Active Directory UDF - Help & Support (III)

[guaikahenguai]

16 hours ago, water said:

You could add _AD_ErrorNotify(1) at the top of your script so we get more detailed error information.

COM Error Encountered in _AD_DisablePasswordChange.exe
AD UDF version = 1.6.1
@AutoItVersion = 3.3.15.4
@AutoItX64 = 0
@Compiled = 1
@OSArch = X64
@OSVersion = WIN_10
Scriptline = -1
NumberHex = 0x80020009
Number = -2147352567
WinDescription = Exception occurred.
Description = 
Source = 
HelpFile = 
HelpContext = 0
LastDllError = 0

[water]

Unfortunately this is a very general error code - it doesn't tell us much 😞
Could you please run your script uncompiled so we get at least the scriptline where the error occurs?

 

 

[guaikahenguai]

1 hour ago, water said:

Unfortunately this is a very general error code - it doesn't tell us much 😞
Could you please run your script uncompiled so we get at least the scriptline where the error occurs?

 

 

Running an uncompiled script does not display a script error  line. The script runs normally but does not display a run error message, just setting will not take effect.

Weird thing: The same script works on a domain controller, but setting will not take effect on a domain member computer. At a loss to understand.🤔

This problem can't be solved?

That's really a pity.😔

[water]

There should be no difference if running compiled or uncompiled regarding errors. You should get the same error message on your SciTE console.

2 hours ago, guaikahenguai said:

Weird thing: The same script works on a domain controller, but setting will not take effect on a domain member computer. At a loss to understand.🤔

This sounds like a permission problem. In my opinion you should talk to your AD admin.

[guaikahenguai]

20 hours ago, water said:

There should be no difference if running compiled or uncompiled regarding errors. You should get the same error message on your SciTE console.

This sounds like a permission problem. In my opinion you should talk to your AD admin.

COM Error Encountered in _AD_DisablePasswordChange.au3
AD UDF version = 1.6.1
@AutoItVersion = 3.3.15.4
@AutoItX64 = 1
@Compiled = 0
@OSArch = X64
@OSVersion = WIN_10
Scriptline = 1328
NumberHex = 0x80020009
Number = -2147352567
WinDescription = Exception occurred.
Description = 
Source = 
HelpFile = 
HelpContext = 0
LastDllError = 0
========================================================
Result: 1, error: 0, extended: 0

 

How to view "Scriptline = 1328".My script is only 89 lines in total.

[guaikahenguai]

11 minutes ago, guaikahenguai said:

COM Error Encountered in _AD_DisablePasswordChange.au3
AD UDF version = 1.6.1
@AutoItVersion = 3.3.15.4
@AutoItX64 = 1
@Compiled = 0
@OSArch = X64
@OSVersion = WIN_10
Scriptline = 1328
NumberHex = 0x80020009
Number = -2147352567
WinDescription = Exception occurred.
Description = 
Source = 
HelpFile = 
HelpContext = 0
LastDllError = 0
========================================================
Result: 1, error: 0, extended: 0

 

How to view "Scriptline = 1328".My script is only 89 lines in total.

I found this Scriptline by my own method：

$oObject.Put("ntSecurityDescriptor", $oSD)

 

[chaoticyeshua]

Hello,

With Microsoft's domain join changes mentioned in this article, I am needing a way to prompt a local user account for a technician's AD credentials and then use those credentials to change ownership of a computer object to their AD account to complete the domain join using their credentials. We used to use a service account, but this will no longer function as of this September since it is not the owner of the AD objects. I've been told by our Enterprise Systems team that they will not implement the group policy on the domain controllers to allow specified users/groups to join computers to the domain, and have instead been instructed to delete computer objects and have them get auto-created by a manual domain join process. This is unacceptable to me and would prefer to automate ownership changes. However, I don't see a way in your UDF to change ownership of an object. Is there a way to do that? Thank you for any assistance you can provide.

[water]

My UDF does not provide such a function.
But you could use PowerShell or DSACLS for this task as described here.

[chaoticyeshua]

7 minutes ago, water said:

My UDF does not provide such a function.
But you could use PowerShell or DSACLS for this task as described here.

Thanks for the recommendation!

[MWIProd]

Hi water,

I don't know if this is a bug but function _AD_GetGroupMembers() doesn't list users where UserPrimaryGroup is not "Domain Users".

Best regards.

[water]

You mean you want to get the members of group x and _AD_GetGroupMembers does not return those users who have set their UserPrimaryGroup to group x?

Edited August 11, 2023 by water

[MWIProd]

Yes...

And you will answer it is normal ?! 😅 

Edited August 17, 2023 by MWIProd

[water]

Kind of

Only the functions _AD_GetUserGroups and _AD_IsMemberOf currently handle the PrimaryGroup.

The PrimaryGroup works the other way round. Means: The group members are not stored in the group, but the PrimaryGroup is stored in a property of the user.

We now have the functions _AD_GetUserPrimaryGroup and _AD_SetUserPrimaryGroup. Perhaps a new function to list all members of a specific Primary Group would be appropriate plus adding the corresponding comments to _AD_GetGroupMembers?

N.B.: I no longer have access to an Active Directory server. So if you vote for a new function all testing needs to be done by you.

Edited August 17, 2023 by water

[Saad]

Hello everyone,

The return of _AD_GetAllOUs($sOU, "\", 2) is missing the below OUs.

Builtin
LostAndFound
Microsoft Exchange System Objects

#include <AD.au3>

_AD_Open()
If @error Then
    MsgBox(0, @error, @extended)
Else
    Local $aOUs = _AD_GetAllOUs("", "\", 2)
    _AD_Close()
    _ArrayDisplay($aOUs)
EndIf

Thoughts?

[water]

Seems this are hidden OUs.
Need to investigate how to query such objects.
Unfortunately I do no longer have access to an Active Directory. So it will take some time and testing needs to be done by you.