AD user - query logonhours

[UglyBob]

Yet another bump...

Anybody have an idea how to figure out the $arrLogonHours variable? If VBScript can work it, then surely AutoIt can...?

is that tumbleweed I see rolling by?

anyhoo, a little update....

I've been carrying out a few more experiments on this issue. I've found I can actually update the attribute using a range of characters. The first example is limited to the characters 1-127 (ascii plus the control characters).

e.g.

Dim $result

$objUser1 = ObjGet("LDAP://CN=some user,OU=users,DC=domain,DC=com")

for $u = 1 to 21
$result &= "#"
Next

ConsoleWrite ( "output:" & $result &@CRLF)
$objUser1.put ("logonHours", $result)
$objUser1.setinfo

Each character can be stored as a single byte and will represent every 8 hours to the value of '11000100' (which is 35 flipped around).

but there's more....

certain characters are actually represented as 16 bits or even 24bits:

using a 16 character:

Dim $result

$objUser1 = ObjGet("LDAP://CN=some user,OU=users,DC=domain,DC=com")

for $u = 1 to 10
$result &= "ä"
Next
$result &= chr(1)

ConsoleWrite ( "output:" & $result &@CRLF)
$objUser1.put ("logonHours", $result)
$objUser1.setinfo

logonhours become:

Day Byte 1 Byte 2 Byte 3

Sun 11000011 00100101 11000011

Mon 00100101 11000011 00100101

Tue 11000011 00100101 11000011

Wed 00100101 11000011 00100101

Thu 11000011 00100101 11000011

Fri 00100101 11000011 00100101

Sat 11000011 00100101 10000000

using a 24 bit character:

Dim $result
$objUser1 = ObjGet("LDAP://CN=some user,OU=users,DC=domain,DC=com")
for $u = 1 to 7
$result &= ""
Next
ConsoleWrite ( "output:" & $result &@CRLF)
$objUser1.put ("logonHours", $result)
$objUser1.setinfo

each logon day becomes - 01000111 01000001 00110101

pretty messy huh, but as you can see all three examples add up to that magical 21 bytes. So my point is the attribute is all about bytes, and is probably why no matter what function you throw at it autoit displays nothing; and the reason why vbscript does work is because it has a function to extract each byte (midB). Hopefully my findings will help someone more knowledgeable in cracking this hard nut.

[PsaltyDS]

is that tumbleweed I see rolling by?

Sorry, missed it while listening to the crickets chirping...

anyhoo, a little update....

I've been carrying out a few more experiments on this issue. I've found I can actually update the attribute using a range of characters. The first example is limited to the characters 1-127 (ascii plus the control characters).

e.g.

; ...

each logon day becomes - 01000111 01000001 00110101

pretty messy huh, but as you can see all three examples add up to that magical 21 bytes. So my point is the attribute is all about bytes, and is probably why no matter what function you throw at it autoit displays nothing; and the reason why vbscript does work is because it has a function to extract each byte (midB). Hopefully my findings will help someone more knowledgeable in cracking this hard nut.

This was the part that confused me. AutoIt HAS tools to deal with binary values, but they don't seem to recognize $arrLogonHours as binary either (BinaryLen($arrLogonHours) = 0). Deep in it's little C++ heart, AutoIt uses variants for variables, which I think are the value's memory structure plus a flag/structure that identifies its type. When this COM reference is made to get $arrLogonHours, AutoIt doesn't know how to map the return to one of its known variant types.

That is my conjecture. The smart people ain't s'plained it to me yet...

[ptrex]

@All

These are some quick translations of the VBS LenB, _AscB and MidB.

At least I hope

expandcollapse popup

#include <Array.au3>

$arrLogonHours = "00000001111111111110000124"
                  
ConsoleWrite("LenB : " & _LenB($arrLogonHours) & @LF)

Func _LenB ($sString)
    Local $sStr
        $sStr = StringLen (StringStripWS($sString,8)) / 8
    Return int ($sStr)
EndFunc


ConsoleWrite("AscB : " &_AscB($arrLogonHours) & @LF)

Func _AscB ($sString)
    $sByte = StringLeft ($sString,4)
    Return $sByte
EndFunc

  ConsoleWrite("ByteInString : " &_BytesInString($arrLogonHours,3) & @LF)

Func _BytesInString ($sString,$iPos)
    Local $sBit, $i, $y, $z
    local $sLength, $iBytes
    
    $sLength = StringLen(StringStripWS($sString,8))
    
    $iBytes  = int($sLength) /8

    If $iPos <= $iBytes then
        
    Local $aBuffer [$iBytes +1]
        $y = 1
        $z = 8
    
        For $i = 1 to $iBytes 
            For $y = $z-7 to $z
            $sBit = $sBit & StringMid($sString,$y,1)
            Next
        $z += 8
        $aBuffer [$i] = $sBit
        $sBit = ""
        Next
            Return ($aBuffer[$iPos])
    Else
        SetError (0)
        Return ""
    EndIf
EndFunc

I hope this keeps you going.

regards

ptrex

Edited October 21, 2007 by ptrex

[UglyBob]

@All

These are some quick translations of the VBS LenB, _AscB and MidB.

At least I hope

alas....

this would work if the variable actually was a 'string' of 0's and 1's, but it isn't. The AD attribute is not a string in the variable sense as we know it, it's 21 bytes strung together. It's how we extract those bytes and represent them on screen that makes them appear as ascii/extended characters in a string variable.

If you think about it the string you set as

'00000001111111111110000124' is actually a string of ascii characters, each character is a single byte; so this in binary form would become:

'001100000011000000110000001100000011000000110000001100000011000100110001001100010011000100110001

001100010011000100110001001100010011000100110001001100010011000000110000001100000011000000110001'

(leaving out the last two '2 and 4').

Your script is working on the former assumption which doesn't work with the real 'logonhours' attribute. As you can see with my latest examples I use a 'string' of characters (21 in total) to become the 168 bits in 'logonhours' because I know that each ascii character I use becomes the binary data strung together.

...hope that makes sense.....

[PsaltyDS]

@All

These are some quick translations of the VBS LenB, _AscB and MidB.

At least I hope

expandcollapse popup

#include <Array.au3>

$arrLogonHours = "00000001111111111110000124"
                  
ConsoleWrite("LenB : " & _LenB($arrLogonHours) & @LF)

Func _LenB ($sString)
    Local $sStr
        $sStr = StringLen (StringStripWS($sString,8)) / 8
    Return int ($sStr)
EndFunc
ConsoleWrite("AscB : " &_AscB($arrLogonHours) & @LF)

Func _AscB ($sString)
    $sByte = StringLeft ($sString,4)
    Return $sByte
EndFunc

  ConsoleWrite("ByteInString : " &_BytesInString($arrLogonHours,3) & @LF)

Func _BytesInString ($sString,$iPos)
    Local $sBit, $i, $y, $z
    local $sLength, $iBytes
    
    $sLength = StringLen(StringStripWS($sString,8))
    
    $iBytes  = int($sLength) /8

    If $iPos <= $iBytes then
        
    Local $aBuffer [$iBytes +1]
        $y = 1
        $z = 8
    
        For $i = 1 to $iBytes 
            For $y = $z-7 to $z
            $sBit = $sBit & StringMid($sString,$y,1)
            Next
        $z += 8
        $aBuffer [$i] = $sBit
        $sBit = ""
        Next
            Return ($aBuffer[$iPos])
    Else
        SetError (0)
        Return ""
    EndIf
EndFunc

I hope this keeps you going.

regards

ptrex

@ptrex,

I'll try it tomorrow when I'm in AD-land, but I don't think it will work. I ran the code in post #17 on an actual Win2K3 AD domain with a user that had logon hours set. The code specifically tries IsArray(), IsObj(), and the a simple string presentation of $arrLogonHours -- nothing. This is what made me start thinking AutoIt was getting an unrecognized variable type back from the COM method: $arrLogonHours = $objUser.Get("logonHours").

The real problem is that AutoIt sees nothing in $arrLogonHours, not that we can't translate it afterwards. VBScript sees it fine, but AutoIt sees nothing.

Since I'm not a C++ coder, this puts it firmly over my head.

[ptrex]

@PsaltyDS

OK I would have thought so as well that it would not solve it.

But when I run the VBScript as was provided I don"t get anything either ?

So I think that there is something wrong with the script logic as well.

Did anyone run the VBS example to see what was the result of that as well ?

regards

ptrex

[ptrex]

@all

This is a little test to see where it goes wrong

#include <array.au3>

Dim $objUser  ;'An ADSI user object
Dim $arrProps ;'An array of properties to return
   
$objUser=ObjGet ("LDAP://cn=User,ou=OU,dc=DOMAIN,dc=COM")
   
;'**********************************************************************
;'Set the list of properties to return
;'**********************************************************************
$ArrProps = _ArrayCreate("cn","ADsPath", "LogonHours")
   
;'**********************************************************************
;'Get the specified properties
;'**********************************************************************
$objUser.GetInfoEx ($arrProps, 0)


ConsoleWrite( $objUser.cn & " | " & $objUser.ADsPath & " | " & _
              IsInt($objUser.LogonHours) & " | " & _
              IsString($objUser.LogonHours) & " | " & _
              IsArray($objUser.LogonHours) & " | " & _
              IsBool($objUser.LogonHours) & " | " & _
              IsNumber($objUser.LogonHours) & " | " & _
              IsBinary($objUser.LogonHours) & " | " & _
              IsFloat($objUser.LogonHours) & " | " & _
              @LF)

As you can see the LOGOHOURS all return 0, meaning that the return type is not recognized by AU3 ?

Is this a bug ?

If no one of the devs reply I will post a question into the BUG section of the forum.

regards,

ptrex

[PsaltyDS]

@PsaltyDS

OK I would have thought so as well that it would not solve it.

But when I run the VBScript as was provided I don"t get anything either ?

So I think that there is something wrong with the script logic as well.

Did anyone run the VBS example to see what was the result of that as well ?

regards

ptrex

Just to address the VBScript code, this code by Richard L. Mueller works (the trick is translation to AutoIt):

CODE

' LogonHours.vbs

' VBScript program to document hours of the week when a given Active

' Directory user is allowed to logon, using the logonHours attribute.

'

' ----------------------------------------------------------------------

' Copyright © 2002 Richard L. Mueller

' Hilltop Lab web site - http://www.rlmueller.net

' Version 1.0 - November 10, 2002

' Version 1.1 - February 19, 2003 - Standardize Hungarian notation.

' Version 1.2 - May 19, 2003 - Bug fixes.

' Version 1.3 - January 25, 2004 - Modify error trapping.

'

' This script is designed to be run at a command prompt, using the

' Cscript host. For example:

' cscript //nologo LogonHours.vbs DistinguishedName

' DistinguishedName can be similar to:

' "cn=TestUser,ou=Sales,dc=MyDomain,dc=com"

'

' You have a royalty-free right to use, modify, reproduce, and

' distribute this script file in any way you find useful, provided that

' you agree that the copyright owner above has no warranty, obligations,

' or liability for such use.

Option Explicit

Dim objShell, lngBias, arrstrDayOfWeek, strUserDN

Dim arrbytLogonHours(20)

Dim arrintLogonHoursBits(167)

Dim bytLogonHours, lngBiasKey

Dim bytLogonHour, intLogonHour, strLine

Dim objUser, k, intCounter, intLoopCounter, j, m

' Check for required argument.

If (Wscript.Arguments.Count = 0) Then

Wscript.Echo "Error, required argument missing."

Wscript.Echo "LogonHours.vbs"

Wscript.Echo "Program to document allowed logon hours"

Wscript.Echo "Syntax:"

Wscript.Echo "cscript LogonHours.vbs DN"

Wscript.Echo "where DN is the DistinguishedName of an AD user."

Wscript.Echo "For example, DN could be:"

Wscript.Echo " cn=TestUser,ou=Sales,dc=MyDomain,dc=com"

Wscript.Quit(1)

End If

strUserDN = Wscript.Arguments(0)

' Bind to the specified user object with the LDAP provider.

On Error Resume Next

Set objUser = GetObject("LDAP://" & strUserDN)

If (Err.Number <> 0) Then

On Error GoTo 0

Wscript.Echo "User not found in Active Directory"

Wscript.Echo strUserDN

Wscript.Quit(1)

End If

On Error GoTo 0

' Determine the time zone bias from the local registry.

Set objShell = CreateObject("Wscript.Shell")

lngBiasKey = objShell.RegRead("HKLM\System\CurrentControlSet\Control\" _

& "TimeZoneInformation\Bias")

If (UCase(TypeName(lngBiasKey)) = "LONG") Then

lngBias = lngBiasKey

ElseIf (UCase(TypeName(lngBiasKey)) = "VARIANT()") Then

lngBias = 0

For k = 0 To UBound(lngBiasKey)

lngBias = lngBias + (lngBiasKey(k) * 256^k)

Next

End If

lngBias = Round(lngBias/60)

arrstrDayOfWeek = Array("Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat")

Wscript.Echo "User: " & objUser.name

' Retrieve the user's logonHours attribute.

objUser.GetInfoEx Array("logonHours"), 0

bytLogonHours = objUser.Get("logonHours")

' Populate a byte array.

For k = 1 To LenB(bytLogonHours)

arrbytLogonHours(k - 1) = AscB(MidB(bytLogonHours, k, 1))

Next

' Populate a bit array, offset by the time zone bias.

j = 0

For Each bytLogonHour In arrbytLogonHours

For k = 7 To 0 Step -1

m = 8*j + k - lngBias

If (m < 0) Then

m = m + 168

End If

If (bytLogonHour And 2^k) Then

arrintLogonHoursBits(m) = 1

Else

arrintLogonHoursBits(m) = 0

End If

Next

j = j + 1

Next

' Output the bit array, one day per line, 24 hours per day.

intCounter = 0

intLoopCounter = 0

Wscript.Echo "Day"

Wscript.Echo "of ------- Hour of the Day -------"

Wscript.Echo "Week M-3 3-6 6-9 9-N N-3 3-6 6-9 9-M"

For Each intLogonHour In arrintLogonHoursBits

If (intCounter = 0) Then

strLine = arrstrDayOfWeek(intLoopCounter) & " "

intLoopCounter = intLoopCounter + 1

End If

strLine = strLine & intLogonHour

intCounter = intCounter + 1

If (intCounter = 3) Or (intCounter = 6) Or (intCounter = 9) _

Or (intCounter = 12) Or (intCounter = 15) Or (intCounter = 18) _

Or (intCounter = 21) Then

strLine = strLine & " "

End If

If (intCounter = 24) Then

Wscript.Echo strLine

intCounter = 0

End If

Next

' Clean up.

Set objUser = Nothing

Set objShell = Nothing

Running the code above on a Win2K3 AD domain gave me this:

C:\Temp\Testing>cscript LogonHours.vbs "CN=Test User,OU=Domain Users,OU=Domain Users and COMPUTERS,DC=DC001,DC=mydomain,DC=com"
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

User: CN=Test User
Day
of   ------- Hour of the Day -------
Week M-3 3-6 6-9 9-N N-3 3-6 6-9 9-M
Sun  000 000 000 000 000 000 000 000
Mon  000 000 111 111 011 111 000 000
Tue  000 000 111 111 011 111 000 000
Wed  000 000 111 111 011 111 000 000
Thu  000 000 111 111 011 111 000 000
Fri  000 000 111 111 011 111 000 000
Sat  000 000 000 000 000 000 000 000

C:\Temp\Testing>

The output is nicely accurate. I set up "Test User" to only logon between 6am and 6pm, Monday thru Friday, but not during lunch from noon to 1pm.

[UglyBob]

erm, just to point out, there was nothing wrong with the original VBscript I posted. Richard's script works exactly the same way (using 'ascB' & 'midB' to extract the bytes), the only difference is the arrangement of the 0's and 1's on screen; Richard's script looks more pleasing to the eye, but that's academic.

[PsaltyDS]

@all

This is a little test to see where it goes wrong

As you can see the LOGOHOURS all return 0, meaning that the return type is not recognized by AU3 ?

Is this a bug ?

If no one of the devs reply I will post a question into the BUG section of the forum.

regards,

ptrex

I ran that on the same domain I ran the VBScript on (with user address corrected) and got this:

Test User | CN=Test User,OU=Domain Users,OU=Domain Users and COMPUTERS,DC=DC001,DC=mydomain,DC=com | 0 | 0 | 0 | 0 | 0 | 0 | 0 |

Got all zeros, as you said.

Mhz gave me some other things to try that I couldn't get to today. Will give it a shot tomorrow.

erm, just to point out, there was nothing wrong with the original VBscript I posted. Richard's script works exactly the same way (using 'ascB' & 'midB' to extract the bytes), the only difference is the arrangement of the 0's and 1's on screen; Richard's script looks more pleasing to the eye, but that's academic.

True. I still want to make it work in AutoIt and will try some more stuff tomorrow.

Edited October 22, 2007 by PsaltyDS

[ptrex]

@PsaltyDS

I logged a Bug report. And Valik responded to this that Byte Array returns are not supported in AU3 as far as he knows.

But can't we use the DllStructCreate for that ?

I made something up like this. But I am not so much into DLLCall so I can"t tell wether this makes sense.

$Ret = $objUser.Get("LogonHours")
$str        = "byte"
$a          = DllStructCreate($str)
DllStructSetData($a,1,$Ret,1)
MsgBox(0,"DllStruct","Struct Size: " & DllStructGetSize($a) & @CRLF & _
        "Struct pointer: " & DllStructGetPtr($a) & @CRLF & _
        "Data: " & DllStructGetData($a,1) )

I hope someone can have a look at this.

Regards,

ptrex

[PsaltyDS]

@PsaltyDS

I logged a Bug report. And Valik responded to this that Byte Array returns are not supported in AU3 as far as he knows.

But can't we use the DllStructCreate for that ?

I made something up like this. But I am not so much into DLLCall so I can"t tell wether this makes sense.

$Ret = $objUser.Get("LogonHours")
$str        = "byte"
$a          = DllStructCreate($str)
DllStructSetData($a,1,$Ret,1)
MsgBox(0,"DllStruct","Struct Size: " & DllStructGetSize($a) & @CRLF & _
        "Struct pointer: " & DllStructGetPtr($a) & @CRLF & _
        "Data: " & DllStructGetData($a,1) )

[PsaltyDS]

@ptrex:

I also tried this:

Dim $objUser  ;'An ADSI user object
$objUser = ObjGet("LDAP://cn=Test User,ou=Domain Users,ou=Domain Users and Computers,dc=MyDomain,dc=com")

$Ret = $objUser.Get ("LogonHours")
$str = "byte" 
$a = DllStructCreate($str)
DllStructSetData($a, 1, $Ret, 1)
MsgBox(0, "DllStruct", "Struct Size: " & DllStructGetSize($a) & @CRLF & _
        "Struct pointer: " & DllStructGetPtr($a) & @CRLF & _
        "Data: " & DllStructGetData($a, 1))

Compiled and ran without error, but the message box was:

Struct Size:  1
Struct pointer:  14869840
Data:  0

Sigh...

[ptrex]

@PsaltyDS

OK I think it's time we get input formt he Devs on this, before wasting more time.

A pitty that this is not working in AU3.

OK there"s always a bypass to run it in AU3 using the Embedded Scripting Host.

Let"s hope for the best

regards

ptrex

[evilertoaster]

http://www.autoitscript.com/forum/index.ph...showtopic=44920 is a similar topic. Looks like once they byte data gets used in a COM/Obj interface, its get messed up.

[ptrex]

@all

Indead I tested the Example provided by Jon in that thread referred by evilertoaster.

This is the output :

Dim $objUser  ;'An ADSI user object
Dim $arrProps ;'An array of properties to return
   
$objUser=ObjGet ("LDAP://cn=User,ou=DEPT,dc=DOMAIN,dc=COM")
;'**********************************************************************
;'Set the list of properties to return
;'**********************************************************************
$ArrProps = _ArrayCreate("cn","ADsPath", "LogonHours")
   
;'**********************************************************************
;'Get the specified properties
;'**********************************************************************
$objUser.GetInfoEx ($arrProps, 0)
$Ret = $objUser.Get("LogonHours")

$str        = "byte[20]"
$a          = DllStructCreate($str)
DllStructSetData($a,1,$Ret,1) ;,1
MsgBox(0,"DllStruct","Struct Size: " & DllStructGetSize($a) & @CRLF & _
        "Struct pointer: " & DllStructGetPtr($a) & @CRLF & _
        "Data: " & DllStructGetData($a,1) & @CRLF & _
        "ErrorCode : " & @Error )

Struct Size: 20

Struct pointer: 14803128

Data: 0x0000000000000000000000000000000000000000

[PsaltyDS]

Tried to translate this method...

' Retrieve the user's logonHours attribute.
objUser.GetInfoEx Array("logonHours"), 0
bytLogonHours = objUser.Get("logonHours")

...into this AutoIt version:

$avProps = _ArrayCreate("LogonHours")
$arrLogonHours = $objUser.GetInfoEx ($avProps, 0)

This was based on some Googled-up examples of using objUser.GetInfoEx. It seems to want an array of string property names, and the array index of what you want second value has to be 0. Didn't help. Tried this code and it identified the returned value as a nul string:

expandcollapse popup

#include <array.au3>

Global $oMyErrorNum, $oMyErrorDesc, $sMsg = ""
$oMyError = ObjEvent("AutoIt.Error", "MyErrFunc")

$sUser = InputBox("LogonHours", "Input user name: ")
If @error Then Exit

$objUser = ObjGet("LDAP://CN=" & $sUser & ",OU=Domain Users,OU=Domain Users and Computers,DC=DC001,DC=domain,DC=com")
If IsObj($objUser) Then
    $avProps = _ArrayCreate("LogonHours")
    $arrLogonHours = $objUser.GetInfoEx ($avProps, 0)
    Select
        Case IsArray($arrLogonHours)
            MsgBox(64, "Array!", "$arrLogonHours is an array!")
            _ArrayDisplay($arrLogonHours, "$arrLogonHours")
        Case IsBinary($arrLogonHours)
            MsgBox(64, "Binary!", "$arrLogonHours is a binary:  Len = " & BinaryLen($arrLogonHours))
        Case IsString($arrLogonHours)
            MsgBox(64, "String!", "$arrLogonHours is a string:  " & $arrLogonHours)
        Case IsObj($arrLogonHours)
            MsgBox(64, "Object!", "$arrLogonHours is an object!")
        Case IsNumber($arrLogonHours)
            MsgBox(64, "Number!", "$arrLogonHours is a number:  " & $arrLogonHours)
        Case Else
            MsgBox(16, "None!", "$arrLogonHours type not recognized!")
    EndSelect
Else
    MsgBox(0, "Error", "No good LDAP connection, Try again ... ")
EndIf

Func MyErrFunc()
    $oMyErrorNum = $oMyError.number
    $oMyErrorDesc = $oMyError.windescription

    ; something to check for when this function returns
    ; @error = 1, @extended = 32bit error number
    MsgBox(16, "COM Error", "Number = " & $oMyErrorNum & @CRLF & "Description:  " & $oMyErrorDesc)
    SetError(1, $oMyError.number)
EndFunc   ;==>MyErrFuncoÝ÷ Ù+bYèzºè®Æî¶z+zÛ«ö¥¹ç¢¶«=!/z|(®Ç¢¶¯zg­ç±iËljg«zË¥·^Þ¦VyÚ®¢ÒèÇ¢êìªê-Â+ajx§µéíÚ¢¬¦º)z»r©ªê-)àà^®¸²«¨´óÒªäx.¦Ø^º'ÚÞxº(Ébëajجlºh±çm¢·­º¹î±¦åyÖ­j;¬µÆè­²¨¹Ú'ßÛaj÷­¢­¶·¶ò¢÷«¶§zÜ(®G¯z¼­g²¢ênV§jÛk»­xíz·¬¶)à+aÉèÂ×¥ÉÓ~®²èÇ¢êìÉ趷¢    âÍçl¢+wöȶاÊ&zØbî¶z-¡ûazÜ©zÂ-zË^uú+jëh×6 $avProps = _ArrayCreate("LogonHours") ; array of attributes to be cached
    $objUser.GetInfoEx ($avProps, 0) ; Caches the value from the directory
    $arrLogonHours = $objUser.Get("LogonHours")

Edited October 24, 2007 by PsaltyDS

[ptrex]

@PsaltyDS

Check the bug forum on my latest update.

regards

ptrex