Active Directory UDF

[water]

Just tested. Seems you need to enter a separate line to handle a PRINTABLE_STRING:

If $oItem.ADsType = $ADSTYPE_CASE_IGNORE_STRING Then
    $aObjectProperties[$iCount3][1] = $vPropertyValue.CaseIgnoreString
ElseIf $oItem.ADsType = $ADSTYPE_PRINTABLE_STRING Then
    $aObjectProperties[$iCount3][1] = $vPropertyValue.PrintableString

 

[colombeen]

3 hours ago, water said:

Just tested. Seems you need to enter a separate line to handle a PRINTABLE_STRING:

If $oItem.ADsType = $ADSTYPE_CASE_IGNORE_STRING Then
    $aObjectProperties[$iCount3][1] = $vPropertyValue.CaseIgnoreString
ElseIf $oItem.ADsType = $ADSTYPE_PRINTABLE_STRING Then
    $aObjectProperties[$iCount3][1] = $vPropertyValue.PrintableString

 

I'll try that tomorrow (but I'll update to the new version first I think). when it's on one line I get an empty result.

[supersonic]

water,

I've just tested 1440:

"D:\SUPERSONIC\_\AUTOIT\Include\Water\AD_01.04.04.00\AD.au3" (2097) : ==> Variable used without being declared.:
$sPropertyName = $oProperty.Name
^ ERROR

[water]

Ops. my bad.
Simply add " $sPropertyName" to line 2084:

    Local $oProperty, $oPropertyEntry, $sPropertyName, $oValue, $iPropertyRecord = 0, $xAD_Dummy

[water]

Ops. my bad.
Simply add " $sPropertyName" to line 2084:

    Local $oProperty, $oPropertyEntry, $sPropertyName, $oValue, $iPropertyRecord = 0, $xAD_Dummy

[supersonic]

Thanks, I know; maybe a bugfix release 1.4.4.1 is useful to others...?

Edited May 4, 2016 by supersonic

[water]

Double post.

Edited May 3, 2016 by water

[water]

Version 1.4.5.0 of the UDF has been released.

Bugfix in function _AD_JoinDomain.

Please test before using in production!
For download please see my signature.

[supersonic]

Thank you for keeing your UDF so well maintained!

[water]

The AD, Outlook, Word and Excel UDFs are my babies

[WimBelgium]

Hi,

I've been using AutoIT and your AD UDF for some time, it's great!  I just run into something silly now and can't quickly find the work around so I thought let's ask it directly   Question is, how do I write multi valued AD fields like proxyaddresses? 

Snippet:

                $aTarget = "SMTP:" & $amailtostring
                $aSIP = "SIP:" & $amailtostring
                $aProxy = $aTarget & ";" & $aSIP
                _AD_ModifyAttribute($asAMAccountNameToString,"proxyaddresses",$aTarget,2)
                _AD_ModifyAttribute($asAMAccountNameToString,"proxyaddresses",$aSIP,3)

I've tried all I can imagine, writing with 2/3, putting in 1 $aProxy variable, using @CRLF / @CR / @LF .... you name it.

As you can already see from the snippet, I'm kind of a noob in it :-P

Appreciate your answer!
Wim

[water]

What is the value of @error and @extended after calling _AD_ModifyAttribute?
To modify proxyaddresses use function_AD_AddEmailAddress. This function makes sure that SMTP/smtp entries are handled correctly.

Edited July 11, 2016 by water

[WimBelgium]

@error and @extended are always 0, regardless if I run the _AD_Modify... above both with ,2 or ,3
When I run with ,3 nothing happens, when I run with ,2 only the last value SIP:%mail% gets insert in the proxyaddress AD field.

When I use the _AD_AddEmailAddress, it adds SMTP as a fixed header, in my case I need to be able to add SIP: too

[water]

Could you please post an example script so I see how you add your data?

[water]

In addition could you please insert

_AD_ErrorNotify(2)

at the top of your script?
Gives us better error information.

[WimBelgium]

Hi, sorry for late reply, I've been working on it and making progression but still some issues... I will try to explain little better.

Tool is some kind of a 'general user management' tool specific for our environment with multiple AD domains, migrations going on etc ... Following part of code gets triggered when a button is pressed, this is done in background, and then a GUI prompts to fill in extra fields which are not fixed, and also writes them back to AD

first _AD_Open with parameters

$array = _AD_GetObjectsInOU($sAD_OU_EUU, $sAD_Filter, 1)
$iMax=UBound($array)

For $i = 1 to $iMax -1
                Global $asAMAccountName = _AD_GetObjectProperties(($array[$i]), "sAMAccountName")
                Global $asAMAccountNameToString = _ArrayToString($asAMAccountName,"",1,1,@CRLF,1,1)
                Global $amail = _AD_GetObjectProperties(($array[$i]), "mail")
                Global $amailtostring = _ArrayToString($amail,"",1,1,@CRLF,1,1)
                Global $aEmpty = "smtp:"
                _AD_ModifyAttribute($asAMAccountNameToString,"userprincipalname",$amailtostring,2)
                _AD_ModifyAttribute($asAMAccountNameToString,"preferredLanguage","en-GB")
                $aTarget = "SMTP:" & $amailtostring
                $aSIP = "SIP:" & $amailtostring
                $aProxy = $aTarget & ";" & $aSIP
                _AD_ModifyAttribute($asAMAccountNameToString,"targetAddress",$aTarget)
                _AD_ModifyAttribute($asAMAccountNameToString,"extensionattribute14", "EU_S")
                $aMailNick = "EUU_" & $asAMAccountNameToString
                _AD_ModifyAttribute($asAMAccountNameToString,"mailnickname",$aMailNick)
                _AD_ModifyAttribute($asAMAccountNameToString,"proxyAddresses",$aEmpty)
                Global $iValue = _AD_AddEmailAddress($asAMAccountNameToString, $amailtostring,True)

To explain above:
- I first tried with $aTarget and $aSIP to use _Modify to add it to proxyaddress, but of course being an array that did not work
- using _AD_AddEmailAddress works great, I've adapted your code in AD.au3 to also include the SIP: using below code

    If $bPrimary Then
        For $iCount1 = 0 To UBound($aProxyAddresses) - 1
            If StringInStr($aProxyAddresses[$iCount1], "SMTP:", 1) Then
                $aProxyAddresses[$iCount1] = StringReplace($aProxyAddresses[$iCount1], "SMTP:", "smtp:", 0, 1)
            EndIf
        Next
        _ArrayAdd($aProxyAddresses, "SMTP:" & $sNewEmail)
        _ArrayAdd($aProxyAddresses, "SIP:" & $sNewEmail)  ==> Added
        $oUser.Put("mail", $sNewEmail)
    Else
        _ArrayAdd($aProxyAddresses, "smtp:" & $sNewEmail)
        _ArrayAdd($aProxyAddresses, "SIP:" & $sNewEmail)  ==> Added
    EndIf
    $oUser.PutEx(2, "proxyaddresses", $aProxyAddresses)

 

Problem: I get error if I don't fill the proxyaddress first with empty string _AD_ModifyAttribute($asAMAccountNameToString,"proxyAddresses",$aEmpty), see screenshot.  This is with a new user.

So question is, what am I doing wrong? Modify the AD.au3 wrong? Why do I need to write a string to proxyaddress field first ...

Appreciate the time and answer!

(and yes code looks like a mess probably, I'm a SysAdmin not a Dev :/)
 

[water]

This "error" on scriptline 3705 is just an information that tells you that retrieving the current value(s) of attribute proxyAddresses failed because the property has not been set yet.
If you do not get additional error messages then everything should work as expected.

[Juvigy]

 Hi Water,

I am trying to use _AD_IsObjectLocked($adaccount) but it gives me 0 and error is 0 although the account is locked._AD_UnlockObject($adaccount) is unlocking it.

If i do PowerShell - (Get-Aduser $user -Properties LockedOut).LockedOut it gives me TRUE - so the account is locked , it is locked when i check it manually in AD.

Do you know why?

[water]

Which version of the AD UDF do you run?

[Juvigy]

1.3.0.0

This is the code for the function:

expandcollapse popup

; #FUNCTION# ====================================================================================================================
; Name...........: _AD_IsObjectLocked
; Description ...: Returns 1 if the object (user account, computer account) is locked.
; Syntax.........: _AD_IsObjectLocked([$sAD_Object = @Username])
; Parameters ....: $sAD_Object - Optional: Object to check (default = @Username). Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
; Return values .: Success - 1, Specified object is locked, sets @error to:
;                  |x - number of minutes till the account is unlocked. -1 means the account has to be unlocked manually by an admin
;                  Failure - 0, sets @error to:
;                  |0 - $sAD_Object is not locked
;                  |1 - $sAD_Object could not be found
; Author ........: water
; Modified.......:
; Remarks .......: A $ sign must be appended to the computer name to create a correct sAMAccountName e.g. @ComputerName & "$"
;                  LockoutTime contains the timestamp when the object was locked. This value is not reset until the user/computer logs on again.
;                  LockoutTime could be > 0 even when the lockout already has expired.
; Related .......: _AD_GetObjectsLocked, _AD_UnlockObject
; Link ..........: http://www.pcreview.co.uk/forums/thread-1350048.php, http://www.rlmueller.net/IsUserLocked.htm, http://technet.microsoft.com/en-us/library/cc780271%28WS.10%29.aspx
; Example .......: Yes
; ===============================================================================================================================
Func _AD_IsObjectLocked($sAD_Object = @UserName)
    ;-------------------------------------------------------------
    ; HINT: To enhance performance this can also be written as:
    ;   $oUser = ObjGet("WinNT://<Domain>/<User>")
    ;   ConsoleWrite("Locked: " & $oUser.IsAccountLocked & @CRLF)
    ;-------------------------------------------------------------
    If Not _AD_ObjectExists($sAD_Object) Then Return SetError(1, 0, 0)
    Local $sAD_Property = "sAMAccountName"
    If StringMid($sAD_Object, 3, 1) = "=" Then $sAD_Property = "distinguishedName"; FQDN provided
    $__oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sAD_DNSDomain & ">;(" & $sAD_Property & "=" & $sAD_Object & ");ADsPath;subtree"
    Local $oAD_RecordSet = $__oAD_Command.Execute ; Retrieve the ADsPath for the object
    Local $sAD_LDAPEntry = $oAD_RecordSet.fields(0).value
    Local $oAD_Object = __AD_ObjGet($sAD_LDAPEntry) ; Retrieve the COM Object for the object
    Local $oAD_LockoutTime = $oAD_Object.LockoutTime
    ; Object is not locked out
    If Not IsObj($oAD_LockoutTime) Then Return
    ; Calculate lockout time (UTC)
    Local $sAD_LockoutTime = _DateAdd("s", Int(__AD_LargeInt2Double($oAD_LockoutTime.LowPart, $oAD_LockoutTime.HighPart) / (10000000)), "1601/01/01 00:00:00")
    ; Object is not locked out
    If $sAD_LockoutTime = "1601/01/01 00:00:00" Then Return
    ; Get password info - Account Lockout Duration
    Local $aAD_Temp = _AD_GetPasswordInfo($sAD_Object)
    ; if lockout duration is 0 (= unlock manually by admin needed) then no calculation is necessary. Set @error to -1 (minutes till the account is unlocked)
    If $aAD_Temp[5] = 0 Then Return SetError(-1, 0, 1)
    ; Calculate when the lockout will be reset
    Local $sAD_ResetLockoutTime = _DateAdd("n", $aAD_Temp[5], $sAD_LockoutTime)
    ; Compare to current date/time (UTC)
    Local $sAD_Now = _Date_Time_GetSystemTime()
    $sAD_Now = _Date_Time_SystemTimeToDateTimeStr($sAD_Now, 1)
    If $sAD_ResetLockoutTime >= $sAD_Now Then Return SetError(_DateDiff("n", $sAD_Now, $sAD_ResetLockoutTime), 0, 1)
    Return
EndFunc   ;==>_AD_IsObjectLocked