Domänen-Benutzer auflisten AD.au3

Mahagon

Hi,
Habe ein seltsames Problem

Wenn ich versuche mit

Spoiler anzeigen

[autoit]

_AD_Open()
$qased = _AD_GetGroupMembers("CN=Domänen-Benutzer,CN=Users,DC=DOMAINXY,DC=de")
_ArrayDisplay($qased)
_AD_Close()

[/autoit]

bzw. mit

Spoiler anzeigen

[autoit]

_AD_Open()
$qased = _AD_GetGroupMembers("Domänen-Benutzer")
_ArrayDisplay($qased)
_AD_Close()

[/autoit]

die Benutzer auszulesen, erhalte ich immer $qased[0] = 0, obwohl ~150 Benutzer sich darin befinden sollten.
Andere Benutzergruppen in der Domäne funktionieren einwandfrei (sind aber auch nicht so groß)

Jemand eine Idee woran das liegen könnte? (am ä vermutlich nicht, da Domänen-Admins aufgelistet werden)

**water**

In aller Kürze: WAD - Works as designed.
Erklärung: Jeder User ist einer sogenannten "Primary Group" zugeordnet. In 99.9% der Fälle ist das die Gruppe "Domänen-Benutzer". Wenn Du solche "Primary Groups" nach ihren Gruppenmitgliedern abfragst, erhältst Du immer eine leere Liste. Denn die wäre unter Umständen kilometerlang.
Die Funktionen _AD_IsMemberOf, _AD_GetUserGroups, _AD_GetUserPrimaryGroup und _AD_SetUserPrimaryGroup behandeln diese speziellen Gruppen.

Du solltest also nicht von der Gruppe auf die User, sondern über die User auf die Gruppen schliessen.

Was willst Du eigentlich genau erreichen? Vielleicht geht das auch anders.

Mahagon

Ah okay...Danke
Naja kurz und Bündig: ich will Berechtigungen inkl Benutzer auflisten

Spoiler anzeigen

[autoit]

#RequireAdmin
#include <File.au3>
#include <AD.au3>
#include <GUIConstants.au3>
Local _
$FILE_READ_DATA__FILE_LIST_DIRECTORY = 1, _;Grants the right to read data from the file. For a directory, this value grants the right to list the contents of the directory.
$FILE_WRITE_DATA__FILE_ADD_FILE = 2, _;Grants the right to write data to the file. For a directory, this value grants the right to create a file in the directory.
$FILE_APPEND_DATA__FILE_ADD_SUBDIRECTORY = 4, _;Grants the right to append data to the file. For a directory, this value grants the right to create a subdirectory.
$FILE_READ_EA = 8, _;Grants the right to read extended attributes.
$FILE_WRITE_EA = 16, _;Grants the right to write extended attributes.
$FILE_EXECUTE__FILE_TRAVERSE = 32, _;Grants the right to execute a file. For a directory, the directory can be traversed.
$FILE_DELETE_CHILD = 64, _;Grants the right to delete a directory and all the files it contains (its children), even if the files are read-only.
$FILE_READ_ATTRIBUTES = 128, _;Grants the right to read file attributes.
$FILE_WRITE_ATTRIBUTES = 256, _;Grants the right to change file attributes.
$DELETE = 65536, _;Grants delete access.
$READ_CONTROL = 131072, _;Grants read access to the security descriptor and owner.
$WRITE_DAC = 262144, _;Grants write access to the discretionary access control list (ACL).
$WRITE_OWNER = 524288, _;Assigns the write owner.
$SYNCHRONIZE = 1048576, _;Synchronizes access and allows a process to wait for an object to enter the signaled state.
$OBJECT_INHERIT_ACE = 1, _;Noncontainer child objects inherit the ACE as an effective ACE. For child objects that are containers, the ACE is inherited as an inherit-only ACE unless the NO_PROPAGATE_INHERIT_ACE bit flag is also set.
$CONTAINER_INHERIT_ACE = 2, _ ; Child objects that are containers, such as directories, inherit the ACE as an effective ACE. The inherited ACE is inheritable unless the NO_PROPAGATE_INHERIT_ACE bit flag is also set.
$NO_PROPAGATE_INHERIT_ACE = 4, _ ;If the ACE is inherited by a child object, the system clears the OBJECT_INHERIT_ACE and CONTAINER_INHERIT_ACE flags in the inherited ACE. This prevents the ACE from being inherited by subsequent generations of objects.
$INHERIT_ONLY_ACE = 8, _ ;Indicates an inherit-only ACE which does not control access to the object to which it is attached. If this flag is not set, the ACE is an effective ACE which controls access to the object to which it is attached. Both effective and inherit-only ACEs can be inherited depending on the state of the other inheritance flags.
$INHERITED_ACE = 16, _ ;The system sets this bit when it propagates an inherited ACE to a child object.
$wbemFlagReturnImmediately = 0x10, _
$wbemFlagForwardOnly = 0x20, _
$colItems = "", _
$strComputer = "localhost", _
$objSD, _
$Output = "", _
$objDaclAccessmask
Local $aRights2dArray[1][21]
Local $aRightFlags[14] = [$FILE_READ_DATA__FILE_LIST_DIRECTORY, $FILE_WRITE_DATA__FILE_ADD_FILE, $FILE_APPEND_DATA__FILE_ADD_SUBDIRECTORY, $FILE_READ_EA, $FILE_WRITE_EA, $FILE_EXECUTE__FILE_TRAVERSE, $FILE_DELETE_CHILD, $FILE_READ_ATTRIBUTES, $FILE_WRITE_ATTRIBUTES, $DELETE, $READ_CONTROL, $WRITE_DAC, $WRITE_OWNER, $SYNCHRONIZE]
Local $aAceflags[5] = [$OBJECT_INHERIT_ACE, $CONTAINER_INHERIT_ACE, $NO_PROPAGATE_INHERIT_ACE, $INHERIT_ONLY_ACE, $INHERITED_ACE]
Local $sRootFolder = FileSelectFolder("Verzeichnis zum auslesen der Berechtigungen auswählen", "",2,"C:")
Local $pathall
Local $sProtokoll = @ScriptDir & "\" & StringReplace(StringReplace($sRootFolder, "\", "_"), ":", "-") & " Berechtigungen " & @YDAY & @MON & @MDAY & @HOUR & @MIN & @SEC & ".log"