Created with HTMHelp © Sebastian Walter
Function List
_AD_Open
Description: Opens a connection to Active Directory.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - (No longer used)
2 - Creation of the COM object to the AD failed. @extended returns error code from ObjCreate
3 - Open the connection to AD failed. @extended returns error code of the COM error handler.
Generated if the User doesn't have query / modify access
4 - Creation of the RootDSE object failed. @extended returns the error code received by the COM error handler.
Generated when connection to the domain isn't successful. @extended returns -2147023541 (0x8007054B)
5 - Creation of the DS object failed. @extended returns the error code received by the COM error handler
6 - Parameter $sHostServerParam and $sConfigurationParam are required when $sDNSDomainParam is specified
7 - Parameter $sPasswordParam is required when $sUserIdParam is specified
8 - OpenDSObject method failed. @extended set to error code received from the OpenDSObject method.
On Windows XP or lower this shows that $sUserIdParam and/or $sPasswordParam are invalid
x - For Windows Vista and later: Win32 error code (decimal). To get detailed error information call function _AD_GetLastADSIError
Parameters:
$sUserIdParam - Optional: UserId credential for authentication. This has to be a valid domain user
$sPasswordParam - Optional: Password for authentication
$sDNSDomainParam - Optional: Active Directory domain name if you want to connect to an alternate domain e.g. DC=microsoft,DC=com
$sHostServerParam - Optional: Name of Domain Controller if you want to connect to a different domain e.g. DC-Server1.microsoft.com
If you want to connect to a Global Catalog append port 3268 e.g. DC-Server1.microsoft.com:3268
You can omit the servername e.g. only specify microsoft.com if you want to access the domain root
$sConfigurationParam - Optional: Configuration naming context if you want to connect to a different domain e.g. CN=Configuration,DC=microsoft,DC=com
$iSecurity - Optional: Specifies the security settings to be used. Can be a combination of the following:
0: No security settings are used (default)
1: Sets the connection property "Encrypt Password" to True to encrypt userid and password
2: The channel is encrypted using Secure Sockets Layer (SSL). AD requires that the Certificate Server be installed to support SSL
Remarks: To close the connection to the Active Directory, use the _AD_Close function.
;+
_AD_Open will use the alternative credentials $sUserIdParam and $sPasswordParam if passed as parameters.
$sUserIdParam has to be in one of the following forms (assume the samAccountName = DJ)
* Windows Login Name e.g. "DJ"
* NetBIOS Login Name e.g. "<DOMAIN>\DJ"
* User Principal Name e.g. "DJ@domain.com"
All other name formats have NOT been successfully tested (see section "Link").
;+
Connection to an alternate domain (not the domain your computer is a member of) or if your computer is not a domain member
requires $sDNSDomainParam, $sHostServerParam and $sConfigurationParam as FQDN as well as $sUserIdParam and $sPasswordParam.
Example:
$sDNSDomainParam = "DC=subdomain,DC=example,DC=com"
$sHostServerParam = "servername.subdomain.example.com"
$sConfigurationParam = "CN=Configuration,DC=subdomain,DC=example,DC=com"
;+
The COM error handler will be initialized only if there doesn't already exist another error handler.
;+
If you specify $sUserIdParam as NetBIOS Login Name or User Principal Name and the OS is Windows Vista or later then _AD_Open will try to
verify the userid/password.
@error will be set to the Win32 error code (decimal). To get detailed error information please call _AD_GetlastADSIError.
For all other OS or if userid is specified as Windows Login Name @error=8.
This is OS dependant because Windows XP doesn't return useful error information.
For Windows Login Name all OS return success even when an error occures. This seems to be caused by secure authentification.
;+
$iSecurity = 2 activates LDAP/SSL. LDAP/SSL uses port 636 by default.
Note that an SSL server certificate must be configured properly in order to use SSL.
;+
If you want to connect to a specific DC in the current domain then just provide $sHostServerParam and let $sDNSDomainParam and $sConfigurationParam be blank.
Author: Jonathan Clelland
Modified: water
Related: _AD_Close
_AD_Close
Description: Closes the connection established to Active Directory by _AD_Open.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - Closing the connection to the AD failed. @extended returns the error code received by the COM error handler
Parameters:
None
Remarks: Even if closing the connection wasn't successfull and @error is set all used variables have been reset.
Author: Jonathan Clelland
Modified: water
Related: _AD_Open
_AD_ErrorNotify
Description: Set or query the debug level.
Return Value:
Success (for $iDebug = -1) - one based one-dimensional array with the following elements:
1 - Debug level. Value from 0 to 3. Check parameter $iDebug for details
2 - Debug file. File to write the debugging info to as defined by parameter $sDebugFile
3 - True if the COM error handler has beend set for this UDF. False if debugging is set off or another COM error handler was already stt
Success (for $iDebug = 0) - 1
Success (for $iDebug => 0) - 1, sets @extended to:
0 - The COM error handler for this UDF was already active
1 - A COM error handler has successfully been initialized for this UDF
Failure - 0, sets @error to:
1 - $iDebug is not an integer or < -1 or > 4
2 - Installation of the custom error handler failed. @extended is set to the error code returned by ObjEvent
3 - COM error handler already set to another function
Parameters:
$iDebug - Debug level. Allowed values are:
-1 - Return the current settings
0 - Disable debugging
1 - Enable debugging. Output the debug info to the console
2 - Enable Debugging. Output the debug info to a MsgBox
3 - Enable Debugging. Output the debug info to a file defined by $sDebugFile
4 - Enable Debugging. The COM errors will be handled (the script no longer crashes) without any output
$sDebugFile - Optional: File to write the debugging info to if $iDebug = 3 (Default = @ScriptDir & "\AD_Debug.txt")
Author: water
_AD_SamAccountNameToFQDN
Description: Returns a Fully Qualified Domain Name (FQDN) from a SamAccountName.
Return Value:
Success - Fully Qualified Domain Name (FQDN)
Failure - "", sets @error to:
1 - No record returned from Active Directory. $sSamAccountName not found
Parameters:
$sSamAccountName - Optional: Security Accounts Manager (SAM) account name (default = @UserName)
Remarks: A $ sign must be appended to the computer name to generate the FQDN for a sAMAccountName e.g. @ComputerName & "$".
The function escapes the following special characters (# and /). Commas in CN= or OU= have to be escaped by you.
If $sSamAccountName is already a FQDN then the function returns $sSamAccountName unchanged and without raising an error.
Author: Jonathan Clelland
Modified: water
Related: _AD_FQDNToSamAccountName
_AD_FQDNToSamAccountName
Description: Returns the SamAccountName of a Fully Qualified Domain Name (FQDN).
Return Value:
Success - SamAccountName
Failure - "", sets @error to:
1 - No record returned from Active Directory. $sFQDN not found
Parameters:
$sFQDN - Fully Qualified Domain Name (FQDN)
Remarks: You have to escape commas in $sFQDN with a backslash. E.g. "CN=Lastname\, Firstname,OU=..."
All other special characters (# and /) are escaped by the function.
If $sFQDN is already a SamAccountName then the function returns $sFQDN unchanged and without raising an error.
Author: Jonathan Clelland
Modified: water
Related: _AD_SamAccountNameToFQDN, _AD_FQDNToDisplayname
_AD_FQDNToDisplayname
Description: Returns the Display Name of a Fully Qualified Domain Name (FQDN) object.
Return Value:
Success - Display Name
Failure - "", sets @error to:
x - @error as set by function _AD_GetObjectAttribute
Parameters:
$sFQDN - Fully Qualified Domain Name (FQDN)
Remarks: You must escape commas in $sFQDN with a backslash. E.g. "CN=Lastname\, Firstname,OU=..."
All other special characters (# and /) are escaped by the function.
The function removes all escape characters (\) from the returned value.
Author: Jonathan Clelland
Modified: water
Related: _AD_FQDNToSamAccountName
_AD_ObjectExists
Description: Returns 1 if exactly one object exists for the given property in the local Active Directory Tree.
Return Value:
Success - 1, Exactly one object exists for the given property in the local Active Directory Tree
Failure - 0, sets @error to:
1 - No object found for the specified property
x - More than one object found for the specified property. x is the number of objects found
Parameters:
$sObject - Optional: Object (user, computer, group, OU) to check (default = @UserName)
$sProperty - Optional: Property to check. If omitted the function tries to determine whether to use sAMAccountname or FQDN
Remarks: Checking on a computer account requires a "$" (dollar) appended to the sAMAccountName.
To check the existence of an OU use the FQDN of the OU as first parameter because an OU has no SamAccountName.
Author: Jonathan Clelland
Modified: water
_AD_GetSchemaAttributes
Description: Enumerates attributes from the AD Schema (those replicated to the Global Catalog, indexed attributes or all).
Return Value:
Success - One-based two dimensional array with the following information for all selected attributes:
0 - ldapDisplayName of the attribute
1 - True if the attribute is replicated to the Global Catalog, False or "" of not
2 - True if the attribute is indexed. Indexed attributes give better performance
Failure - "", sets @error to:
1 - The LDAP query returned no records or another error occurred
Parameters:
$iSelect - Optional: Specifies the attributes to be returned:
1 - Return all attributes (default)
2 - Return all attributes that are replicated to the Global Catalog
3 - Return all attributes that are indexed
Author: water
_AD_GetObjectAttribute
Description: Returns the specified attribute for the named object.
Return Value:
Success - Value for the given attribute
Failure - "", sets @error to:
1 - $sObject does not exist
2 - $sAttribute does not exist for $sObject. @Extended is set to the error returned by LDAP
Parameters:
$sObject - sAMAccountName or FQDN of the object the attribute should be retrieved from
$sAttribute - Attribute to be retrieved
Remarks: If the attribute is a single-value the function returns a string otherwise it returns an array.
To get decrypted attributes (GUID, SID, dates etc.) please see _AD_GetObjectProperties.
Author: Jonathan Clelland
Modified: water
Related: _AD_ModifyAttribute, _AD_GetObjectProperties
_AD_IsMemberOf
Description: Returns 1 if the object (user, group, computer) is a member of the specified group or any contained group.
Return Value:
Success - 1, Specified object (user, group, computer) is a member of the specified group
Failure - 0, @error set
0 - $sObject is not a member of $sGroup
1 - $sGroup does not exist
2 - $sObject does not exist
Parameters:
$sGroup - Group to be checked for membership. Can be specified as sAMAccountName or Fully Qualified Domain Name (FQDN)
$sObject - Optional: Object type (user, group, computer) to check for membership of $sGroup. Can be specified as sAMAccountName or Fully Qualified Domain Name (FQDN) (default = @UserName)
$bIncludePrimaryGroup - Optional: Additionally checks the primary group for object membership (default = False)
$bRecursive - Optional: Recursively check all groups of $sGroup up to the depth defined by $iDepth (default = False)
$iDepth - Optional: Maximum depth of recursion (default = 10)
Remarks: Determines if the object is an immediate member of the group. This function does not verify membership in any nested groups.
Author: Jonathan Clelland
Modified: water
Related: _AD_GetUserGroups, _AD_GetUserPrimaryGroup, _AD_RecursiveGetMemberOf
_AD_HasFullRights
Description: Returns 1 if the given user has full rights over the given group or user.
Return Value:
Success - 1, Specified user has full rights over the given group or user
Failure - 0, @error set
0 - $sUser does not have full rights over $sObject
1 - $sUser does not exist
2 - $sObject does not exist
Parameters:
$sObject - Group or User to be checked. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$sUser - Optional: User to be checked. Can be specified as Fully Qualified Domain Name (FQDN) or SamAccountName (default = @UserName)
Author: Jonathan Clelland
Modified: water
Related: _AD_HasUnlockResetRights, _AD_HasRequiredRights, _AD_HasGroupUpdateRights
_AD_HasUnlockResetRights
Description: Returns 1 if the given user has unlock and password reset rights on the object.
Return Value:
Success - 1, Specified user has unlock and password reset rights over the given group or user
Failure - 0, @error set
0 - $sUser does not have unlock and password reset rights over $sObject
1 - $sUser does not exist
2 - $sObject does not exist
Parameters:
$sObject - Group or User to be checked. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$sUser - Optional: User to be checked. Can be specified as Fully Qualified Domain Name (FQDN) or SamAccountName (default = @UserName)
Author: Jonathan Clelland
Modified: water
Related: _AD_HasFullRights, _AD_HasRequiredRights, _AD_HasGroupUpdateRights
_AD_HasRequiredRights
Description: Returns 1 if the given user has the required rights on the object.
Return Value:
Success - 1, Specified user has the required rights over the given group or user
Failure - 0, @error set
0 - $sUser does not have the required rights over $sObject
1 - $sUser does not exist
2 - $sObject does not exist
Parameters:
$sObject - Group or User to be checked. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$sRight - Optional: Access mask constant to be checked (default = $ADS_FULL_RIGHTS (Full rights)).
Full rights is the combination of the following rights:
ADS_RIGHT_DELETE = 0x10000
ADS_RIGHT_READ_CONTROL = 0x20000
ADS_RIGHT_WRITE_DAC = 0x40000
ADS_RIGHT_WRITE_OWNER = 0x80000
ADS_RIGHT_DS_CREATE_CHILD = 0x1
ADS_RIGHT_DS_DELETE_CHILD = 0x2
ADS_RIGHT_ACTRL_DS_LIST = 0x4
ADS_RIGHT_DS_SELF = 0x8
ADS_RIGHT_DS_READ_PROP = 0x10
ADS_RIGHT_DS_WRITE_PROP = 0x20
ADS_RIGHT_DS_DELETE_TREE = 0x40
ADS_RIGHT_DS_LIST_OBJECT = 0x80
ADS_RIGHT_DS_CONTROL_ACCESS = 0x100
$sUser - Optional: User to be checked. Can be specified as Fully Qualified Domain Name (FQDN) or SamAccountName (default = @UserName)
Author: Jonathan Clelland
Modified: water
Related: _AD_HasFullRights, _AD_HasUnlockResetRights, _AD_HasGroupUpdateRights
_AD_HasGroupUpdateRights
Description: Returns 1 if the given user has rights to update the group membership of the object.
Return Value:
Success - 1, Specified user has the rights to update the group membership on the given group
Failure - 0, @error set
0 - $sUser does not have the rights to update the group membership on $sObject
1 - $sUser does not exist
2 - $sObject does not exist
Parameters:
$sObject - Group to be checked. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$sUser - Optional: User to be checked. Can be specified as Fully Qualified Domain Name (FQDN) or SamAccountName (default = @UserName)
Author: Jonathan Clelland
Modified: water
Related: _AD_HasFullRights, _AD_HasUnlockResetRights, _AD_HasRequiredRights
_AD_GetObjectClass
Description: Returns the main class (also called structural class) of an object ("user", "group" etc.).
Return Value:
Success - Main class of the specified object if $bAll = False or an zero-based array of the main plus the superior classes if $bAll = True
Failure - "", sets @error to:
1 - Specified object does not exist
2 - The LDAP query returned no record. @extended is set to the error returned by LDAP
Parameters:
$sObject - Object for which the main class should be returned. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$bAll - Optional: Returns the main class plus the superior classes from which the main class is deduced hierarchically (default = False)
Author: Jonathan Clelland
Modified: water
_AD_GetObjectOU
Description: Returns the OU (Organizational Unit) of an object ("user", "group" etc.).
Return Value:
Success - FQDN of the object's OU.
Failure - "", sets @error to:
1 - Specified object does not exist
2 - The LDAP query returned no record. @extended is set to the error returned by LDAP
3 - Parameter $sReturn is wrong. Must be "distinguishedName" or "Name"
Parameters:
$sObject - Object for which the main class should be returned. Can be specified as Fully Qualified Domain Name (FQDN), sAMAccountName or ADsPath
$sReturn - Optional: Property to return. Must be "distinguishedName" or "Name" (default = "distinguishedName")
Author: water
_AD_GetUserGroups
Description: Returns an array of group names that the user is immediately a member of.
Return Value:
Success - Returns an one-based one dimensional array of group names (FQDN) the user is a member of
Failure - "", sets @error to:
1 - Specified user does not exist
Parameters:
$sUser - Optional: User for which the group membership is to be returned (default = @Username). Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$bIncludePrimaryGroup - Optional: include the primary group to the returned list (default = False)
Remarks: Works for computers or groups as well.
Author: Jonathan Clelland
Modified: water
Related: _AD_IsMemberOf, _AD_GetUserPrimaryGroup, _AD_RecursiveGetMemberOf
_AD_GetUserPrimaryGroup
Description: Returns the primary group the user is assigned to.
Return Value:
Success - Primary group (FQDN) the user is assigned to.
Failure - "", sets @error to:
1 - Specified user does not exist
2 - A primary group couldn't be found for the specified user
Parameters:
$sUser - Optional: User for which the primary group is to be returned (default = @Username). Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
Author: Jonathan Clelland
Modified: water
Related: _AD_IsMemberOf, _AD_GetUserGroups, _AD_RecursiveGetMemberOf, _AD_SetUserPrimaryGroup
_AD_SetUserPrimaryGroup
Description: Sets the users primary group.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sUser does not exist
2 - $sGroup does not exist
3 - $sUser must be a member of $sGroup
x - Error returned by SetInfo method (Missing permission etc.)
Parameters:
$sUser - User for which the primary group is to be set. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$sGroup - Group to be set as the primary group for the specified user. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
Author: Talder
Related: _AD_AddUserToGroup, _AD_GetUserPrimaryGroup
_AD_RecursiveGetMemberOf
Description: Takes a group, user or computer and recursively returns a list of groups the object is a member of.
Return Value:
Success - Returns an one-based one dimensional array of group names (FQDN or sAMAccountName) the user or group is a member of
Failure - "", sets @error to:
1 - Specified user, group or computer does not exist
Parameters:
$sObject - User, group or computer for which the group membership is to be returned. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$iDepth - Optional: Maximum depth of recursion (default = 10)
$bListInherited - Optional: Defines if the function returns the group(s) it was inherited from (default = True)
$bFQDN - Optional: Specifies the attribute to be returned. True = distinguishedName (FQDN), False = SamAccountName (default = True)
Remarks: This function traverses the groups that the object is immediately a member of while also checking its group membership.
For groups that are inherited, the return is the FQDN or sAMAccountname of the group, user or computer, and the FQDN(s) or sAMAccountname(s) of the group(s) it
was inherited from, seperated by '|'(s) if flag $bListInherited is set to True.
;+
If flag $bListInherited is set to False then the group names are sorted and only unique groups are returned.
Author: Jonathan Clelland
Modified: water
Related: _AD_IsMemberOf, _AD_GetUserGroups, _AD_GetUserPrimaryGroup
_AD_GetGroupMembers
Description: Returns an array of group members.
Return Value:
Success - Returns an one-based one dimensional array of names (FQDN) that are members of the specified group
Failure - "", sets @error to:
1 - Specified group does not exist
Parameters:
$sGroup - Group to retrieve members from. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
Remarks: If the group has no members, _AD_GetGroupMembers returns an array with one element (row count) set to 0
Author: Jonathan Clelland
Modified: water
Related: _AD_GetGroupMemberOf, _AD_RecursiveGetGroupMembers
_AD_RecursiveGetGroupMembers
Description: Takes a group and recursively returns a list of groups and members of the group.
Return Value:
Success - Returns an one-based one dimensional array of group or member names (FQDN or sAMAccountName)
Failure - "", sets @error to:
1 - Specified group does not exist
Parameters:
$sGroup - Group for which the members should to be returned. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
$iDepth - Optional: Maximum depth of recursion (default = 10)
$bListInherited - Optional: Defines if the function returns the group it is a member of (default = True)
$bFQDN - Optional: Specifies the attribute to be returned. True = distinguishedName (FQDN), False = SamAccountName (default = True)
Remarks: This function traverses the groups in the specified group until the maximum depth is reached.
if $bListInherited = True the return is the FQDN or sAMAccountname of the group or member and the FQDN(s) or sAMAccountname(s) of the group it
is a member of, seperated by '|'(s) if flag $bListInherited is set to True.
;+
If flag $bListInherited is set to False then the group/member names are sorted and only unique entries are returned.
Author: Jonathan Clelland
Modified: water
Related: _AD_GetGroupMembers
_AD_GetGroupMemberOf
Description: Returns an array of group membership.
Return Value:
Success - Returns an one-based one dimensional array of group names (FQDN) that the specified group is a member of
Failure - "", sets @error to:
1 - Specified group does not exist
Parameters:
$sGroup - Group for which membership in other groups is to be retrieved. Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
Author: Jonathan Clelland
Modified: water
Related: _AD_GetGroupMembers, _AD_RecursiveGetGroupMembers
_AD_GetObjectsInOU
Description: Returns a filtered array of objects and attributes for a given OU or just the number of records if $bCount is True.
Return Value:
Success - Number of records retrieved or a one or two dimensional one-based array of objects and attributes in the given OU. First entry is for the given OU itself
Failure - "", sets @error to:
1 - Specified OU does not exist
2 - No records returned from Active Directory. $sDataToRetrieve is invalid (attribute may not exist). @extended is set to the error returned by LDAP
3 - No records returned from Active Directory. $sFilter didn't return a record
Parameters:
$sOU - The OU to retrieve from (FQDN) (default = "", equals "search the whole AD tree")
$sFilter - Optional: An additional LDAP filter if required (default = "(name=*)")
$iSearchScope - Optional: 0 = base, 1 = one-level, 2 = sub-tree (default)
$sDataToRetrieve - Optional: A comma-seperated list of attributes to retrieve (default = "sAMAccountName").
More than one attribute will create a 2-dimensional array
$sSortBy - Optional: name of the attribute the resulting array will be sorted upon (default = "sAMAccountName").
To completely suppress sorting (even the default sort) set this parameter to "". This improves performance when doing large queries
$bCount - Optional: If set to True only returns the number of records returned by the query (default = False)
$vReturnNull - Optional: If set to any other value but True Null values (occur when the property has never been set) are returned as this value (default = True)
Remarks: Multi-value attributes are returned as string with the pipe character (|) as separator.
;+
The default filter returns an array including one record for the OU itself. To exclude the OU use a different filter that doesn't include the OU
e.g. "(&(objectcategory=person)(objectclass=user)(name=*))"
;+
To make sure that all properties you specify in $sDataToRetrieve exist in the AD you can use _AD_ObjectExistsInSchema.
;+
The following examples illustrate the use of the escaping mechanism in the LDAP filter:
(o=Parens R Us \28for all your parenthetical needs\29)
(cn=*\2A*)
(filename=C:\5cMyFile)
(bin=\00\00\00\04)
(sn=Lu\c4\8di\c4\87)
The first example shows the use of the escaping mechanism to represent parenthesis characters.
The second shows how to represent a "*" in a value, preventing it from being interpreted as a substring indicator.
The third illustrates the escaping of the backslash character.
The fourth example shows a filter searching for the four-byte value 0x00000004, illustrating the use of the escaping mechanism to
represent arbitrary data, including NUL characters.
The final example illustrates the use of the escaping mechanism to represent various non-ASCII UTF-8 characters.
Author: Jonathan Clelland
Modified: water
Related: _AD_GetAllOUs
_AD_GetAllOUs
Description: Retrieves an array of OUs. The paths are separated by the '\' character.
Return Value:
Success - One-based two dimensional array of OUs starting with the given OU. The paths are separated by "\"
0 - ... \name of grandfather OU\name of father OU\name of son OU
1 - Distinguished Name (FQDN) of the son OU
Failure - "", sets @error to:
1 - No OUs found
2 - Specified $sRoot does not exist
3 - $iSelect is not an integer or < 0 or > 2
Parameters:
$sRoot - Optional: OU (FQDN) where to start in the AD tree (default = "", equals "start at the AD root")
$sSeparator - Optional: Single character to separate the OU names (default = "\")
$iSelect - Optional: Which objects should be returned in the result (default = 0)
0 - Return OUs (Organizational Units) (default)
1 - Return CNs (Containers)
2 - Return OUs + CNs
$iSearchScope - Optional: 0 = base, 1 = one-level, 2 = sub-tree (default)
Remarks: If an OU contains spaces the sorting is wrong and might lead to problems in further processing.
Please have a look at www.autoitscript.com/forum/topic/106163-active-directory-udf/page__view__findpost__p__943892
Author: Jonathan Clelland
Modified: water
Related: _AD_GetObjectsInOU
_AD_ListDomainControllers
Description: Enumerates all Domain Controllers (returns information about: Domain Controller, site, subnet and Global Catalog).
Return Value:
Success - One-based two dimensional array with the following information:
0 - Domain Controller: Name
1 - Domain Controller: Distinguished Name (FQDN)
2 - Domain Controller: DNS host name
3 - Site: Name
4 - Site: Distinguished Name (FQDN)
5 - Site: List of subnets that can connect to the site using this DC in the format x.x.x.x/mask - multiple subnets are separated by comma
6 - Global Catalog: Set to True if the DC is a Global Catalog (only if flag $bListGC = True. If False then "" is returned)
Failure - "", sets @error to:
1 - No Domain Controllers found. @extended is set to the error returned by LDAP
Parameters:
$bListRO - Optional: If set to True only returns RODC (read only domain controllers) (default = False)
$bListGC - Optional: If set to True queries the DC for a Global Catalog. Disabled for performance reasons (default = False)
Remarks: This function only lists writeable DCs (default). To list RODC (read only DCs) use parameter $bListRO
Author: water (based on VB functions by Richard L. Mueller)
_AD_ListRootDSEAttributes
Description: Returns a one-based array of the RootDSE Atributes.
Return Value:
Success - Returns an one-based one dimensional array of the following RootDSE attributes. Multi-valued attributes are as multiple lines.
1 - configurationNamingContext: Specifies the distinguished name for the configuration container.
2 - currentTime: Specifies the current time set on this directory server in Coordinated Universal Time format.
3 - defaultNamingContext: Specifies the distinguished name of the domain that this directory server is a member.
4 - dnsHostName: Specifies the DNS address for this directory server.
5 - domainControllerFunctionality: Specifies the functional level of this domain controller. Values can be:
0 - Windows 2000 Mode
2 - Windows Server 2003 Mode
3 - Windows Server 2008 Mode
4 - Windows Server 2008 R2 Mode
5 - Windows Server 2012 Mode
6 - Windows Server 2012 R2 Mode
7 - Windows Server 2016 Mode
6 - domainFunctionality: Specifies the functional level of the domain. Values can be:
0 - Windows 2000 Domain Mode
1 - Windows Server 2003 Interim Domain Mode
2 - Windows Server 2003 Domain Mode
3 - Windows Server 2008 Domain Mode
4 - Windows Server 2008 R2 Domain Mode
5 - Windows Server 2012 Domain Mode
6 - Windows Server 2012 R2 Domain Mode
7 - Windows Server 2016 Domain Mode
7 - dsServiceName: Specifies the distinguished name of the NTDS settings object for this directory server.
8 - forestFunctionality: Specifies the functional level of the forest. Values can be:
0 - Windows 2000 Forest Mode
1 - Windows Server 2003 Interim Forest Mode
2 - Windows Server 2003 Forest Mode
3 - Windows Server 2008 Forest Mode
4 - Windows Server 2008 R2 Forest Mode
5 - Windows Server 2012 Forest Mode
6 - Windows Server 2012 R2 Forest Mode
7 - Windows Server 2016 Forest Mode
9 - highestCommittedUSN: Specifies the highest update sequence number (USN) on this directory server. Used by directory replication.
10 - isGlobalCatalogReady: Specifies Global Catalog operational status. Values can be either True or False.
11 - isSynchronized: Specifies directory server synchronisation status. Values can be either True or False.
12 - LDAPServiceName: Specifies the Service Principal Name (SPN) for the LDAP server. Used for mutual authentication.
13 - namingContexts: A multi-valued attribute that specifies the distinguished names for all naming contexts stored on this directory server.
+By default, a Windows 2000 domain controller has at least three naming contexts: Schema, Configuration, and the domain which the server is a member of.
14 - rootDomainNamingContext: Specifies the distinguished name for the first domain in the forest that this directory server is a member of.
15 - schemaNamingContext: Specifies the distinguished name for the schema container.
16 - serverName: Specifies the distinguished name of the server object for this directory server in the configuration container.
17 - subschemaSubentry: Specifies the distinguished name for the subSchema object. The subSchema object specifies properties that expose the supported attributes
+(in the attributeTypes property) and classes (in the objectClasses property).
18 - supportedCapabilities: multi-valued attribute that specifies the capabilities supported by this directory server.
19 - supportedControl: A multi-valued attribute that specifies the extension control OIDs supported by this directory server.
20 - supportedLDAPPolicies: A multi-valued attribute that specifies the names of the supported LDAP management policies.
21 - supportedLDAPVersion: A multi-valued attribute that specifies the LDAP versions (specified by major version number) supported by this directory server.
22 - supportedSASLMechanisms: Specifies the security mechanisms supported for SASL negotiation (see LDAP RFCs). By default, GSSAPI is supported.
Remarks: In LDAP 3.0, rootDSE is defined as the root of the directory data tree on a directory server.
The rootDSE is not part of any namespace. The purpose of the rootDSE is to provide data about the directory server.
Author: water
_AD_ListRoleOwners
Description: Returns a one-based array of FSMO (Flexible Single Master Operation) Role Owners.
Return Value:
Success - Returns an one-based one dimensional array of FSMO Role Owners. The array contains:
1 - Domain PDC FSMO
2 - Domain Rid FSMO
3 - Domain Infrastructure FSMO
4 - Forest-wide Schema FSMO
5 - Forest-wide Domain naming FSMO
Author: water
_AD_GetLastLoginDate
Description: Returns the lastlogin information for user and computer accounts from all DCs using the SamAccountName.
Return Value:
Success - Last login date returned as YYYYMMDDHHMMSS. @extended is set to the total number of Domain Controllers.
+@error could be > 0 and contains the number of DCs that could not be reached or returns no data
Failure - 0, sets @error to:
1 - $sObject could not be found. @extended = 0
2 - $sObject has never logged in to the domain. @extended = 0
3 - $aDCList has to be an array or blank
4 - $aDCList has to be a 2-dimensional array
Warning - Last login date returned as YYYYMMDDHHMMSS (see Success), sets @error and @extended to:
x - Number of DCs which could not be reached. Result is returned from all available DCs. @extended is set to the total number of Domain Controllers
Parameters:
$sObject - Optional: SamAccountName of a user or computer account to get the last login date (default = @Username).
$sSite - Optional: Only query DCs that belong to this site(s) (default = all sites).
+This can be a single site or a list of sites separated by commas
$aDCList - Optional: one-based two dimensional array of Domain Controllers as returned by function _AD_ListDomainControllers (default = "")
Remarks: If it takes (too) long to get a result either some DCs are down or you have too many DCs in your AD.
+Case one: Please check @error and @extended as described above
+Case two: Specify parameter $sSite to reduce the number of DCs to query and/or retrieve the list of DCs yourself and pass the array as parameter 3
Author: Jonathan Clelland
Modified: water, Stephane
_AD_IsObjectDisabled
Description: Returns 1 if the object (user account, computer account) is disabled.
Return Value:
Success - 1, Specified object is disabled
Failure - 0, sets @error to:
0 - $sObject is not disabled
1 - $sObject could not be found
Parameters:
$sObject - Optional: Object to check (default = @Username). Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
Remarks: A $ sign must be appended to the computer name to create a correct sAMAccountName e.g. @ComputerName & "$"
Author: Jonathan Clelland
Modified: water
Related: _AD_DisableObject, _AD_EnableObject, _AD_GetObjectsDisabled
_AD_IsObjectLocked
Description: Returns 1 if the object (user account, computer account) is locked.
Return Value:
Success - 1, Specified object is locked, sets @error to:
x - number of minutes till the account is unlocked. -1 means the account has to be unlocked manually by an admin
Failure - 0, sets @error to:
0 - $sObject is not locked
1 - $sObject could not be found
Parameters:
$sObject - Optional: Object to check (default = @Username). Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
Remarks: A $ sign must be appended to the computer name to create a correct sAMAccountName e.g. @ComputerName & "$"
LockoutTime contains the timestamp when the object was locked. This value is not reset until the user/computer logs on again.
LockoutTime could be > 0 even when the lockout already has expired.
Author: water
Related: _AD_GetObjectsLocked, _AD_UnlockObject
_AD_IsPasswordExpired
Description: Returns 1 if the password of the user or computer account has expired.
Return Value:
Success - 1, The password of the specified account has expired
Failure - 0, sets @error to:
0 - Password for $sAccount has not expired
1 - $sAccount could not be found
x - Error as returned by function _AD_GetPasswordInfo
Parameters:
$sAccount - Optional: User or computer account to check (default = @Username). Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
Remarks: Correctly works with fine-grained passwort policy
Author: Jonathan Clelland
Modified: water
Related: _AD_GetPasswordExpired, _AD_GetPasswordDontExpire, _AD_SetPassword, _AD_DisablePasswordExpire, _AD_EnablePasswordExpire, _AD_EnablePasswordChange, _AD_DisablePasswordChange, _AD_GetPasswordInfo
_AD_GetObjectsDisabled
Description: Returns an array with FQDNs of disabled objects (user accounts, computer accounts).
Return Value:
Success - array of user or computer account FQDNs
Failure - "", sets @error to:
1 - $sClass is invalid. Values can be "computer" or "user"
2 - Specified $sRoot does not exist
Parameters:
$sClass - Optional: Specifies if disabled user accounts or computer accounts should be returned (default = "user").
"user" - Returns objects of category "user"
"computer" - Returns objects of category "computer"
$sRoot - Optional: FQDN of the OU where the search should start (default = "" = search the whole tree)
Author: Jonathan Clelland
Modified: water
Related: _AD_IsObjectDisabled, _AD_DisableObject, _AD_EnableObject
_AD_GetObjectsLocked
Description: Returns an array of FQDNs of locked (user and/or, computer accounts), lockout time and minutes remaining in locked state.
Return Value:
Success - Returns a one-based two dimensional array with the following information:
0 - FQDN of the locked object
1 - lockout time YYYY/MM/DD HH:MM:SS in local time of the calling user
2 - Minutes until the object will be unlocked
Failure - "", sets @error to:
1 - $sClass is invalid. Should be "computer" or "user"
2 - No locked objects found
3 - Specified $sRoot does not exist
Parameters:
$sClass - Optional: Specifies if locked user accounts or computer accounts should be returned (default = "user").
"user" - Returns objects of category "user"
"computer" - Returns objects of category "computer"
$sRoot - Optional: FQDN of the OU where the search should start (default = "" = search the whole tree)
Remarks: LockoutTime contains the timestamp when the object was locked. This value is not reset until the user/computer logs on again.
LockoutTime could be > 0 even when the lockout has already expired.
Author: Jonathan Clelland
Modified: water
Related: _AD_IsObjectLocked, _AD_UnlockObject
_AD_GetPasswordExpired
Description: Returns an array of FQDNs of user or computer accounts with expired passwords.
Return Value:
Success - One-based two dimensional array of FQDNs of accounts with expired passwords
0 - FQDNs of accounts with expired password
1 - password last set YYYY/MM/DD HH:NMM:SS UTC
2 - password last set YYYY/MM/DD HH:NMM:SS local time of calling user
Failure - "", sets @error to:
1 - No expired passwords found. @extended is set to the error returned by LDAP
2 - Specified $sRoot does not exist
3 - $iPasswordAge is not numeric
Parameters:
$sRoot - Optional: FQDN of the OU where the search should start (default = "" = search the whole tree)
$bNeverChanged - Optional: If set to True returns all accounts who have never changed their password as well (default = False)
$iPasswordAge - Optional: Takes the max. password age from the AD or uses this value if > 0
$bComputer - Optional: If True queries computer accounts, if False queries user accounts (default = False)
Author: water
Related: _AD_IsPasswordExpired, _AD_GetPasswordDontExpire, _AD_SetPassword, _AD_DisablePasswordExpire, _AD_EnablePasswordExpire, _AD_EnablePasswordChange, _AD_DisablePasswordChange, _AD_GetPasswordInfo
_AD_GetPasswordDontExpire
Description: Returns an array of user account FQDNs where the password does not expire.
Return Value:
Success - Array with FQDNs of user accounts for which the password does not expire
Failure - "", sets @error to:
1 - No user accounts for which the password does not expire. @extended is set to the error returned by LDAP
2 - Specified $sRoot does not exist
Parameters:
$sRoot - Optional: FQDN of the OU where the search should start (default = "" = search the whole tree)
Author: Jonathan Clelland
Modified: water
Related: _AD_IsPasswordExpired, _AD_GetPasswordExpired, _AD_SetPassword, _AD_DisablePasswordExpire, _AD_EnablePasswordExpire, _AD_EnablePasswordChange, _AD_DisablePasswordChange, _AD_GetPasswordInfo
_AD_GetObjectProperties
Description: Returns a two-dimensional array of all or selected properties and their values of an object in readable form.
Return Value:
Success - Returns a one based two-dimensional array with all properties and their values of an object in readable form
Failure - "" or property name, sets @error to:
1 - $vObject could not be found
2 - No values for the specified property. The name of the property in error is returned as the function result
3 - Error retrieving $vObject. @Extended is set to the error returned by LDAP
Parameters:
$vObject - Optional: SamAccountName, FQDN or ADSPath of the object to retrieve properties from (e.g. computer, user, group ...) (default = @Username)
Can be of type object as well. Useful to get properties for a schema or configuration object (see _AD_ListRootDSEAttributes)
$sProperties - Optional: Comma separated list of properties to return (default = "" = return all properties)
$bSort - Optional: True specifies that the array will be sorted on property name (default = True)
Remarks: Dates are returned in format: YYYY/MM/DD HH:MM:SS local time of the calling user (AD stores all dates in UTC - Universal Time Coordinated)
Exception: AD internal dates like "whenCreated", "whenChanged" and "dSCorePropagationData". They are returned as UTC
NT Security Descriptors are returned as: Control:nn, Group:Domain\Group, Owner:Domain\Group, Revision:nn
No error is returned if there are properties in $sProperties that are not available for the selected object
;+
Properties are returned in alphabetical order. If $sProperties is set to "samaccountname,displayname" the returned array will contain
displayname as the first and samaccountname as the second row.
Author: Sundance
Modified: water
_AD_CreateOU
Description: Creates a child OU in the specified parent OU.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sParentOU does not exist
2 - $sOU in $sParentOU already exists
3 - $sOU is missing
x - Error returned by Create or SetInfo method (Missing permission etc.)
Parameters:
$sParentOU - Parent OU where the new OU will be created (FQDN)
$sOU - OU to create in the the parent OU (Name without leading "OU=")
Remarks: This does not create any attributes for the OU. Use function _AD_ModifyAttribute.
Author: Jonathan Clelland
Modified: water
Related: _AD_CreateUser, _AD_CreateGroup, _AD_AddUserToGroup, _AD_RemoveUserFromGroup
_AD_CreateUser
Description: Creates and activates a user in the specified OU.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sUser already exists
2 - $sOU does not exist
3 - $sCN is missing
4 - $sUser is missing
5 - $sUser could not be created. @extended is set to the error returned by LDAP
x - Error returned by SetInfo method (Missing permission etc.)
Parameters:
$sOU - OU to create the user in. Form is "OU=sampleou,OU=sampleparent,DC=sampledomain1,DC=sampledomain2"
$sUser - Username, form is SamAccountName without leading 'CN='
$sCN - Common Name (without CN=) or RDN (Relative Distinguished Name) like "Lastname Firstname"
Remarks: This function only sets sAMAccountName (= $sUser) and userPrincipalName (e.g. $sUser@microsoft.com).
All other attributes have to be set using function _AD_ModifyAttribute
Author: Jonathan Clelland
Modified: water
Related: _AD_CreateOU, _AD_CreateGroup, _AD_AddUserToGroup, _AD_RemoveUserFromGroup
_AD_SetPassword
Description: Sets or clears the password for a user or computer.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetPassword or SetInfo method (Missing permission etc.)
Parameters:
$sObject - User or computer for which to set the password (FQDN or sAMAccountName)
$sAD_Password - Optional: Password to be set for $sObject. If $sAD_Password is "" then the password will be cleared (default)
$iExpired - Optional: 1 = the password has to be changed at next logon (Default = 0)
Remarks: Changing the password for a computer does a "reset" so the computer can be rejoined to the domain with the same SID.
Author: KenE
Modified: water
Related: _AD_IsPasswordExpired, _AD_GetPasswordExpired, _AD_GetPasswordDontExpire, _AD_DisablePasswordExpire, _AD_EnablePasswordExpire, _AD_EnablePasswordChange, _AD_DisablePasswordChange, _AD_GetPasswordInfo, _AD_ChangePassword
_AD_ChangePassword
Description: Changes the password for the currently logged on user.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - Error accessing the current user object
2 - Error returned by ChangePassword method (Missing permission etc.)
Parameters:
$sOldPW - Old password of the user
$sNewPW - New password to be set for the user
Remarks: This allows a logged on user without elevated permissions to change his password.
Author: water
Related: _AD_IsPasswordExpired, _AD_GetPasswordExpired, _AD_GetPasswordDontExpire, _AD_DisablePasswordExpire, _AD_EnablePasswordExpire, _AD_EnablePasswordChange, _AD_DisablePasswordChange, _AD_GetPasswordInfo, _AD_SetPassword
_AD_CreateGroup
Description: Creates a group in the specified OU.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sGroup already exists
2 - $sOU does not exist
x - Error returned by Create or SetInfo method (Missing permission etc.)
Parameters:
$sOU - OU to create the group in. Form is "OU=sampleou,OU=sampleparent,DC=sampledomain1,DC=sampledomain2" (FQDN)
$sGroup - Groupname, form is SamAccountName without leading 'CN='
$iType - Optional: Group type (default = $ADS_GROUP_TYPE_GLOBAL_SECURITY). NOTE: Global security must be 'BitOr'ed with a scope.
Remarks: This function only sets sAMAccountName and grouptype. All other attributes have to be set using
function _AD_ModifyAttribute
Author: Jonathan Clelland
Modified: water
Related: _AD_CreateOU, _AD_CreateUser, _AD_AddUserToGroup, _AD_RemoveUserFromGroup
_AD_AddUserToGroup
Description: Adds a user or computer to the specified group.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sGroup does not exist
2 - $sUser (user or computer) does not exist
3 - $sUser (user or computer) is already a member of $sGroup
x - Error returned by Add or SetInfo method (Missing permission etc.)
Parameters:
$sGroup - Groupname (FQDN or sAMAccountName)
$sUser - Username or computername to be added to the group (FQDN or sAMAccountName)
Remarks: Works for both computers and groups. The sAMAccountname of a computer requires a trailing "$" before converting it to a FQDN.
Author: Jonathan Clelland
Modified: water
Related: _AD_CreateOU, _AD_CreateUser, _AD_CreateGroup, _AD_RemoveUserFromGroup
_AD_RemoveUserFromGroup
Description: Removes a user or computer from the specified group.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sGroup does not exist
2 - $sUser does not exist
3 - $sUser is not a member of $sGroup
x - Error returned by Remove or SetInfo method (Missing permission etc.)
Parameters:
$sGroup - Groupname (FQDN or sAMAccountName)
$sUser - Username (FQDN or sAMAccountName)
Remarks: Works for computer objects as well. Remember that the sAMAccountname of a computer needs a trailing "$" before converting it to a FQDN.
Author: Jonathan Clelland
Modified: water
Related: _AD_CreateOU, _AD_CreateUser, _AD_CreateGroup, _AD_AddUserToGroup
_AD_CreateComputer
Description: Creates and enables a computer account. A specific, authenticated user/group can then use this account to add his or her workstation to the domain.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sOU does not exist
2 - $sComputer already defined in $sOU
3 - $sUser does not exist
x - Error returned by Create or SetInfo method (Missing permission etc.)
Parameters:
$sOU - OU to create the computer in. Form is "OU=sampleou,OU=sampleparent,DC=sampledomain1,DC=sampledomain2" (FQDN)
$sComputer - Computername, form is SamAccountName without trailing "$"
$sUser - User or group that will be allowed to add the computer to the domain (SamAccountName)
Remarks: By default, any authenticated user can create up to 10 computer accounts in the domain (machine account quota).
(see: technet.microsoft.com/en-us/library/cc780195(WS.10).aspx)
To create the Access Control List you need certain permissions. If this permissions are missing you might be able to add the
computer to the domain but the function will exit with failure and the ACL is not set.
;+
Creating a computer object in AD does not permit a user to join a computer to the domain.
Certain permissions have to be granted so that the user has rights to modify the computer object.
When you create a computer account using the ADUC snap-in you have the option to select a
user or group to manage the computer object and join a computer to the domain using that object.
;+
When you use that method, the following access control entries (ACEs) are added to the
access control list (ACL) of the computer object:
* List Contents, Read All Properties, Delete, Delete Subtree, Read Permissions, All
Extended Rights (i.e., Allowed to Authenticate, Change Password, Send As, Receive As, Reset Password)
* Write Property for description
* Write Property for sAMAccountName
* Write Property for displayName
* Write Property for Logon Information
* Write Property for Account Restrictions
* Validate write to DNS host name
* Validated write for service principal name
Author: Jonathan Clelland
Modified: water
Related: _AD_CreateOU, _AD_JoinDomain
_AD_ModifyAttribute
Description: Modifies an attribute of the given object to the value specified.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetInfo method (Missing permission etc.)
Parameters:
$sObject - Object (user, group ...) to add/delete/modify an attribute (sAMAccountName or FQDN)
$sAttribute - Attribute to add/delete/modify
$sValue - Optional: Value to modify the attribute to. Use a blank string ("") to delete the attribute (default).
+$sValue can be a single value (as a string) or a multi-value (as a one-dimensional array)
$iOption - Optional: Indicates the mode of modification: Append, Replace, Remove, and Delete
1 - CLEAR: remove all the property value(s) from the object (default when $svalue = "")
2 - UPDATE: replace the current value(s) with the specified value(s)
3 - APPEND: append the specified value(s) to the existing values(s)
4 - DELETE: delete the specified value(s) from the object
Author: Jonathan Clelland
Modified: water
Related: _AD_GetObjectAttribute, _AD_GetObjectProperties, _AD_AddEmailAddress
_AD_RenameObject
Description: Renames an object within an OU.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sObject does not exist
x - Error returned by MoveHere function (Missing permission etc.)
Parameters:
$sObject - Object (user, group, computer) to rename (FQDN or sAMAccountName)
$sCN - New Name (relative name) of the object in the current OU without CN=
Remarks: Renames an object within the same OU. You can not move objects to another OU with this function.
Author: Jonathan Clelland
Modified: water
Related: _AD_MoveObject, _AD_DeleteObject
_AD_MoveObject
Description: Moves an object to another OU.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sOU does not exist
2 - $sObject does not exist
3 - Object already exists in the target OU
x - Error returned by MoveHere function (Missing permission etc.)
Parameters:
$sOU - Target OU for the object move (FQDN)
$sObject - Object (user, group, computer) to move (FQDN or sAMAccountName)
$sCN - Optional: New Name of the object in the target OU. Common Name or RDN (Relative Distinguished Name) like "Lastname Firstname" without leading "CN="
Remarks: You must escape commas in $sObject with a backslash. E.g. "CN=Lastname\, Firstname,OU=..."
If you want to move an OU you have to specify $sObject as FQDN. OUs do not have a SamAccountName
Author: water
Related: _AD_RenameObject, _AD_DeleteObject, _AD_DeleteSubTree
_AD_DeleteObject
Description: Deletes the specified object.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sObject does not exist
x - Error returned by Delete function (Missing permission etc.)
Parameters:
$sObject - Object (user, group, computer, OU etc.) to delete (FQDN or sAMAccountName)
$sClass - The schema class object to delete ("user", "computer", "group", "contact" etc). Can be derived using _AD_GetObjectClass().
Remarks: The function can only delete leaf objects. If you want to delete an object containing other objects you first have to delete the contained objects.
Author: Jonathan Clelland
Modified: water
Related: _AD_RenameObject, _AD_MoveObject, _AD_DeleteSubTree
_AD_DeleteSubtree
Description: Deletes the specified object including all child objects of this object.
Return Value:
Success - 1
Failure - The distinguishedName of the object raising the error, sets @error to:
1 - $sObject does not exist
2 - Error returned by DeleteObject method for an object (Missing permission etc.). @extended holds the COM error code.
3 - Error returned by DeleteObject method for an OU (Missing permission etc.). @extended holds the COM error code.
Parameters:
$sObject - Object (user, group, computer, OU etc.) to delete (FQDN or sAMAccountName)
$iFlag (Optional) - Specifies how to process child objects. Can be:
0 - Deletes $sObject, all child containers and all leaf objects (default)
1 - Only deletes leaf objects. $sObject and all child containers remain active. Means: The subtree will be cleared.
2 - Deletes child leaf and container objects. Means: The subtree will be deleted, only $sObject remains.
Remarks: Leaf: An object without child objects
Container: An object that can hold child objects (leafs or containers)
Author: water
Modified: The function only handles OUs as container objects at the moment.
Related: _AD_RenameObject, _AD_MoveObject, _AD_DeleteObject
_AD_SetAccountExpire
Description: Modifies the specified user or computer account expiration date/time or sets the account to never expire.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetInfo method (Missing permission etc.)
Parameters:
$sObject - User or computer account to set expiration date/time (sAMAccountName or FQDN)
$sDateTime - Expiration date/time in format: yyyy-mm-dd hh:mm:ss (local time) or "01/01/1970" to never expire
Remarks: Use the following syntax for the date/time:
01/01/1970 = never expire
yyyy-mm-dd hh:mm:ss= "international format" - always works
xx/xx/xx <time> = "localized format" - the format depends on the local date/time settings
;+
Microsoft:
The date when the account expires. This value represents the number of 100-nanosecond intervals since January 1, 1601 (UTC).
A value of 0 or 0x7FFFFFFFFFFFFFFF (9223372036854775807) indicates that the account never expires.
;+
Richard L. Mueller:
"In Active Directory Users and Computers you can specify the date when a user account expires on the "Account"
tab of the user properties dialog. This date is stored in the accountExpires attribute of the user object.
There is also a property method called AccountExpirationDate, exposed by the IADsUser interface, that can be
used to display and set this date. If you've ever compared accountExpires and AccountExpirationDate with the
date shown in ADUC, you may have wondered what's going on. It is common for the values to differ by a day,
sometimes even two days."
Author: KenE
Modified: water
_AD_DisablePasswordExpire
Description: Modifies specified users password to not expire.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sObject does not exist
x - Error returned by Put or SetInfo method (Missing permission etc.)
Parameters:
$sObject - User account to disable password expiration (sAMAccountName or FQDN)
Author: KenE
Modified: water
Related: _AD_IsPasswordExpired, _AD_GetPasswordExpired, _AD_GetPasswordDontExpire, _AD_SetPassword, _AD_EnablePasswordChange, _AD_DisablePasswordChange, _AD_GetPasswordInfo, _AD_EnablePasswordExpire
_AD_EnablePasswordExpire
Description: Sets users password to expire.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetInfo method (Missing permission etc.)
Parameters:
$sObject - User account to enable password expiration (sAMAccountName or FQDN)
Author: Joe2010
Modified: water
Related: _AD_IsPasswordExpired, _AD_GetPasswordExpired, _AD_GetPasswordDontExpire, _AD_SetPassword, _AD_EnablePasswordChange, _AD_DisablePasswordChange, _AD_GetPasswordInfo, _AD_DisablePasswordExpire
_AD_EnablePasswordChange
Description: Disables the 'User Cannot Change Password' option, allowing the user to change their password.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetInfo method (Missing permission etc.)
Parameters:
$sObject - User account to enable changing the password (sAMAccountName or FQDN)
Author: KenE
Modified: water
Related: _AD_IsPasswordExpired, _AD_GetPasswordExpired, _AD_GetPasswordDontExpire, _AD_SetPassword, _AD_DisablePasswordExpire, _AD_EnablePasswordExpire, _AD_DisablePasswordChange, _AD_GetPasswordInfo
_AD_DisablePasswordChange
Description: Enables the 'User Cannot Change Password' option, preventing the user from changing their password.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetInfo method (Missing permission etc.)
Parameters:
$sObject - User account to disallow changing his password (SAMAccountNmae or FQDN)
Author: KenE
Modified: water
Related: _AD_IsPasswordExpired, _AD_GetPasswordExpired, _AD_GetPasswordDontExpire, _AD_SetPassword, _AD_DisablePasswordExpire, _AD_EnablePasswordExpire, _AD_EnablePasswordChange, _AD_GetPasswordInfo
_AD_UnlockObject
Description: Unlocks an AD object (user account, computer account).
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetInfo method (Missing permission etc.)
Parameters:
$sObject - User account or computer account to unlock (sAMAccountName or FQDN)
Author: water
Related: _AD_IsObjectLocked, _AD_GetObjectsLocked
_AD_DisableObject
Description: Disables an AD object (user account, computer account).
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetInfo method (Missing permission etc.)
Parameters:
$sObject - User account or computer account to disable (sAMAccountName or FQDN)
Author: water
Related: _AD_IsObjectDisabled, _AD_EnableObject, _AD_GetObjectsDisabled
_AD_EnableObject
Description: Enables an AD object (user account, computer account).
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sObject does not exist
x - Error returned by SetInfo method (Missing permission etc.)
Parameters:
$sObject - User account or computer account to enable (sAMAccountName or FQDN)
Author: water
Related: _AD_IsObjectDisabled, _AD_DisableObject, _AD_GetObjectsDisabled
_AD_GetPasswordInfo
Description: Returns password information retrieved from the domain policy and the specified user or computer account.
Return Value:
Success - Returns a one-based array with the following information:
1 - Maximum Password Age (days)
2 - Minimum Password Age (days)
3 - Enforce Password History (# of passwords remembered)
4 - Minimum Password Length
5 - Account Lockout Duration (minutes). 0 means the account has to be unlocked manually by an administrator
6 - Account Lockout Threshold (invalid logon attempts)
7 - Reset account lockout counter after (minutes)
8 - Password last changed (YYYY/MM/DD HH:MM:SS in local time of the calling user) or "1601/01/01 00:00:00" (means "Password has never been set")
9 - Password expires (YYYY/MM/DD HH:MM:SS in local time of the calling user) or empty when password has not been set before or never expires
10 - Password last changed (YYYY/MM/DD HH:MM:SS in UTC) or "1601/01/01 00:00:00" (means "Password has never been set")
11 - Password expires (YYYY/MM/DD HH:MM:SS in UTC) or empty when password has not been set before or never expires
12 - Password properties. Part of Domain Policy. A bit field to indicate complexity / storage restrictions
1 - DOMAIN_PASSWORD_COMPLEX
2 - DOMAIN_PASSWORD_NO_ANON_CHANGE
4 - DOMAIN_PASSWORD_NO_CLEAR_CHANGE
8 - DOMAIN_LOCKOUT_ADMINS
16 - DOMAIN_PASSWORD_STORE_CLEARTEXT
32 - DOMAIN_REFUSE_PASSWORD_CHANGE
13 - Calculated password expiration date/time. Identical with element 9 of this array.
Returns a value even when fine grained password policy is in use; which means that most of the other elements of this array are blank or 0.
This is a Virtual Attribute (aka "Pseudo Attribute", "Constructed Attribute" or "Back-link") where the value is calculated by the LDAP Server Implementation and is not actually part of the LDAP Entry.
Failure - "", sets @error to:
1 - $sObject not found
2 - Function _AD_GetObjectProperties returned an error which is returned in @extended
Warning - Returns a one-based array (see Success), sets @extended to:
1 - Password does not expire (User Access Control - UAC - is set)
2 - Password has never been set
4 - The Maximum Password Age is set to 0 in the domain. Therefore, the password does not expire
8 - The version of the accessed DC (needs to be >= 2008) does not support property MSDS-UserPasswordExpiryTimeComputed. Element 13 of the returned array is set to element 9.
The @extended value can be a combination of the above values e.g. 3 = 1 (Password does not expire) + 2 (Password has never been set)
Parameters:
$sObject - Optional: User or computer account to get password info for (default = @UserName). Format is sAMAccountName or FQDN
Remarks: For details about password properties please check: msdn.microsoft.com/en-us/library/aa375371(v=vs.85).aspx
Author: water
Related: _AD_IsPasswordExpired, _AD_GetPasswordExpired, _AD_GetPasswordDontExpire, _AD_SetPassword, _AD_DisablePasswordExpire, _AD_EnablePasswordExpire, _AD_EnablePasswordChange, _AD_DisablePasswordChange
_AD_ListExchangeServers
Description: Enumerates all Exchange Servers in the Forest.
Return Value:
Success - Returns an one-based one dimensional array with the names of the Exchange Servers
Failure - "", sets @error to:
1 - No Exchange Servers found. @extended is set to the error returned by LDAP
Author: water
Related: _AD_ListExchangeMailboxStores
_AD_ListExchangeMailboxStores
Description: Enumerates all Exchange Mailbox Stores in the Forest.
Return Value:
Success - Returns a one-based two dimensional array with the following information:
0 - name
1 - cn
2 - distinguishedName
Failure - "", sets @error to:
1 - No Exchange Mailbox Stores found. @extended is set to the error returned by LDAP
Author: water
Related: _AD_ListExchangeServers
_AD_GetSystemInfo
Description: Retrieves data describing the local computer if it is a member of a (at least) Windows 2000 domain.
Return Value:
Success - Returns an one-based one dimensional array with the following information:
1 - distinguished name of the local computer
2 - DNS name of the local computer domain
3 - short name of the local computer domain
4 - DNS name of the local computer forest
5 - Local computer domain status: native mode (True) or mixed mode (False)
6 - distinguished name of the NTDS-DSA object for the DC that owns the primary domain controller role in the local computer domain
7 - distinguished name of the NTDS-DSA object for the DC that owns the schema role in the local computer forest
8 - site name of the local computer
9 - distinguished name of the current user
Failure - "", sets @error to:
1 - Creation of object "ADSystemInfo" returned an error. See @extended
Author: water
_AD_GetManagedBy
Description: Retrieves all groups that are managed by any or the specified user.
Return Value:
Success - Returns a one-based two dimensional array with the following information:
0 - distinguished name of the group
1 - distinguished name of the manager for this group
Failure - "", sets @error to:
1 - $sManagedBy is unknown
2 - No groups found. @extended is set to the error returned by LDAP
Parameters:
$sManagedBy - Optional: Manager to filter the list of groups (default = *). Can be a SAMAccountname or a FQDN
Remarks: This query returns all groups that have the attribute "managedBy" set or set to the specified manager.
;+
To get a list of all groups that manager x manages (by querying just the user object) use:
$Result = _AD_GetObjectAttribute("samAccountName of the manager","managedObjects")
_ArrayDisplay($Result)
;+
To return managers for OUs change "objectCategory=group" to "objectClass=organizationalUnit".
Author: water
_AD_GetManager
Description: Retrieves all users that are managed by any or the specified user.
Return Value:
Success - Returns a one-based two dimensional array with the following information:
0 - distinguished name of the user
1 - distinguished name of the manager for this user
Failure - "", sets @error to:
1 - $sManager is unknown
2 - No users found. @extended is set to the error returned by LDAP
Parameters:
$sManager - Optional: Manager to filter the list of users (default = *). Can be sAMAccountName or FQDN
Remarks: This query returns all users that have the attribute "Manager" set or set to the specified manager.
;+
To get a list of all users that manager x manages (by querying just the user object) use:
$Result = _AD_GetObjectAttribute("samAccountName of the manager","directReports")
_ArrayDisplay($Result)
Author: water
_AD_GetGroupAdmins
Description: Returns an array of the administrator sAMAccountNames for the specified group (not including the group owner/manager).
Return Value:
Success - Returns an one-based one dimensional array with the sAMAccountNames of the administrators for the specified group
+(not including the group owner/manager)
Failure - "", sets @error to:
1 - Group could not be found
2 - No administrators found
Parameters:
$sObject - group name. Can be SAMaccountName or FQDN
Author: John Clelland
Modified: water
_AD_GroupManagerCanModify
Description: Returns 1 if the manager of the group can modify the member list.
Return Value:
Success - 1, Specified user can modify the member list
Failure - 0, @error set
1 - Group does not exist
2 - The group manager can not modify the member list
3 - There is no manager assigned to the group
Parameters:
$sObject - FQDN of the group
Author: John Clelland
Modified: water
Related: _AD_GroupAssignManager, _AD_GroupRemoveManager, _AD_SetGroupManagerCanModify
_AD_ListPrintQueues
Description: Enumerates all PrintQueues in the AD tree, the specified spool server or OU.
Return Value:
Success - One-based two dimensional array with the following information:
0 - PrinterName: Short name of the PrintQueue
1 - ServerName: SpoolServerName.Domain
2 - DistinguishedName: FQDN of the PrintQueue
Failure - "", @error set
1 - There is no PrintQueue available. @extended is set to the error returned by LDAP
2 - Specified OU does not exist
Parameters:
$sServername - Optional: Short name of the spool server to process. LDAP wildcards apply (default = "*", equals "search all servers")
$sOU - Optional: The OU to retrieve from (FQDN) (default = "", equals "search the whole AD tree")
$iSearchScope - Optional: 0 = base, 1 = one-level, 2 = sub-tree (default)
$sPrintQueues - Optional: Short name of the printqueues to search for. LDAP wildcards apply (default = "*", equals "search all print queues")
Remarks: To get more (including multi-valued) attributes of a printqueue use _AD_GetObjectProperties
Author: water
_AD_SetGroupManagerCanModify
Description: Sets the Group manager to be able to modify the member list.
Return Value:
Success - 1
Failure - 0, @error set
1 - $sGroup does not exist
2 - Group manager can already modify the member list
3 - $sGroup has no manager assigned
x - Error returned by SetInfo method (Missing permission etc.)
Parameters:
$sGroup - Groupname (sAMAccountName or FQDN)
Author: Jonathan Clelland
Modified: water
Related: _AD_GroupAssignManager, _AD_GroupManagerCanModify, _AD_GroupRemoveManager
_AD_GroupAssignManager
Description: Assigns the user as group manager.
Return Value:
Success - 1
Failure - 0, @error set
1 - $sGroup does not exist
2 - $sUser does not exist
x - Error returned by SetInfo method (Missing permission etc.)
Parameters:
$sGroup - Groupname (sAMAccountName or FQDN)
$sUser - User to assign as manager (sAMAccountName or FQDN)
Author: Jonathan Clelland
Modified: water
Related: _AD_SetGroupManagerCanModify, _AD_GroupManagerCanModify, _AD_GroupRemoveManager
_AD_GroupRemoveManager
Description: Remove the group manager from a group or only remove the manager's modify permission.
Return Value:
Success - 1
Failure - 0, @error set
1 - $sGroup does not exist
2 - $sGroup does not have a manager assigned
Parameters:
$sGroup - Groupname (sAMAccountName or FQDN)
$bFlag - Optional: if True the function only removes the manager's modify permission
Author: Jonathan Clelland
Modified: water
Related: _AD_SetGroupManagerCanModify, _AD_GroupManagerCanModify, _AD_GroupAssignManager
_AD_AddEmailAddress
Description: Appends an SMTP email address to the 'Email Addresses' tab of an Exchange-enabled AD account.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - $sUser does not exist
2 - Could not connect to $sUser. @extended is set to the error returned by LDAP
x - Error returned by GetEx or SetInfo method (Missing permission etc.)
Parameters:
$sUser - User account (sAMAccountName or FQDN)
$sNewEmail - Email address to add to the account
$bPrimary - Optional: if True the new email address will be set as primary address
Author: Jonathan Clelland
Related: _AD_ModifyAttribute
_AD_JoinDomain
Description: Joins a computer to a domain.
Return Value:
Success - 1, sets @extended to the return value of the JoinDomainOrWorkgroup method:
0 - indicates successful completion. No reboot required.
1 - indicates successful completion with reboot required.
Failure - 0, @error set
1 - $sComputer account does not exist in the domain and $iFlag <> 2
2 - $sUserParam does not exist in the domain
3 - WMI object could not be created. See @extended for error code. See remarks for further information
4 - The computer is already a member of the domain
5 - Joining the domain was not successful. @extended holds the Win32 error code (see: msdn.microsoft.com/en-us/library/ms681381(v=VS.85).aspx)
6 - $sNewName account already exists. You can't rename $sComputer to $sNewName
7 - Computer could not be renamed. See @extended for the COM error code.
Parameters:
$sComputer - Optional: Name of the computer to be joined to the domain (Default = @ComputerName)
$sUserParam - Optional: Domain user with admin rights to join the computer to the domain.
+Supported are NetBIOSName (domain\user), user principal name (user@domain) or Windows login name (user).
+(Default = credentials from _AD_Open or - if not used - of the user running the script)
$sPasswordParam - Optional: Password for $sUserParam (Default = credentials from _AD_Open or - if not used - of the user running the script)
$sOU - Optiona: FQDN of the OU where the computer will be placed. (Default = Keyword Default = Computers container)
$iFlag - Optional: A set of bit flags (means: add the numbers for any valid combination) that specify options for joining a domain. Some of the possible flags:
+1 - Joins a computer to a domain. Computer account must already exist in the domain (Default)
+2 - Creates an account on a domain
+32 - Allows a join to a new domain even if the computer is already joined to a domain
$sNewname - Optional: Name to change the computer to after joining to the domain.
Remarks: This function allows to join the computer the script is running on or any other computer to be joined to a domain.
The domain the computer is joined to is the domain the user logged on to by using AD_Open.
If no credentials are passed to this function but have been used with _AD_Open() then the _AD_Open credentials will be used.
Using default credentials of the user running the script is only sensible when you are logged on to the domain and try to join another computer.
You have to make sure to use a valid $iFlag. The function does not check it. Most used are 1 (join) and 3 (create computer account and join).
You have to reboot the computer after a successful join to the domain.
The JoinDomainOrWorkgroup method is available only on Windows XP computer and Windows Server 2003 or later.
Author: water
Related: _AD_CreateComputer
_AD_UnJoinDomain
Description: Unjoins the computer from its current domain and disables the computer account.
Return Value:
Success - 1
Failure - 0, @error set
1 - $sComputer account does not exist in the domain
2 - $sUserParam does not exist in the domain
3 - WMI object could not be created. See @extended for the COM error code. See remarks for further information
4 - The computer is a member of another or no domain
5 - Unjoining the domain was not successful. See @extended for the COM error code. See remarks for further information
6 - Joining the Computer to the specified workgroup was not successful. See @extended for the COM error code
Parameters:
$sComputer - Optional: Computername to unjoin from the domain (Default = @ComputerName)
$sWorkgroup - Optional: Workgroup the unjoined computer is assigned to (Default = Workgroup named like the domain the computer was unjoined from)
$sUserParam - Optional: Domain user with admin rights to unjoin the computer from the domain.
+Supported are NetBIOSName (domain\user), user principal name (user@domain) or Windows login name (user).
+(Default = credentials from _AD_Open or - if not used - of the user running the script)
$sPasswordParam - Optional: Password for $sUserParam (Default = credentials from _AD_Open or - if not used - of the user running the script)
Remarks: This function allows to unjoin the computer the script is running on or any other computer from a domain.
The domain the computer is unjoined from is the domain the user logged on to by using AD_Open.
If no credentials are passed to this function but have been used with _AD_Open() then the _AD_Open credentials will be used.
If no workgroup is specified then the computer is assigned to a workgroup named like the domain the computer was unjoined from.
You have to reboot the computer after a successful unjoin from the domain.
The JoinDomainOrWorkgroup method is available only on Windows XP computer and Windows Server 2003 or later.
Author: water
_AD_IsAccountExpired
Description: Returns 1 if the account (user, computer) has expired.
Return Value:
Success - 1, The specified account has expired
Failure - 0, sets @error to:
0 - Account has not expired
1 - $sObject could not be found
2 - An error occurred when accessing property AccountExpirationDate. @extended is set to the error returned by LDAP
Parameters:
$sObject - Optional: Account (User, computer) to check (default = @Username). Can be specified as Fully Qualified Domain Name (FQDN) or sAMAccountName
Author: water
Related: _AD_GetAccountsExpired, _AD_SetAccountExpire
_AD_GetAccountsExpired
Description: Returns an array with FQDNs of expired accounts (user, computer).
Return Value:
Success - One-based two dimensional array of FQDNs of expired accounts
0 - FQDNs of expired accounts
1 - account expired YYYY/MM/DD HH:NMM:SS UTC
2 - account expired YYYY/MM/DD HH:NMM:SS local time of calling user
Failure - "", sets @error to:
1 - No expired accounts found. @extended is set to the error returned by LDAP
2 - Specified date/time is invalid
3 - Invalid value for $sClass. Has to be "user" or "computer"
4 - Specified $sRoot does not exist
Parameters:
$sClass - Optional: Specifies if expired user accounts or computer accounts should be returned (default = "user").
"user" - Returns objects of category "user"
"computer" - Returns objects of category "computer"
$sDTEExpire - YYYY/MM/DD HH:MM:SS (local time) returns all accounts that expire between $sDTSExpire and the specified date/time (default = "" = Now)
$sDTSExpire - YYYY/MM/DD HH:MM:SS (local time) returns all accounts that expire between the specified date/time and $sDTEExpire (default = "1601/01/01 00:00:00)
$sRoot - Optional: FQDN of the OU where the search should start (default = "" = search the whole tree)
Author: water
Related: _AD_IsAccountExpired, _AD_SetAccountExpire
_AD_ListSchemaVersions
Description: Returns information about the AD Schema versions.
Return Value:
Success - Returns an one-based one dimensional array of the following Schema versions.
1 - Active Directory Schema version. This can be one of the following values:
13 - Windows 2000 Server
30 - Windows Server 2003 RTM / Service Pack 1 / Service Pack 2
31 - Windows Server 2003 R2
44 - Windows Server 2008 RTM
47 - Windows Server 2008 R2
2 - Exchange Schema version. This can be one of the following values:
4397 - Exchange Server 2000 RTM
4406 - Exchange Server 2000 With Service Pack 3
6870 - Exchange Server 2003 RTM
6936 - Exchange Server 2003 With Service Pack 3
10628 - Exchange Server 2007
11116 - Exchange 2007 With Service Pack 1
14622 - Exchange 2007 With Service Pack 2, Exchange 2010 RTM
14625 - Exchange 2007 SP3
14720 - Exchange 2010 SP1 (beta)
14726 - Exchange 2010 SP1
3 - Exchange 2000 Active Directory Connector version. This can be one of the following values:
4197 - Exchange Server 2000 RTM
4 - Office Communications Server Schema version. This can be one of the following values:
1006 - LCS 2005 SP1
1007 - OCS 2007
1008 - OCS 2007 R2
1100 - Lync Server 2010
Parameters:
None
Remarks: RTM stands for "Release to Manufacturing"
Author: water
_AD_ObjectExistsInSchema
Description: Returns 1 if exactly one object exists for the given property in the Active Directory Schema.
Return Value:
Success - 1, Exactly one object exists for the given property in the Active Directory Schema
Failure - 0, sets @error to:
1 - No object found for the specified property
x - More than one object found for the specified property. x is the number of objects found
Parameters:
$sObject - Optional: Object to check
$sProperty - Optional: Property to check (default = LDAPDisplayName)
Author: water
_AD_FixSpecialChars
Description: Escapes or unescapes special characters in Distinguished Names or LDAP filters.
Return Value:
$sText with escaped or unescaped special characters
Parameters:
$sText - Text to add / remove escape characters
$iOption - Optional: Defines whether to escape (Default) or unescape special characters for DN or LDAP filters.
0 = Escape special characters in a Distinguished Name (default)
1 = Unescape special characters in a Distinguished Name
3 = Escape special characters in a LDAP filter
$sEscapeChar - Optional: List of characters to escape or unescape in a DN (default = '"\/#,+<>;=')
Remarks: Leading or trailing spaces have to be escaped by the user.
$sEscapeChar is ignored when $iOption = 3.
Author: Jonathan Clelland
Modified: water
_AD_GetLastADSIError
Description: Retrieve the calling thread's last ADSI error code value.
Return Value:
Success - A one-based array containing the following values:
1 - ADSI error code (decimal)
2 - Unicode string that describes the error
3 - name of the provider that raised the error
4 - Win32 error code extracted from element[2]
5 - description of the Win32 error code as returned by _WinAPI_FormatMessage
Failure - "", sets @error to the return value of DLLCall
Parameters:
None
Remarks: This and more errors will be handled (error codes are in hex):
525 - user not found
52e - invalid credentials
530 - not permitted to logon at this time
532 - password expired
533 - account disabled
701 - account expired
773 - user must reset password
Author: water, card0384
_AD_GetADOProperties
Description: Retrieves all properties of an ADO object (Connection, Command).
Return Value:
Success - Returns a one based two-dimensional array with all properties and their values of the specified object
Failure - "", sets @error to:
1 - $sADOObject is invalid. Should either be "Command" or "Connection"
Parameters:
$sADOobject - ADO object for which to retrieve the properties. Can be either "Connection" or "Command"
$sProperties - Optional: Comma separated list of properties to return (default = "" = return all properties)
Author: water
_AD_SetADOProperties
Description: Sets properties of an ADO command object.
Return Value:
Success - 1
Failure - 0, sets @error to:
1 - Invalid format of the parameter. Has to be propertyname=value. @extended = number of the invalid parameter (zero based)
x - Error setting the specified property. @extended = number of the invalid parameter (zero based)
Parameters:
$sP1 - Property to set. This can be a string with the format propertyname=value OR
+a zero based one-dimensional array with unlimited number of strings in the format propertyname=value
$sP2 - Optional: Same as $sP1 but no array is allowed
$sP3 - Optional: Same as $sP2
$sP4 - Optional: Same as $sP2
$sP5 - Optional: Same as $sP2
$sP6 - Optional: Same as $sP2
$sP7 - Optional: Same as $sP2
$sP8 - Optional: Same as $sP2
$sP9 - Optional: Same as $sP2
$sP10 - Optional: Same as $sP2
Remarks: You can query the properties of the ADO connection and command object but you can only set the properties of the command object.
+After the connection is opened by _AD_Open the properties of the connection object are read only.
Author: water
_AD_VersionInfo
Description: Returns an array of information about the AD.au3 UDF.
Return Value:
Success - one-dimensional one based array with the following information:
1 - Release Type (T=Test or V=Production)
2 - Major Version
3 - Minor Version
4 - Sub Version
5 - Release Date (YYYYMMDD)
6 - AutoIt version required
7 - List of authors separated by ","
8 - List of contributors separated by ","
Parameters:
None
Remarks: Based on function _IE_VersionInfo written bei Dale Hohm
Author: water