Active Directory UDF

[water]

Hi supersonic,

at the moment I don't see any of my new UDFs become part of the AutoIt package. As long as you can download them from the forum the only drawback is that the help file can't be called using F1 in SciTE.

_IsMemberOf will always return just 0 (not a member of the specified or any group) and 1.

At the moment I'm very busy, so don't hold your breath for a new version.

[jchapman15]

I added 2 functions to my copy of the AD UDF and am sharing them in the chance that someone else finds them useful.

One searches for AD objects based on multiple properties, basically an enhanced version of _AD_ObjectExists

One searches for AD objects based on multiple properties and returns values for multiple properties, an enhanced version of _AD_GetObjectAttribute

_AD_GetObjectAttributeAdvanced relies on _AD_ObjectExistsAdvanced

_AD_Advanced.zip

[water]

Thanks for posting this functions!

I had a quick look at the functions and have a few remarks:

• _AD_ObjectExists only checks if a user, computer, group etc. exists. It's not a search function but a function that tries to access an object. The return value depends on the result (nothing found, one object found, mutliple objects found)
• Isn't your _AD_ObjectExistsAdvanced very similar to _AD_GetObjectsInOU? You have to specify the whole LDAP query string but can as well specify the count of found records to be returned.
• Isn't your _AD_GetObjectAttribute very similar to _AD_GetObjectsInOU? You have to specify the whole LDAP query string but can as well specify multiple properties to be returned.

[Iceman682]

Hi Water,

Hope you are well?

A quick question if I may regarding _IsMemberOf

Is there a way to stipulate if a user is a member of Group A or Group B then continue etc?

I know this doesn't work but it's an example of what I mean

$sFQDN_User = @UserName
$sFQDN_Group = "Group A" or "Group B" or "Group C"
;Check the group membership of the specified user for the specified group
_AD_Open() ; Do processing with logged on user permissions
$Result = _AD_GetObjectAttribute(@ComputerName & "$", "distinguishedname")
$sOUDescription = _AD_GetobjectAttribute($ADResult, "description")
$ADResult = _AD_GetObjectAttribute(@ComputerName & "$", "description")
$iResult = _AD_IsMemberOf($sFQDN_Group, $sFQDN_User)

Many thanks in advance

Edited June 21, 2013 by Iceman682

[water]

Something like this?

If _AD_IsMemberOf("Group A", @UserName) And _AD_IsMemberOf("Group B", @UserName) Then do whatever you need to do

[Iceman682]

Thanks Water I will give it a try

[Iceman682]

Hi Water

Thanks for the tips, I ended up inserting the following and it worked

;Check the group membership of the specified user for the specified group
    _AD_Open() ; Do processing with logged on user permissions
    $Result = _AD_GetObjectAttribute(@ComputerName & "$", "distinguishedname")
    $sOUDescription = _AD_GetobjectAttribute($ADResult, "description")
    $ADResult = _AD_GetObjectAttribute(@ComputerName & "$", "description")
    $iResult = _AD_IsMemberOf("GroupA", @UserName)
    $iResult1 = _AD_IsMemberOf("GroupB", @UserName)
    $iResult2 = _AD_IsMemberOf("GroupC", @UserName)
    $iResult3 = _AD_IsMemberOf("GroupD", @UserName)
    If $iResult Or $iResult1 Or $iResult2 Or $iResult3 = True Then

Thanks

[water]

[jchapman15]

 

Thanks for posting this functions!

I had a quick look at the functions and have a few remarks:

• _AD_ObjectExists only checks if a user, computer, group etc. exists. It's not a search function but a function that tries to access an object. The return value depends on the result (nothing found, one object found, mutliple objects found)
• Isn't your _AD_ObjectExistsAdvanced very similar to _AD_GetObjectsInOU? You have to specify the whole LDAP query string but can as well specify the count of found records to be returned.
• Isn't your _AD_GetObjectAttribute very similar to _AD_GetObjectsInOU? You have to specify the whole LDAP query string but can as well specify multiple properties to be returned.

 

 

I wish I had seen _AD_GetObjectsInOU before I had rolled my own, it probably would have solved my problem just as well.

I was searching for something that would take an LDAP query but I just missed this one. Thanks for the heads up!

Probably too much of a pain to refactor this in now but for future projects it'll be something I use.

[water]

I'm not really happy with the function names. But when I was rewriting the original UDF written by Jonathan Clelland I kept the names and only modified the documentation, help file, examples etc.

A good starting point would have been the wiki. Section 6 describes how to run queries.

[ScriptNewbie123]

When I try to use _AD_CreateMailbox("TestAccount","Mail Store")

I get:

COM Error Encountered in Test.au3

AD UDF version = 1.3.0

@AutoItVersion = 3.3.8.1

@AutoItX64 = 0

@Compiled = 0

@OSArch = X86

@OSVersion = WIN_XP

Scriptline = 3781

NumberHex = 80020009

Number = -2147352567

WinDescription = There is no such object on the server.

Description = There is no such object on the server.

 

Facility: LDAP Provider

ID no: 80072030

Microsoft CDO for Exchange Management

Source = 

HelpFile = 

HelpContext = 0

LastDllError = 14007

[water]

You can pass more parameters to function _AD_CreateMailbox.

I would at least pass $sEMailServer (= the name of the Exchange server you want to create the mailbox on).

[water]

BTW: Which version of the Exchange server do you run?

[ScriptNewbie123]

I am using Exchange 2003. It is okay now. I used ExchMbx.exe to create the mailboxes in the end.

Edited August 16, 2013 by ScriptNewbie123

[water]

To make function _AD_CreateMailbox work properly CDOEXM needs to be installed on the local computer.

According tot he remarks in the function:

The mailbox is created using CDOEXM. For this function to work the Exchange administration tools have to be installed on the computer running the script.

[gcue]

i am trying to get the bitlocker recovery password from a workstation object

i saw what you said >here but it's not working..

here's what i have

_AD_Open()
 
$object_properties = _AD_GetObjectProperties($strComputer, "ms-FVE-RecoveryPassword")
 
_AD_Close()
 
_arraydisplay($object_properties)

also there are some instances when a workstation object has multiple - they each have a date associated with them so if i can see the date i can pull the most recent.

Edited September 24, 2013 by gcue

[water]

Does the VB example in the linked post work for you?

[gcue]

it does =)

now i just have to convert it to autoit =)

thanks!

[water]

Great!

Can you then please post the result here so others users can find it?

[KLM]

Danke