Trying to learn to use COM objects...

PsaltyDS · June 15, 2006

I am trying to use COM objects. With help from this forum, this is what I use now:

;--------------------------------------
; Function _ComErrFunc()
;   Custom COM object error handler
;--------------------------------------
Func _ComErrFunc()
    Local $HexNumber = Hex($oComError.number, 8)
    _FileWriteLog($LogFile, "COM Error!  Number is: " & $HexNumber & "Linenbr is: " & $oComError.scriptline & _
            "Description is: " & $oComError.description & "Windescription is: " & $oComError.windescription)
    SetError(1); something to check for when this function returns
EndFunc   ;==>_ComErrFunc


;--------------------------------------
; Function _Add_LocalUser
;   Call with:  _Add_LocalUser($sNewUsrName, $sNewUsrPass [, $sNewUsrFull] [, $sNewUsrDesc]) where:
;       $sNewUsrName = UserName to add
;       $sNewUsrPass = New user's password
;       $sNewUsrFull = (optional) User's full name
;       $sNewUsrDesc = (optional) User's description (comment)
;   Returns 1 for good, 0 for bad
;--------------------------------------
Func _Add_LocalUser($sNewUsrName, $sNewUsrPass, $sNewUsrFull = "", $sNewUsrDesc = "")
    Local $colLocalComputer, $objUser
    
    ; Init COM object
    $colLocalComputer = ObjGet("WinNT://" & @ComputerName)
    
    ; Create user
    $objUser = $colLocalComputer.Create ("user", $sNewUsrName)
    
    ; Apply properties to user
    $objUser.SetPassword ($sNewUsrPass)
    $objUser.Put ("Fullname", $sNewUsrFull)
    $objUser.Put ("Description", $sNewUsrDesc)
    $objUser.SetInfo
    If @error Then
        _FileWriteLog($LogFile, "Error in _Add_LocalUser() adding user: " & $sNewUsrName)
        Return 0
    Else
        _FileWriteLog($LogFile, "Successfully added new user: " & $sNewUsrName)
        Return 1
    EndIf
EndFunc   ;==>_Add_LocalUser

What I want to do is deal with more of the user's properties.

Drilling down in MSDN, I wind up at the IADsUser page.

I see in there the SetPassword, Put, and SetInfo meathods. The problem is the list of things I can do. The full list on that web page only applies to Active Directory, not user in the local SAM. Is there a specific list of what properties apply to a "user" object?

The link on that page to the 'Put Meathod' is generic and doesn't tell me what properties might be there for my given object ('user' in this case).

For the moment this is about the "User must change password at next logon" property (which I don't see), but I am asking in a more general sense, so I learn how find these things myself.

PsaltyDS · June 16, 2006

I'm sorry, did I bump this thread?

PsaltyDS · June 16, 2006

Oops... bumped it again. I'm so clumsy! :">

big_daddy · June 16, 2006

You were so close! You needed to add , "Computer".

;--------------------------------------
; Function _Add_LocalUser
;   Call with:  _Add_LocalUser($sNewUsrName, $sNewUsrPass [, $sNewUsrFull] [, $sNewUsrDesc]) where:
;     $sNewUsrName = UserName to add
;     $sNewUsrPass = New user's password
;     $sNewUsrFull = (optional) User's full name
;     $sNewUsrDesc = (optional) User's description (comment)
;   Returns 1 for good, 0 for bad
;--------------------------------------
Func _Add_LocalUser($sNewUsrName, $sNewUsrPass, $sNewUsrFull = "", $sNewUsrDesc = "")
    Local $colLocalComputer, $objUser
   
    ; Init COM object
    $colLocalComputer = ObjGet("WinNT://" & @ComputerName, "Computer")
   
    ; Create user
    $objUser = $colLocalComputer.Create ("user", $sNewUsrName)
   
    ; Apply properties to user
    $objUser.SetPassword ($sNewUsrPass)
    $objUser.Put ("Fullname", $sNewUsrFull)
    $objUser.Put ("Description", $sNewUsrDesc)
    $objUser.SetInfo
    If @error Then
        _FileWriteLog($LogFile, "Error in _Add_LocalUser() adding user: " & $sNewUsrName)
        Return 0
    Else
        _FileWriteLog($LogFile, "Successfully added new user: " & $sNewUsrName)
        Return 1
    EndIf
EndFunc   ;==>_Add_LocalUser

I just reread your question, and from what I can tell you can't set the "User must change password at next logon" property for a local account.

Edited June 16, 2006 by big_daddy

PsaltyDS · June 16, 2006

You were so close! You needed to add ', "Computer"'.
; Init COM object
    $colLocalComputer = ObjGet("WinNT://" & @ComputerName, "Computer")oÝ÷ Ûú®¢×ißÙ§¢Û(²êÞz¹¦#fë-æ«)à¶¬µêæz%¢ºÖrÝx-¢Ø^Áæéj®®
I trimmed off the & "" part becuase it looked like a useless appendix sticking out there.

What I'm trying to figure out (or find out where to look up) is under the WinNT "provider", under the User "Object", what are the properties I can change with the Put "meathod"? Specificaly, is there one for the checkbox in the GUI labeled "User must change password at next logon", so I can make sure that gets turned OFF on my new users?

Sorry for the COM-Object-Newbie questions, but I don't even know if I have the terminology straight yet. This is my practical example on which to learn these things.

big_daddy · June 16, 2006

Your right it does work both ways. Though according to this it should not:

To create a local user, bind to a target computer, as shown in the following code example.

Dim mach As IADsContainer
Dim usr as IADsUser

On Error GoTo Cleanup
Set mach = GetObject("WinNT://MyMachine,Computer")
Set usr = mach.Create("user","jeffsmith")
usr.SetInfo

Cleanup:
    If(Err.Number<>0) Then
        MsgBox("An error has occurred. " & Err.Number)
    End If
    Set mach = Nothing
    Set usr = Nothing

I think what you are looking for is this, but it only works for AD Accounts.

$objUser.Put ("PwdLastSet", 0) ; Change pwd at next login
$objUser.Put ("PwdLastSet", 1) ; password never expires
$objUser.Put ("PwdLastSet", -1) ; "pwdLastSet = today"

Edited June 16, 2006 by big_daddy

PsaltyDS · June 16, 2006

I think what you are looking for is this, but it only works for AD Accounts.

$objUser.Put ("PwdLastSet", 0) ; this will force password changeoÝ÷ Ûú®¢×v÷öÛ§uêìµ©ÝÂ¦º)z»r¶ÊkzÇ§¶)Ú§¢éíq©÷öÖÞiÇ²Çnëm«wöÌ!Ë¥¢÷Êè²íwÜ:²}ý¶ÇÚyªk¡¹^Øhº@qÊ.ÛæyØ§¶PZ½ê®¢Ù®²×!jx¥«,ÂÝªê-±ë[É×jémnëZqÊ.ÛæyÛa® Øb°#¡¸Þr×hm²ßÛ'¢Û.r^jRn²×ëºËkjØ§(ºWgßÛe¢-«n¦¸ Ûaz·°ØT±êèn7¶)ß¢¹¶*'6ax(ØZ¶ z×¥Éºy^²Â&Ëv+p'!q©ÛyÚ'zZjTáÈ¬+^²Ö®¶seôFEôÆö6ÅW6W"gV÷CµFW7EW6W#gV÷C²ÂgV÷C´3×ÆWb333·GgV÷C²ÂgV÷CµFW7BW6W"öæRgV÷C²ÂgV÷C´×FW7BW6W"âgV÷C² £²ÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÐ£²gVæ7FöâôFEôÆö6ÅW6W £²6ÆÂvF¢ôFEôÆö6ÅW6W"b33c·4æWuW7$æÖRÂb33c·4æWuW7%72²Âb33c·4æWuW7$gVÆÅÒ²Âb33c·4æWuW7$FW65ÒvW&S £²b33c·4æWuW7$æÖRÒW6W$æÖRFòF@£²b33c·4æWuW7%72ÒæWrW6W"b33·277v÷&@£²b33c·4æWuW7$gVÆÂÒ÷FöæÂW6W"b33·2gVÆÂæÖP£²b33c·4æWuW7$FW62Ò÷FöæÂW6W"b33·2FW67&Föâ6öÖÖVçB£²&WGW&ç2f÷"vööBÂf÷"&@£²ÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÒÐ¤gVæ2ôFEôÆö6ÅW6W"b33c·4æWuW7$æÖRÂb33c·4æWuW7%72Âb33c·4æWuW7$gVÆÂÒgV÷C²gV÷C²Âb33c·4æWuW7$FW62ÒgV÷C²gV÷C² Æö6Âb33c¶6öÄÆö6Ä6ö×WFW"Âb33c¶ö&¥W6W   ²æB4ôÒö&¦V7@ b33c¶6öÄÆö6Ä6ö×WFW"Òö&¤vWBgV÷CµväåC¢òògV÷C²f×²6ö×WFW$æÖR  ²7&VFRW6W  b33c¶ö&¥W6W"Òb33c¶6öÄÆö6Ä6ö×WFW"ä7&VFRgV÷C·W6W"gV÷C²Âb33c·4æWuW7$æÖR  ²Ç&÷W'FW2FòW6W  b33c¶ö&¥W6W"å6WE77v÷&Bb33c·4æWuW7%72 b33c¶ö&¥W6W"åWBgV÷C´gVÆÆæÖRgV÷C²Âb33c·4æWuW7$gVÆÂ b33c¶ö&¥W6W"åWBgV÷C´FW67&FöâgV÷C²Âb33c·4æWuW7$FW62 ²b33c¶ö&¥W6W"åWBgV÷CµvDÆ7E6WBgV÷C²Â b33c¶ö&¥W6W"å6WDæfð bW'&÷"FVà µôfÆUw&FTÆörb33c´ÆötfÆRÂgV÷C´W'&÷"âôFEôÆö6ÅW6W"FFærW6W#¢gV÷C²f×²b33c·4æWuW7$æÖR ×6t&÷bÂgV÷C´W'&÷"gV÷C²ÂgV÷C´W'&÷"âôFEôÆö6ÅW6W"FFærW6W#¢gV÷C²f×²b33c·4æWuW7$æÖR &WGW&â VÇ6P µôfÆUw&FTÆörb33c´ÆötfÆRÂgV÷Cµ7V66W76gVÆÇFFVBæWrW6W#¢gV÷C²f×²b33c·4æWuW7$æÖR ×6t&÷cBÂgV÷Cµ7V66W72gV÷C²ÂgV÷Cµ7V66W76gVÆÇFFVBæWrW6W#¢gV÷C²f×²b33c·4æWuW7$æÖR &WGW&â VæD`¤VæDgVæ2³ÓÒfwCµôFEôÆö6ÅW6W

seandisanti · June 16, 2006

I don't understand why a property that is present in a local account can't be accessed... but that's why we love Microsoft - not!

Doesn't seem to be a problem though. Accounts created in the GUI have "must change password" set by default, but accounts created through this COM object don't, so it's not such a big deal. Just frustrating I couldn't look that up right there with User object information. Nothing on that page tells me (unless I missed it) which can be done local.

This is my test:

_Add_LocalUser("TestUser1", "C0mplex!ty", "Test User One", "My test user.")

;--------------------------------------
; Function _Add_LocalUser
;   Call with:  _Add_LocalUser($sNewUsrName, $sNewUsrPass [, $sNewUsrFull] [, $sNewUsrDesc]) where:
;       $sNewUsrName = UserName to add
;       $sNewUsrPass = New user's password
;       $sNewUsrFull = (optional) User's full name
;       $sNewUsrDesc = (optional) User's description (comment)
;   Returns 1 for good, 0 for bad
;--------------------------------------
Func _Add_LocalUser($sNewUsrName, $sNewUsrPass, $sNewUsrFull = "", $sNewUsrDesc = "")
    Local $colLocalComputer, $objUser
    
    ; Init COM object
    $colLocalComputer = ObjGet("WinNT://" & @ComputerName)
    
    ; Create user
    $objUser = $colLocalComputer.Create ("user", $sNewUsrName)
    
    ; Apply properties to user
    $objUser.SetPassword ($sNewUsrPass)
    $objUser.Put ("Fullname", $sNewUsrFull)
    $objUser.Put ("Description", $sNewUsrDesc)
    ; $objUser.Put ("PwdLastSet", 0)
    $objUser.SetInfo
    If @error Then
        ;_FileWriteLog($LogFile, "Error in _Add_LocalUser() adding user: " & $sNewUsrName)
        MsgBox(16, "Error", "Error in _Add_LocalUser() adding user: " & $sNewUsrName)
        Return 0
    Else
        ;_FileWriteLog($LogFile, "Successfully added new user: " & $sNewUsrName)
        MsgBox(64, "Success", "Successfully added new user: " & $sNewUsrName)
        Return 1
    EndIf
EndFunc   ;==>_Add_LocalUser

this may help, it's straight from the Microsoft Platform SDK regarding NetUserSetInfo function

Platform SDK: Network Management
NetUserSetInfo

The NetUserSetInfo function sets the parameters of a user account.

NET_API_STATUS NetUserSetInfo(
LPCWSTR servername,
LPCWSTR username,
DWORD level,
LPBYTE buf,
LPDWORD parm_err
);

Parameters
servername
[in]Pointer to a constant string that specifies the DNS or NetBIOS name of the remote server on which the function is to execute. If this parameter is NULL, the local computer is used.
Windows NT: This string must begin with \\.
username
[in] Pointer to a constant string that specifies the name of the user account for which to set information. For more information, see the following Remarks section.
level
[in] Specifies the information level of the data. This parameter can be one of the following values. Value Meaning
0 Specifies the user account name. The buf parameter points to a USER_INFO_0 structure. Use this structure to specify a new group name. For more information, see the following Remarks section.
1 Specifies detailed information about the user account. The buf parameter points to a USER_INFO_1 structure.
2 Specifies level one information and additional attributes about the user account. The buf parameter points to a USER_INFO_2 structure.
3 Specifies level two information and additional attributes about the user account. This level is valid only on servers. The buf parameter points to a USER_INFO_3 structure. Note that it is recommended that you use USER_INFO_4 instead.
4 Specifies level two information and additional attributes about the user account. This level is valid only on servers. The buf parameter points to a USER_INFO_4 structure.
Windows 2000/NT: This level is not supported.
21 Specifies a one-way encrypted LAN Manager 2.x-compatible password. The buf parameter points to a USER_INFO_21 structure.
22 Specifies detailed information about the user account. The buf parameter points to a USER_INFO_22 structure.
1003 Specifies a user password. The buf parameter points to a USER_INFO_1003 structure.
1005 Specifies a user privilege level. The buf parameter points to a USER_INFO_1005 structure.
1006 Specifies the path of the home directory for the user. The buf parameter points to a USER_INFO_1006 structure.
1007 Specifies a comment to associate with the user account. The buf parameter points to a USER_INFO_1007 structure.
1008 Specifies user account attributes. The buf parameter points to a USER_INFO_1008 structure.
1009 Specifies the path for the user's logon script file. The buf parameter points to a USER_INFO_1009 structure.
1010 Specifies the user's operator privileges. The buf parameter points to a USER_INFO_1010 structure.
1011 Specifies the full name of the user. The buf parameter points to a USER_INFO_1011 structure.
1012 Specifies a comment to associate with the user. The buf parameter points to a USER_INFO_1012 structure.
1014 Specifies the names of workstations from which the user can log on. The buf parameter points to a USER_INFO_1014 structure.
1017 Specifies when the user account expires. The buf parameter points to a USER_INFO_1017 structure.
1020 Specifies the times during which the user can log on. The buf parameter points to a USER_INFO_1020 structure.
1024 Specifies the user's country/region code. The buf parameter points to a USER_INFO_1024 structure.
1051 Specifies the relative identifier of a global group that represents the enrolled user. The buf parameter points to a USER_INFO_1051 structure.
1052 Specifies the path to a network user's profile. The buf parameter points to a USER_INFO_1052 structure.
1053 Specifies the drive letter assigned to the user's home directory. The buf parameter points to a USER_INFO_1053 structure.

buf
[in] Pointer to the buffer that specifies the data. The format of this data depends on the value of the level parameter. For more information, see Network Management Function Buffers.
parm_err
[out] Pointer to a value that receives the index of the first member of the user information structure that causes ERROR_INVALID_PARAMETER. If this parameter is NULL, the index is not returned on error. For more information, see the following Remarks section.
Return Values
If the function succeeds, the return value is NERR_Success.

If the function fails, the return value can be one of the following error codes.

Return code Description
ERROR_ACCESS_DENIED The user does not have access to the requested information.
ERROR_INVALID_PARAMETER One of the function parameters is invalid. For more information, see the following Remarks section.
NERR_InvalidComputer The computer name is invalid.
NERR_NotPrimary The operation is allowed only on the primary domain controller of the domain.
NERR_SpeGroupOp The operation is not allowed on specified special groups, which are user groups, admin groups, local groups, or guest groups.
NERR_LastAdmin The operation is not allowed on the last administrative account.
NERR_BadPassword The share name or password is invalid.
NERR_PasswordTooShort The password is shorter than required. (The password could also be too long, be too recent in its change history, not have enough unique characters, or not meet another password policy requirement.)
NERR_UserNotFound The user name could not be found.

Remarks
If you are programming for Active Directory, you may be able to call certain Active Directory Service Interface (ADSI) methods to achieve the same functionality you can achieve by calling the network management user functions. For more information, see IADsUser and IADsComputer.

If you call this function on a domain controller that is running Active Directory, access is allowed or denied based on the access control list (ACL) for the securable object. The default ACL permits only Domain Admins and Account Operators to call this function. On a member server or workstation, only Administrators and Power Users can call this function. For more information, see Security Requirements for the Network Management Functions. For more information on ACLs, ACEs, and access tokens, see Access Control Model.

Windows NT: Only members of the Administrators or Account Operators local group can successfully execute the NetUserSetInfo function on a remote server or on a computer that has local security enabled. A user can call NetUserSetInfo to set certain information on his or her own account. Additional information about permissions required to set user elements follows in this Remarks section.
The security descriptor of the User object is used to perform the access check for this function.

Only users or applications having administrative privileges can call the NetUserSetInfo function to change a user's password. When an administrator calls NetUserSetInfo, the only restriction applied is that the new password length must be consistent with system modals. A user or application that knows a user's current password can call the NetUserChangePassword function to change the password. For more information about calling functions that require administrator privileges, see Running with Special Privileges.

Members of the Administrators local group can set any modifiable user account elements. All users can set the usri2_country_code member of the USER_INFO_2 structure (and the usri1024_country_code member of the USER_INFO_1024 structure) for their own accounts.

A member of the Account Operator's local group cannot set details for an Administrators class account, give an existing account Administrator privilege, or change the operator privilege of any account. If you attempt to change the privilege level or disable the last account with Administrator privilege in the security database, (the security accounts manager (SAM) database or, in the case of domain controllers, the Active Directory), the NetUserSetInfo function fails and returns NERR_LastAdmin.

To set the following user account control flags, the following privileges and control access rights are required.

Account control flag Privilege or right required
UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION SeEnableDelegationPrivilege privilege, which is granted to Administrators by default.
UF_TRUSTED_FOR_DELEGATION SeEnableDelegationPrivilege.
UF_PASSWD_NOTREQD "Update password not required" control access right on the Domain object, which is granted to authenticated users by default.
UF_DONT_EXPIRE_PASSWD "Unexpire password" control access right on the Domain object, which is granted to authenticated users by default.
UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED "Enable per user reversibly encrypted password" control access right on the Domain object, which is granted to authenticated users by default.
UF_SERVER_TRUST_ACCOUNT "Add/remove replica in domain" control access right on the Domain object, which is granted to Administrators by default.

For a list of privilege constants, see Authorization Constants.

The correct way to specify the new name for an account is to call NetUserSetInfo with USER_INFO_0 and to specify the new value using the usri0_name member. If you call NetUserSetInfo with other information levels and specify a value using a usriX_name member, the value is ignored.

Note that calls to NetUserSetInfo can change the home directory only for user accounts that the network server creates.

If the NetUserSetInfo function returns ERROR_INVALID_PARAMETER, you can use the parm_err parameter to indicate the first member of the user information structure that is invalid. (A user information structure begins with USER_INFO_ and its format is specified by the level parameter.) The following table lists the values that can be returned in the parm_err parameter and the corresponding structure member that is in error. (The prefix usri*_ indicates that the member can begin with multiple prefixes, for example, usri10_ or usri1003_.)

Value Member
USER_NAME_PARMNUM usri*_name
USER_PASSWORD_PARMNUM usri*_password
USER_PASSWORD_AGE_PARMNUM usri*_password_age
USER_PRIV_PARMNUM usri*_priv
USER_HOME_DIR_PARMNUM usri*_home_dir
USER_COMMENT_PARMNUM usri*_comment
USER_FLAGS_PARMNUM usri*_flags
USER_SCRIPT_PATH_PARMNUM usri*_script_path
USER_AUTH_FLAGS_PARMNUM usri*_auth_flags
USER_FULL_NAME_PARMNUM usri*_full_name
USER_USR_COMMENT_PARMNUM usri*_usr_comment
USER_PARMS_PARMNUM usri*_parms
USER_WORKSTATIONS_PARMNUM usri*_workstations
USER_LAST_LOGON_PARMNUM usri*_last_logon
USER_LAST_LOGOFF_PARMNUM usri*_last_logoff
USER_ACCT_EXPIRES_PARMNUM usri*_acct_expires
USER_MAX_STORAGE_PARMNUM usri*_max_storage
USER_UNITS_PER_WEEK_PARMNUM usri*_units_per_week
USER_LOGON_HOURS_PARMNUM usri*_logon_hours
USER_PAD_PW_COUNT_PARMNUM usri*_bad_pw_count
USER_NUM_LOGONS_PARMNUM usri*_num_logons
USER_LOGON_SERVER_PARMNUM usri*_logon_server
USER_COUNTRY_CODE_PARMNUM usri*_country_code
USER_CODE_PAGE_PARMNUM usri*_code_page
USER_PRIMARY_GROUP_PARMNUM usri*_primary_group_id
USER_PROFILE_PARMNUM usri*_profile
USER_HOME_DIR_DRIVE_PARMNUM usri*_home_dir_drive

User account names are limited to 20 characters and group names are limited to 256 characters. In addition, account names cannot be terminated by a period and they cannot include commas or any of the following printable characters: ", /, \, [, ], :, |, <, >, +, =, ;, ?, *. Names also cannot include characters in the range 1-31, which are nonprintable.

Windows NT 4.0: Calls to this function fail if an account name does not meet the criteria outlined previously.
Example Code
The following code sample demonstrates how to disable a user account with a call to the NetUserSetInfo function. The code sample fills in the usri1008_flags member of the USER_INFO_1008 structure, specifying the value UF_ACCOUNTDISABLE. Then the sample calls NetUserSetInfo, specifying information level 0.

#ifndef UNICODE
#define UNICODE
#endif

#include <stdio.h>
#include <windows.h>
#include <lm.h>

int wmain(int argc, wchar_t *argv[])
{
DWORD dwLevel = 1008;
USER_INFO_1008 ui;
NET_API_STATUS nStatus;

if (argc != 3)
{
fwprintf(stderr, L"Usage: %s \\\\ServerName UserName\n", argv[0]);
exit(1);
}
// Fill in the USER_INFO_1008 structure member.
// UF_SCRIPT: required for LAN Manager 2.0 and
// Windows NT and later.
//
ui.usri1008_flags = UF_SCRIPT | UF_ACCOUNTDISABLE;
//
// Call the NetUserSetInfo function
// to disable the account, specifying level 1008.
//
nStatus = NetUserSetInfo(argv[1],
argv[2],
dwLevel,
(LPBYTE)&ui,
NULL);
//
// Display the result of the call.
//
if (nStatus == NERR_Success)
fwprintf(stderr, L"User account %s has been disabled\n", argv[2]);
else
fprintf(stderr, "A system error has occurred: %d\n", nStatus);

return 0;
}

Requirements
Client Requires Windows XP, Windows 2000 Professional, or Windows NT Workstation.
Server Requires Windows Server 2003, Windows 2000 Server, or Windows NT Server.
Header Declared in Lmaccess.h; include Lm.h.

Library Link to Netapi32.lib.

DLL Requires Netapi32.dll.

See Also
Network Management Overview, Network Management Functions, User Functions, NetUserGetInfo, USER_INFO_0, USER_INFO_1, USER_INFO_2, USER_INFO_4, USER_INFO_21, USER_INFO_22, USER_INFO_1003, USER_INFO_1005, USER_INFO_1006, USER_INFO_1007, USER_INFO_1008, USER_INFO_1009, USER_INFO_1010, USER_INFO_1011, USER_INFO_1012, USER_INFO_1013, USER_INFO_1014, USER_INFO_1017, USER_INFO_1020, USER_INFO_1024, USER_INFO_1051, USER_INFO_1052, USER_INFO_1053

--------------------------------------------------------------------------------

Last updated: March 2005 | What did you think of this topic? | Order a Platform SDK CD
© Microsoft Corporation. All rights reserved. Terms of use.

Requirements
Client Requires Windows XP, Windows 2000 Professional, or Windows NT Workstation.
Server Requires Windows Server 2003, Windows 2000 Server, or Windows NT Server.
Header Declared in Lmaccess.h; include Lm.h.

Library Link to Netapi32.lib.

DLL Requires Netapi32.dll.

***edit*** sorry, forgot to close quote Edited June 16, 2006 by cameronsdad

PsaltyDS · June 16, 2006

this may help, it's straight from the Microsoft Platform SDK regarding NetUserSetInfo function
***edit*** sorry, forgot to close quote

Hooboy...

OK, pretend you're NOT talking to a programmer... 'cause you're not! :">

Isn't that a change from COM Object interface to a DLL?

From the quoted page:

DLL Requires Netapi32.dll.

That takes me to the next logical question - Would the DLL meathod be easier than the COM stuff I'm trying to learn? I'd like to learn both, but have some immediate script requirements to deal with, so I have to pick one to start out on. I jumped on the COM because an example somebody gave me (I think it was JdeB, so it's officialy his fault) used it.

Did I miss an easier path with the DLL? Would AutoIT (not VB or VC++) do those DLL calls easier than the COM objects?

Jos · June 16, 2006

(I think it was JdeB, so it's officialy his fault) used it.

So what is your problem ? you cannot expired the password ?

Didn't the below line work?:

$objUser.Put ("PwdLastSet", 0)

PsaltyDS · June 16, 2006

So what is your problem ? you cannot expired the password ?
Didn't the below line work?:

$objUser.Put ("PwdLastSet", 0)

That was an ActiveDirectory property, I believe, that wouldn't work with a local SAM user. If you uncomment that very line in my last code post, I get an error that that failed:

>Running:(3.1.1.118):C:\Program Files\AutoIt3\beta\autoit3.exe "C:\AutoIT3 Scripts\Test\Test1.au3"  
C:\AutoIT3 Scripts\Test\Test1.au3 (25) : ==> The requested action with this object has failed.: 
$objUser.Put ("PwdLastSet", 0) 
$objUser.Put ("PwdLastSet", 0)^ ERROR
+>AutoIT3.exe ended.rc:0
>Exit code: 0   Time: 5.264

When this particular install is performed manually, we create a couple of users via the GUI, which sets "must change password" by default. I am scripting that install now using the COM meathod shown, and thought I needed to clear that setting as in the LUSRMGR.MSC GUI (checkbox control ID 257). While chasing this down, I found out the COM meathod leaves all options unselected. Purely as a training exercise now, I'm trying to find out if it was possible to change that setting, or if there was an easier way (DLL?) to accomplish the task.

Edit: We went over this (sort of) before in Thread #23470. I'm just trying to learn more and apply that more broadly now.

Edited June 16, 2006 by PsaltyDS

Jos · June 16, 2006

Try this:

$objUser = $colAccounts.Create("user", $UserName)
$objUser.SetPassword ($Password)
$objUser.Put ("Fullname", "Test User")
$objUser.Put ("Description", "Test User description")
$objUser.Put ("PasswordExpired", 1)
$objUser.SetInfo

PsaltyDS · June 16, 2006

Try this:

$objUser = $colAccounts.Create("user", $UserName)
$objUser.SetPassword ($Password)
$objUser.Put ("Fullname", "Test User")
$objUser.Put ("Description", "Test User description")
$objUser.Put ("PasswordExpired", 1)
$objUser.SetInfooÝ÷ Ûú®¢×aj×bv+wÜ4ázræ«yÛazÆ¦zÇ¶)àÂ+ajëh×6$sNewUsrName = "TestUser1"

; Init COM object
$objUser = ObjGet("WinNT://" & @ComputerName & "/" & $sNewUsrName)

; Apply properties to user
$objUser.Put ("PasswordExpired", 0)
$objUser.SetInfo

If @error Then
    MsgBox(16, "Error", "Error in _Add_LocalUser() changing user: " & $sNewUsrName)
Else
    MsgBox(64, "Success", "Successfully changed user: " & $sNewUsrName)
EndIf

And that worked too! Everybody go home early for the weekend!

Thanks, JdeB.

Just for the sake of learning, what would the same function look like as an AutoIT call to the DLL (Net32Api.dll was mentioned earlier), or is that the "hard way"?

Edited June 16, 2006 by PsaltyDS

Jos · June 16, 2006

Just for the sake of learning, what would the same function look like as an AutoIT call to the DLL (Net32Api.dll was mentioned earlier), or is that the "hard way"?

To me its the hard way but I am sure that cameronsdad is going to show it once he figures it out

seandisanti · June 17, 2006

To me its the hard way but I am sure that cameronsdad is going to show it once he figures it out

actually, i'm looking at a very busy weekend, and don't think i'll even have a chance to touch a computer again until monday at work, at which time i'll hopefully be starting a new position and won't be able to do anything for a couple of weeks. Not to mention i really suck at using dll's...

PsaltyDS · June 17, 2006

actually, i'm looking at a very busy weekend, and don't think i'll even have a chance to touch a computer again until monday at work, at which time i'll hopefully be starting a new position and won't be able to do anything for a couple of weeks. Not to mention i really suck at using dll's...

Don't have a right to expect a lot of work from 'cameronsdad' or 'Big_Daddy' on a father's day weekend anyway, now do we?!

Happy Father's Day!

seandisanti · June 19, 2006

Don't have a right to expect a lot of work from 'cameronsdad' or 'Big_Daddy' on a father's day weekend anyway, now do we?!
Happy Father's Day!

Thanks, and i was right about barely using the computer again too.

PsaltyDS · June 19, 2006

OK, I'm back on task now...

My function to add a user works, the function to add a group works, but I get an error adding the user to the group. Here's the code:

#include<file.au3>
$LogFile = @ScriptDir & "\TestLog.log"

; Declare COM Object error handler:
Global $oComError = ObjEvent("AutoIt.Error", "_ComErrFunc"); Install a custom error handler

_Add_LocalUser("TestUser", "C0mplex!ty", "Mrs. Test T. User", "My test user.")

_Add_LocalGroup("Test Group")

_Add_Usr2Grp("Test Group", "TestUser")

;--------------------------------------
;   Local Functions
;--------------------------------------
;--------------------------------------
; Function _ComErrFunc()
;   Custom COM object error handler
;--------------------------------------
Func _ComErrFunc()
    Local $HexNumber = Hex($oComError.number, 8)
    _FileWriteLog($LogFile, "AutoIT COM Error Occured!" & @CRLF & _
            @TAB & "Error Number: " & $HexNumber & @CRLF & _
            @TAB & "Line Number: " & $oComError.scriptline & @CRLF & _
            @TAB & "Description: " & $oComError.description & @CRLF & _
            @TAB & "WinDescription: " & $oComError.windescription)
    SetError(1); something to check for when this function returns
EndFunc ;==>_ComErrFunc


;--------------------------------------
;  Function _Add_Usr2Grp()
;   Call with:  _Add_Usr2Grp($sGrpName, $sNewGrpMbr) where:
;       $sGrpName = local group name to add members to
;       $sNewGrpMbr = New member to add to the group
;   Returns 1 for good, 0 for bad
;--------------------------------------
Func _Add_Usr2Grp($sGrpName, $sNewGrpMbr)
    Local $objGroup, $objUser
    
; Init group COM object
    $objGroup = ObjGet("WinNT://" & @ComputerName & "/" & $sGrpName)
    
; Init user COM object
    $objUser = ObjGet("WinNT://" & @ComputerName & "/" & $sNewGrpMbr)
    
; Add the user to the group
    $objGroup.add ($objUser)
    $objGroup.SetInfo
    
; Return Results
    If @error = 0 Then
        _FileWriteLog($LogFile, "Successfully added user " & $sNewGrpMbr & " to group: " & $sGrpName)
        Return 1
    Else
        _FileWriteLog($LogFile, "Error adding user " & $sNewGrpMbr & " to group: " & $sGrpName & "; @Error = " & @error)
        Return 0
    EndIf
EndFunc ;==>_Add_Usr2Grp


;--------------------------------------
; Function _Add_LocalGroup()
;   Call with:  _Add_LocalGroup($sNewGrpName, $sNewGrpDesc) where:
;       $sNewGrpName = New local group name to add
;       $sNewGrpDesc = (optional) Group's description
;   Returns 1 for success, 0 for fail
;--------------------------------------
Func _Add_LocalGroup($sNewGrpName, $sNewGrpDesc = "")
    Local $colLocalComputer, $objGroup
    
; Init COM object
    $colLocalComputer = ObjGet("WinNT://" & @ComputerName)
    
; Create user
    $objGroup = $colLocalComputer.Create ("group", $sNewGrpName)
    
; Apply properties to user
    $objGroup.Put ("Description", $sNewGrpDesc)
    $objGroup.SetInfo
    
; Return results
    If @error = 0 Then
        _FileWriteLog($LogFile, "Successfully added new local group: " & $sNewGrpName)
        Return 1
    Else
        _FileWriteLog($LogFile, "Error adding group: " & $sNewGrpName & "; @Error = " & @error)
        Return 0
    EndIf
EndFunc ;==>_Add_LocalGroup


;--------------------------------------
; Function _Add_LocalUser
;   Call with:  _Add_LocalUser($sNewUsrName, $sNewUsrPass [, $sNewUsrFull] [, $sNewUsrDesc]) where:
;       $sNewUsrName = UserName to add
;       $sNewUsrPass = New user's password
;       $sNewUsrFull = (optional) User's full name
;       $sNewUsrDesc = (optional) User's description (comment)
;   Returns 1 for success, 0 for fail
;--------------------------------------
Func _Add_LocalUser($sNewUsrName, $sNewUsrPass, $sNewUsrFull = "", $sNewUsrDesc = "")
    Local $colLocalComputer, $objUser
    
; Init COM object
    $colLocalComputer = ObjGet("WinNT://" & @ComputerName)
    
; Create user
    $objUser = $colLocalComputer.Create ("user", $sNewUsrName)
    
; Apply properties to user
    $objUser.SetPassword ($sNewUsrPass)
    $objUser.Put ("Fullname", $sNewUsrFull)
    $objUser.Put ("Description", $sNewUsrDesc)
    $objUser.Put ("PasswordExpired", 0)
    $objUser.SetInfo
    
; Return results
    If @error = 0 Then
        _FileWriteLog($LogFile, "Successfully added new user: " & $sNewUsrName)
        Return 1
    Else
        _FileWriteLog($LogFile, "Error adding user: " & $sNewUsrName & "; @Error = " & @error)
        Return 0
    EndIf
EndFunc ;==>_Add_LocalUser

And here's the error from the log file:

2006-06-19 12:33:54 : Successfully added new user: TestUser
2006-06-19 12:33:54 : Successfully added new local group: Test Group
2006-06-19 12:33:54 : AutoIT COM Error Occured!
    Error Number: 80020005
    Line Number: 48
    Description: 0
    WinDescription: Type mismatch.
2006-06-19 12:33:54 : Error adding user TestUser to group: Test Group; @Error = 1

I can see I have a wrong data type in _Add_Usr2Grp(), but I'm not sure where...?

Edit: Well, duh... line 48 is where... but I'm not sure what that line should look like to add one object to another...?

Edited June 19, 2006 by PsaltyDS

Jos · June 19, 2006

Try this version of the func:

Func _Add_Usr2Grp($sGrpName, $sNewGrpMbr)
    Local $objGroup, $objUser
    
; Init group COM object
    $objGroup = ObjGet("WinNT://" & @ComputerName & "/" & $sGrpName & ",group")
    
; Init user COM object
    $objUser = ObjGet("WinNT://" & @ComputerName & "/" & $sNewGrpMbr)
    
; Add the user to the group
    $objGroup.Add($objUser.ADsPath)
;$objGroup.add ($objUser)
    $objGroup.SetInfo
    
; Return Results
    If @error = 0 Then
        _FileWriteLog($LogFile, "Successfully added user " & $sNewGrpMbr & " to group: " & $sGrpName)
        Return 1
    Else
        _FileWriteLog($LogFile, "Error adding user " & $sNewGrpMbr & " to group: " & $sGrpName & "; @Error = " & @error)
        Return 0
    EndIf
EndFunc ;==>_Add_Usr2Grp

PsaltyDS · June 19, 2006

Try this version of the func:

Func _Add_Usr2Grp($sGrpName, $sNewGrpMbr)
    Local $objGroup, $objUser
    
; Init group COM object
    $objGroup = ObjGet("WinNT://" & @ComputerName & "/" & $sGrpName & ",group")
    
; Init user COM object
    $objUser = ObjGet("WinNT://" & @ComputerName & "/" & $sNewGrpMbr)
    
; Add the user to the group
    $objGroup.Add($objUser.ADsPath)
;$objGroup.add ($objUser)
    $objGroup.SetInfo
    
; Return Results
    If @error = 0 Then
        _FileWriteLog($LogFile, "Successfully added user " & $sNewGrpMbr & " to group: " & $sGrpName)
        Return 1
    Else
        _FileWriteLog($LogFile, "Error adding user " & $sNewGrpMbr & " to group: " & $sGrpName & "; @Error = " & @error)
        Return 0
    EndIf
EndFunc;==>_Add_Usr2Grp

That worked, and so did this:

; Add the user to the group
; $objGroup.add ($objUser)
    $objGroup.add ("WinNT://" & @ComputerName & "/" & $sNewGrpMbr)

This raises a new question... what if some user and group names happen to match? The call to "WinNT://" & @ComputerName & "/" & $sNewGrpMbr depends on unique naming. If there is a user called Test and a group called Test, how do I distinguish in the COM objects, since they both would be: "WinNT://" & @ComputerName & "/Test"?

Sign In

Trying to learn to use COM objects...

Recommended Posts

PsaltyDS

PsaltyDS

PsaltyDS

big_daddy

PsaltyDS

big_daddy

PsaltyDS

seandisanti

PsaltyDS

Jos

PsaltyDS

Jos

PsaltyDS

Jos

seandisanti

PsaltyDS

seandisanti

PsaltyDS

Jos

PsaltyDS

Create an account or sign in to comment

Create an account

Sign in

Recently Browsing 0 members

Browse

AutoIt Resources

Release

Beta