Active Directory UDF - Help & Support

[Syed23]

Error 0x80020009 most of the time is caused by missing permissions.

Is it possible that you are not allowed to read all properties?

Yeah! There are some properties which i can't read with my ID which need special Administrator id. also is there a way to enhance the function if there is any permission issue to handle that error ?

Edited March 29, 2012 by Syed23

[water]

Insert this line

If @error Then Return SetError(2, @error, 0)

after

Local $sAD_AccountExpires = $oAD_Object.AccountExpirationDate

in function_AD_IsAccountExpired.

If there is an error in accessing the property @error will be set to 2 and @extended to the hex error code.

Can you give it a try?

[Syed23]

Insert this line

If @error Then Return SetError(2, @error, 0)

after

Local $sAD_AccountExpires = $oAD_Object.AccountExpirationDate

in function_AD_IsAccountExpired.

If there is an error in accessing the property @error will be set to 2 and @extended to the hex error code.

Can you give it a try?

Gave a try and now it returns the value as 0 Thanks! i will update error value as -1 and update myself in your UDF as no permissions is that fine ? can i modify your UDF on my machine ?

[water]

You can update the UDF version on your machine any time. But if you download a newer version of my UDF to the same directory your changes will be lost.

I would suggest to check @error like this:

Local $iResult = Global $iResult = _AD_IsAccountExpired()
If @error Then
    MsgBox(16, "Active Directory Example Skript", "Function _AD_IsAccountExpired encountered a problem. @error = " & @error & ", @extended = " & @extended)
ElseIf $iResult = 1 Then
    MsgBox(64, "Active Directory Functions", "User account '" & @UserName & "' has expired")
Else
    MsgBox(64, "Active Directory Functions", "User account '" & @UserName & "' has not expired")
EndIf

[kor]

narrowed it down to the following code generating the error.

Local $iCreate = _AD_CreateUser($sOU, $sUsername, $sFirstName & " " & $sLastName) ; create user
        If $iCreate = 0 Then _Message("ERROR - Unable to create user object", True)

EDIT: discovered that $sFirstName and $sLastName were formatted incorrectly earlier in the script and was passing them as blank values.

However, the AD script should handle blank values a little better in my opinion rather than throwing a COM error.

Edited April 4, 2012 by kor

[water]

_AD_CreateUser at the moment checks for "" and throws an error. You provided at least one space so the function doesn't see an error (at the moment).

I will implement StringStripWS so spaces will give you an error as well. OK?

[kor]

_AD_CreateUser at the moment checks for "" and throws an error. You provided at least one space so the function doesn't see an error (at the moment).

I will implement StringStripWS so spaces will give you an error as well. OK?

That would work. Granted it's my fault for not making sure I'm passing properly formatted variables to the function, but throwing an easier to decipher error message inside autoit might help you when someone new comes in and doesn't understand COM errors.

[gcue]

hi again water

i am trying to use _AD_IsMemberOf - works great when i use it with user names checking against a group. however, i am trying to use it to check if a computer object belongs to a group. it looks like the object is fully quantified in the group so i get false results.

i also tried using _AD_SamAccountNameToFQDN to get fqdn for the computer object to see if i can put that in as the object but _AD_SamAccountNameToFQDN came back blank.

any other workaround?

[water]

When you talk about names you talk about the SamAccountName. The SamAccountname of a computer has an appended Dollar-Sign. So the SamAccountName of your computer would be: @Computername & "$".

[gcue]

worked like a charm! maybe something to include in the function notes? is there anything you dont know water?

[water]

There is a note about the required dollar in function _AD_SamAccountNameToFQDN, _AD_ObjectExists, _AD_IsObjectDisabled, _AD_IsObjectLocked, _AD_AddUserToGroup, _AD_RemoveUserFromGroup.

As well as in the Wiki section 'Tips & Tricks': The SamAccountName of a computer is the computername with a trailing "$" e.g. @ComputerName & "$"

Enough?

[gcue]

ur right! my apologies..

[paullauze]

i get this error when tryint to move a user to a new OU

return code '-214735267' from active directory

[water]

Which version of the UDF do you use?

[paullauze]

2011-12-19 - Version 1.2.0

[water]

Fine. Then please add

$iAD_Debug = 2

after the #include <ad.au3> statement and post the resulting MsgBox.

Edited April 23, 2012 by water

[paullauze]

now i get

COM error Encountered

AD UDF version 1.2.0

scriptline = 2559

NubmerHex = 800200009

Number = -2147352567

WinDescription = There is a naming Violation

the path i am trying to move the user to is:

OU=USERS,OU=BLAH,DC=WORK,DC=NET

[water]

Can you please post all parameters you use for function _AD_MoveObject?

[paullauze]

#include <AD.au3>

$iAD_Debug = 2

_AD_Open()

$sTargetOU = "OU=Users,OU=Blah,DC=Work,DC=net"

$sObject = _AD_SamAccountNameToFQDN("TESTUSER")

Global $iValue = _AD_MoveObject($sTargetOU, $sObject)

If $iValue = 1 Then

MsgBox(64, "Active Directory Functions - Example 1", "Object '" & $sObject & "' successfully moved to '" & $sTargetOU & "'")

ElseIf @error = 1 Then

MsgBox(64, "Active Directory Functions - Example 1", "Target OU '" & $sTargetOU & "' does not exist")

ElseIf @error = 2 Then

MsgBox(64, "Active Directory Functions - Example 1", "Object '" & $sObject & "' does not exist")

Else

MsgBox(64, "Active Directory Functions - Example 1", "Return code '" & @error & "' from Active Directory")

EndIf

_AD_Close()

; this is an excerpt from the example included in the UDF.

I dont get an target OU does not exist error so i am pretty sure the path is correct.

[water]

What's the value of $sObject after _AD_SamAccountNameToFQDN?