Active Directory UDF - Help & Support (III)

[water]

You have to add a "$" at the end of the computername:

#include <AD.au3>
_AD_Open()
ConsoleWrite(@ComputerName & @CRLF)
ConsoleWrite("  " & @ComputerName & " : " & _AD_ObjectExists(@ComputerName) & @CRLF)
ConsoleWrite("  " & @ComputerName & "$: " & _AD_ObjectExists(@ComputerName & "$") & @CRLF)
_AD_Close()

 

[Subz]

$ needs to be appended for example:

#include <AD.au3>

_AD_Open()
    MsgBox(4096, "", _AD_ObjectExists(@ComputerName & "$"))
_AD_Close()

 

[nikink]

D'oh!

Massive facepalm to me and thankyou! Works like a charm when you format it right! 😐

[DonChunior]

We have a few AD user accounts where the userWorkstations attribute has a list of machine names entered.
I can't manage to query this attribute with the AD UDF:

#include <AD.au3>

Main()

Func Main()
    Local $sUserWorkstations = ""

    _AD_Open()
    _AD_ErrorNotify(1)
    $sUserWorkstations = _AD_GetObjectAttribute("ExampleUsername", "userWorkstations")
    _AD_Close()
EndFunc

The console output is as follows:

COM Error Encountered in test.au3
AD UDF version = 1.6.1
@AutoItVersion = 3.3.14.5
@AutoItX64 = 1
@Compiled = 0
@OSArch = X64
@OSVersion = WIN_10
Scriptline = 2184
NumberHex = 0x80020009
Number = -2147352567
WinDescription = Ausnahmefehler aufgetreten.
Description = Die Verzeichniseigenschaft wurden nicht im Cache gefunden.
Source = Active Directory
HelpFile = 
HelpContext = 0
LastDllError = 0
========================================================

 

Edited May 9, 2022 by DonChunior
Added link to description of userWorkstations attribute.

[water]

Seems the property has not been set for the specified user. 
What do you get when you run the AD_GetObjectProperies example script for this user?

[DonChunior]

userWorkstations is definitely set.
And the function _AD_GetObjectProperties() returns a perfect array with all attributes and values of the corresponding user account - only userWorkstations is missing here too. 

[water]

Will have a look

[Subz]

Are you sure the attribute is being replicated between DCs?  In our environment the isMemberOfPartialAttributeSet is set to null meaning it's not replicated.  To verify used the following:

Computer running script is connected to DC1

• Added @ComputerName to userWorkstations attribute on DC2
  nb: Noticed that the data wasn't replicated to DC1
• Running the script I received the same results as above
• Added @ComputerName to userWorkstations attribute on DC1
• Ran the script without error and it returned the @ComputerName correctly

[water]

MS tells us that the userWorkstations attribute should not be used any longer: https://docs.microsoft.com/en-za/windows/win32/adschema/a-userworkstations

Recommended setting is described here: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/allow-log-on-locally

Might be the cause of your problem.

Good reading: http://woshub.com/restrict-workstation-logon-ad-users/

[water]

Another idea is to try _AD_GetObjectAttribute.

[DonChunior]

14 hours ago, Subz said:

Are you sure the attribute is being replicated between DCs?  In our environment the isMemberOfPartialAttributeSet is set to null meaning it's not replicated.

Thanks for the crucial hint, @Subz!
In fact, I have always queried the global catalog before.
Now that I have changed this to the local DC, I also see the userWorkstations property.
Learned something again. 👨‍🎓

[PlayZoneUK]

Hi @water, I'm in the process of creating a tool to make account administration easier for my organisation using your fantastic AD UDF. I'm currently looking at the _AD_SetAccountExpire function and its not behaving as expected (using v1.6.1.0).

If I want to expire an account on 2022-12-12 for some reason it sets the AD account to expire 10th December 2022.

If I use 2022-10-10 it sets the account to expire on  09th October 2022...

Any ideas?

 

Kind Regards

PlayZoneUK

[water]

Which tool do you use to get the date you have set by _AD_SetAccountExpire?
ADUC or the AD UDF?

[PlayZoneUK]

Hi water, I tested using the _AD_SetAccountExpire.au3 included in the Examples directory of the UDF.

I was reviewing the Examples to see how they behave before integration in to the tool   

[water]

In the last 3 paragraphs of this page you get an explanation why the expiration date seems to be wrong by two days:

Account Expiration (rlmueller.net)

I refer to this page in the help file for _AD_SetAccountExpire as well.

[PlayZoneUK]

Doh!... thanks for the assist water, I'll just code the utility to add on an additional two days to the date... not great but at least it won't expire an account before the allotted time.

Thanks again

Edited June 23, 2022 by PlayZoneUK

[gcue]

how can i get JUST displayname or JUST sAMAccountName?

this works but i get both values - Value1 (Value2)

$aObjects = _AD_GetObjectsInOU("", "(proxyAddresses=smtp:" & $email & ")", 2, "displayname,sAMAccountName") 

this doesn't work

$aObjects = _AD_GetObjectsInOU("", "(proxyAddresses=smtp:" & $email & ")", 2, "displayname")

get the following error

Quote

Array variable has incorrect number of subscripts or subscript dimension range exceeded.:
$var = $aObjects[1][0]
$var = ^ ERROR

thanks in advance!

Edited October 20, 2022 by gcue

[gcue]

nevermind just figured it out!  the error was being produced because of another line i had below - error wasnt triggering but the line below was triggering error itself.. 

If @error Then
   Return SetError(1)
EndIf

$arr = $aObjects[1][0]

having difficulty getting differentiating between users and shared mailboxes.  i am trying to get sAMAccountName if its a user and displayname if its a sharedmailbox.  going through long list of both users and shared mailboxes.  in ad they both show as user type objects

Edited October 20, 2022 by gcue

[gcue]

was able to resolve... was no need to differentiate

$sam_account = Get_SamAccountName($email)
$common_name = Get_CommonName($sam_account)

Func Get_SamAccountName($email)

    $aObjects = _AD_GetObjectsInOU("", "(proxyAddresses=smtp:" & $email & ")", 2, "sAMAccountName")

    If @error Then
        Return SetError(1)
    EndIf

    $sam_account = $aObjects[1]

    Return $sam_account

EndFunc

Func Get_CommonName($sam_acct)

    $details_array = _AD_GetObjectProperties($sam_acct, "cn")

    If @error Then
        Return SetError(1)
    EndIf

    $cn = $details_array[1][1]

    Return $cn

EndFunc

 

[Ostap]

Moved to new computer, installed AutoIT3 + AD.au3. Checker found below error: 

"C:\Program Files (x86)\AutoIt3\Include\AD.au3"(5,10) : error: can't open include file <WinAPIConv.au3>.

My "include" files: 

#include <File.au3>
#include <FileConstants.au3>
#include <GuiConstants.au3>
#include <MsgBoxConstants.au3>
#include <ProgressConstants.au3>
#include <Inet2.au3>
#include <Array.au3>
#include <String.au3>
#include <AD.au3>

This is AD.au3 that looks for WinAPIConv.au3. Where can I get WinAPIConv.au3?