Active Directory UDF - Help & Support (III)

[water]

Listing printer queues gets you all queues. If you need to get a list of printers assigned to a user you need to run WMI (examples can be found on the forum).

[water]

_AD_Open() Global $sFQDN = _AD_SamAccountNameToFQDN(GuiCtrlRead($Username)) Global $sDisplayName = _AD_FQDNToDisplayname(GuiCtrlRead($Username))

To get the password info from another account? I am still playing around with it but its a theory atm that i havent pushed on much. >.>

All functions accept the SamAccountName or the FQDN to identify a user object. Not need to call _AD_SamAccountNameToFQDN any longer.

[Ragnarok]

Hi water - I posted over on General Help instead of here (Oops!)  Thanks for all the work you've done on this UDF!

[Ragnarok]

I've realized that separating out the return messages probably wasn't a good idea.  It's changed the message to a return code 2 from AD.

[Ragnarok]

I feel...rather embarassed - seems I had the domain in the username variables and I forgot to remove.  

Thanks again for this awesome UDF!

[water]

Glad you like the UDF and that everything is now working fine for you!

[water]

Version 1.4.2.0 of the UDF has been released.

Now runs with all versions of AutoIt >= 3.3.8.1.

Please test before using in production!

For download please see my signature.

[Neutro]

Hey water,

Just letting you know: I have a bug using AD UDF to retreive the content of the "domain users" group in our AD using "_AD_GetGroupMembers("domain users")".

This only retreives 1 random user of this group.

However, if I do this instead it is working (retreiving 292 users):

_AD_GetObjectsInOU("", "(&(objectcategory=person)(objectclass=user)(name=*))", 2, "sAMAccountName")

Maybe you can try this yourself to see if it's only from me or not

 

 

Edited September 3, 2015 by Neutro

[water]

You can't query a primary group this way. You would get too many results.
But you can do the query the other way round. Query all users where the primary groups is "domain users".

Use function _AD_GetObjectsInOu and query for "(&(objectCategory=person)(objectClass=user)(primaryGroupID=513))"

[Neutro]

Yeah that's what I figured out

Thanks again

[31290]

Hi there, 

First, many thanks for this UDF which is awesome. Thanks to that many ideas pops out of my mind for my day to day work. 
Although I read a lot of things about using it or so, I still can't figure out somethings so I was wondering if you could help.

First idea here @ work is to write a simple GUI that allow us (the IT team) to get every groups a computer belongs to and add some if needed. To get familiar with your UDF, I first tried to get some attributes of a single user:

But I always have the msgbox that I can't get the AD-information of the user. I've tested my connection to the AD and I'm connected.

Here's my code so far:

expandcollapse popup

Opt("GUIOnEventMode", 1) ; Only needed once

Global $sT0_AdminUserName, $sT0_AdminUserPassword, $sT0_DomainName, $sT0_DomainController, $sT0_ConfigurationContext, $iRunning

Global $sIniFile = @ScriptDir & "\ADAT.INI"

$sT0_AdminUserName = IniRead($sIniFile, "ADAT", "AdminUserName", "")
$sT0_AdminUserPassword = IniRead($sIniFile, "ADAT", "AdminPassword", "")
$sT0_DomainName = IniRead($sIniFile, "ADAT", "DomainName", "")
$sT0_DomainController = IniRead($sIniFile, "ADAT", "DomainController", "")
$sT0_ConfigurationContext = IniRead($sIniFile, "ADAT", "ConfigurationContext", "")

_AD_Open($sT0_AdminUserName, $sT0_AdminUserPassword, $sT0_DomainName, $sT0_DomainController, $sT0_ConfigurationContext)

If @error Then
Msgbox (0, "", "Not connected")
Else
Msgbox (0, "", "Connected")
Endif

Global $LoginfoGUI = GUICreate("AG GROUPS", 300, 300, -1, -1)
GUISetFont(8.5, 700, 0)
GUISetBkColor ($Color_White)
GUISetOnEvent($GUI_EVENT_CLOSE, "_Exit", $LoginfoGUI)
GUICtrlCreateLabel("COMPUTER #:", 10, 170)
Global $SWNmbInput = GUICtrlCreateInput("", 100, 168, 80, 20,$GUI_FOCUS)
GUICtrlCreateButton("GET COMPUTER GROUPS", 5, 220)
GUICtrlSetOnEvent(-1,"getGroups")
GUISetState()
$iRunning = 1
While $iRunning = 1
Sleep (10)
Wend

Func getGroups()
_AD_Open($sT0_AdminUserName, $sT0_AdminUserPassword, $sT0_DomainName, $sT0_DomainController, $sT0_ConfigurationContext)
Global $sUser = @UserName
$sResult = _AD_GetObjectAttribute($sUser, "First Name")
If @error Then
    MsgBox(0, "Error", "Error " & @error & " returned when retrieving AD-information for user " & $sUser)
Else
    MsgBox(0, "Result", "Description for user " & $sUser & ": " & $sResult)
EndIf
_AD_Close()
EndFunc
    
Func _Exit()
Exit
EndFunc

Thanks for your time

[water]

Call _AD_Open only a single time in your script (means: remove _AD_Open from function Getgroups).
_AD_GetObjectAttribute needs a valid attribute name. Try "givenName" instead of "First Name".

[31290]

Ok, that's perfect. Many thanks for this. And sorry to bother you again but I'm barely new to AD scripting since I found your UDF today

Do you know where I can find a list of correct "names" like that. I mean "givenName" instead of what I was looking for? Should I always use LDAP Properties?

If you don't mind, I'd like to request some help regarding getting the list of a computer membership and how can I add/remove them for a computer. I know the exact name of the groups, an in which OU they are located. 

See you

[water]

A list can be found here. You have to use the Ldap-Display-Name.

[water]

 

If you don't mind, I'd like to request some help regarding getting the list of a computer membership and how can I add/remove them for a computer. I know the exact name of the groups, an in which OU they are located. 

See you

_AD_RecursiveGetMemberOf should return a recursive list of groups the computer is a member of.
With _AD_RemoveUserFromGroup (despite the name) you should be able to remove the computer from a group.

[31290]

Ok, many thanks again.

 

I managed to get this work with a username, but I can't see how to integrate a computername. I've read the help file coming with this function but this is not mentioned with a computer.

Any clues?

I think reading current membership will be easy but the main point of the software is to add groups to a given computer which is not member of.

See you

Edit: I read and tried this

$aUser = _AD_GetUserGroups(@ComputerName & "$")

But this is not working :/

Edited September 17, 2015 by 31290
new info

[water]

What is the value of @error after calling the function?

[31290]

Yuk :/ i made a typo... But this is now fully working, I have the list of the membership of my computer. I just now ave to made a nice GUI for other tech to choose any other computers and this will do the trick. 

The only thing I would like to ask is how to add a group? For instance, I'd like to make a signle button that will add a set of groups that we put by default to any other computer here@ work.

Also I saw about changing passwords and so, This going to be a very nice and useful AD toolbox that I'm going to write.

 

Many thanks again for the help you would give to me.

[water]

You could have a look the AD example scripts section (please check my signature). ADAT (Active Directory Administration Tool) should give you an idea. 

Every function has its own tab. So the script can easily be extended. 

[31290]

You could have a look the AD example scripts section (please check my signature). ADAT (Active Directory Administration Tool) should give you an idea. 

Every function has its own tab. So the script can easily be extended. 

Yes, I've already setup ADAT and play with it. It's very nice and I surely pick up some functionalities.  The main point for me is to add groups to a given computer, which I did not find anywhere.

Edited September 17, 2015 by 31290
more help