LDAP Filtering with _AD_GetObjectsInOU

[water]

I wonder why you get "mydomain.internal/Users/Service Contractor"
The LDAP query should return something like this: "cn=John Doe,ou=People,dc=sun.com"

[antmar904]

Here is the quick test script:

#include <AD.au3>
#include <MsgBoxConstants.au3>

_AD_Open()
If @error Then Exit MsgBox("", "", "Active Directory Error. Function _AD_Open encountered a problem. Error: " & @error & " extended error: " & @extended)

$aUserObjects = _AD_GetObjectsInOU("", "(&(objectcategory=person)(objectclass=user)(cn=*Contractor*))", 2, "sAMAccountName,Name")

;Debug
_ArrayDisplay($aUserObjects)
_AD_Close()
Exit

I'm using AD.au3 version 1.6.1.0

Edited March 3, 2023 by antmar904

[water]

Does the domain controller (DC) you connect to hold more than one contractor user?
Can you modify the _AD_Open statement in your last post to connect to the Global Catalogue (GC)?

[antmar904]

Yes, the DC holds more accounts with either "consultants" or "contractor" in their cn.

I modified to connect to GC on port 3269 and still only returned one results.

[antmar904]

Also, when I use powershell "Get-Aduser username -pr *" the CN attribute retuned is the whole users display name BUT the CanonicalName attribute returns what I want to search for in my script...

[water]

"The distinguished name http://msdn.microsoft.com/en-us/library/windows/desktop/aa366101(v=vs.85).aspx is the hierarchical path where you will find the object within AD for example "CN=Jeff Smith,OU=Sales,DC=Fabrikam,DC=COM"

The canonical name is the same as the distinguished one but in different writing, with slashes and ordered the other way around: COM/FABRIKAM/SALES/SMITH for example."

The canonicalName attribute is constructed, also called operational. This means the value is not actually saved in AD, but is constructed by the DC when you request the value.
Thats why you can't search for the canonicalName attribute.

Unfortunately you can't use a wildcard with a distinguishedName (according to the X.500 standards). So you have to do it yourself.

I suggest to grab displayname, title, description and samAccountname for all users with the (!userAccountControl:1.2.840.113556.1.4.803:=2) and then then loop through the returned array to grab the users you want to process (means test the displayname and the expiration date).

I further suggest to re-structure your AD. Put all Contractors in a separate OU and all Consultants in another OU.