusual characters in their name (like #,. etc.)?

[HaeMHuK]

No, just spaces and '-'.

Nice beer-drinking.

[water]

Could you please insert the following code into function _AD_GetOUTreeView? Then please check the displayed array. Does it contain the missing sub-OUs? Each entry in column 0 has a number of spaces (denotes the level in the TreeView) plus a # sign.

If $bAD_IsADOpen = False Then _AD_Close()
_ArrayDisplay($aAD_TreeView)  ; <===
_GUICtrlTreeView_BeginUpdate($hAD_TreeView)

Edited November 24, 2011 by water

[HaeMHuK]

Same situation.