Appends a new route to the Dial-In properties of a user account in Active Directory. This operation adds the new route without deleting any existing routes.
Appends new entries to the postOfficeBox attribute of an Active Directory user account. This operation adds the new post office boxes without deleting any existing entries.
Appends a new phone number to the otherHomePhone attribute of an Active Directory user account. This operation adds the phone number to the attribute without deleting ant existing phone numbers.
Copies a published certificate from a template account (userTemplate) and assigns it to the MyerKen Active Directory user account. This operation replaces any existing published certificates for the MyerKen account.
On Error Resume Next
Const ADS_PROPERTY_UPDATE = 2
Set objUserTemplate = _
GetObject("LDAP://cn=userTemplate,OU=Management,dc=NA,dc=fabrikam,dc=com")
arrUserCertificates = objUserTemplate.GetEx("userCertificate")
Set objUser = _
GetObject("LDAP://cn=MyerKen,OU=Management,dc=NA,dc=fabrikam,dc=com")
objUser.PutEx ADS_PROPERTY_UPDATE, "userCertificate", arrUserCertificates
objUser.SetInfo
Removes all information from the deparment, directReports, and manager attributes of the MyerKen Active Directory user account.
On Error Resume Next
Const E_ADS_PROPERTY_NOT_FOUND = &h8000500D
Const ADS_PROPERTY_CLEAR = 1
Set objUser = GetObject _
("LDAP://cn=MyerKen,ou=Management,dc=NA,dc=fabrikam,dc=com")
objUser.PutEx ADS_PROPERTY_CLEAR, "department", 0
objUser.SetInfo
arrDirectReports = objUser.GetEx("directReports")
If err.number = E_ADS_PROPERTY_NOT_FOUND Then
WScript.Quit
Else
For Each strValue in arrDirectReports
Set objUserSource = GetObject("LDAP://" & strValue)
objUserSource.PutEx ADS_PROPERTY_CLEAR, "manager", 0
objUserSource.SetInfo
Next
End If
Configures organization information for the MyerKen Active Directory user account. The script also assigns MyerKen as the manager for LewJudy and AkersKim.
Copies a published certificate from a template account (userTemplate) to the MyerKen Active Directory user account. This operation appends the new certificate without deleting any existing certificates.
On Error Resume Next
Const ADS_PROPERTY_APPEND = 3
Set objUserTemplate = _
GetObject("LDAP://cn=userTemplate,OU=Management,dc=NA,dc=fabrikam,dc=com")
arrUserCertificates = objUserTemplate.GetEx("userCertificate")
Set objUser = _
GetObject("LDAP://cn=MyerKen,OU=Management,dc=NA,dc=fabrikam,dc=com")
objUser.PutEx ADS_PROPERTY_APPEND, "userCertificate", arrUserCertificates
objUser.SetInfo
Configures the upnSuffixes attribute of the Partitions container and displays the new values to the operator.
Const ADS_PROPERTY_APPEND = 3
Set objPartitions = GetObject _
("LDAP://cn=Partitions,cn=Configuration,dc=fabrikam,dc=com")
objPartitions.PutEx ADS_PROPERTY_APPEND, _
"upnSuffixes", Array("sa.fabrikam.com","corp.fabrikam.com")
objPartitions.SetInfo
For Each Suffix in objPartitions.GetEx("upnSuffixes")
WScript.Echo Suffix
Next
Copies the allowed logon hours from a template account (userTemplate) and assigns them to the MyerKen Active Directory user account. The MyerKen account will thus have the same logon hour restrictions as those assigned to the userTemplate account.
On Error Resume Next
Set objUserTemplate = _
GetObject("LDAP://cn=userTemplate,OU=Management,dc=NA,dc=fabrikam,dc=com")
arrLogonHours = objUserTemplate.Get("logonHours")
Set objUser = _
GetObject("LDAP://cn=MyerKen,OU=Management,dc=NA,dc=fabrikam,dc=com")
objUser.Put "logonHours", arrLogonHours
objUser.SetInfo
Demonstration script that creates 1,000 user accounts (named UserNo1, UserNo2, UserNo3, etc.) in the Users container in Active Directory. The script is useful for test scenarios that require multiple user accounts.
Set objRootDSE = GetObject("LDAP://rootDSE")
Set objContainer = GetObject("LDAP://cn=Users," & _
objRootDSE.Get("defaultNamingContext"))
For i = 1 To 1000
Set objLeaf = objContainer.Create("User", "cn=UserNo" & i)
objLeaf.Put "sAMAccountName", "UserNo" & i
objLeaf.SetInfo
Next
WScript.Echo "1000 Users created."
Demonstration script that: 1) creates a new Active Directory organizational unit; 2) creates a new user account and new security group; and, 3) adds the new user as a member of that security group.
Set objDomain = GetObject("LDAP://dc=fabrikam,dc=com")
Set objOU = objDomain.Create("organizationalUnit", "ou=Management")
objOU.SetInfo
Set objOU = GetObject("LDAP://OU=Management,dc=fabrikam,dc=com")
Set objUser = objOU.Create("User", "cn= AckermanPilar")
objUser.Put "sAMAccountName", "AckermanPila"
objUser.SetInfo
Set objOU = GetObject("LDAP://OU=Management,dc=fabrikam,dc=com")
Set objGroup = objOU.Create("Group", "cn=atl-users")
objGroup.Put "sAMAccountName", "atl-users"
objGroup.SetInfo
objGroup.Add objUser.ADSPath
Removes a specific calling station ID from the MyerKen Active Directory user account. This operation only removes the specified calling station ID; no other IDs are deleted.
Deletes a phone number from the otherMobile attribute of the MyerKen Active Directory user account. This operation removes only one phone number (425-555-0113) without affecting any other phone numbers.
Removes a specified value (2224) from the postOfficeBox attribute of the MyerKen Active Directory user account. This operation removes only the specified post office box; other entries will not be deleted.
Retrieves a set of published certificates from a template account (userTemplate), and then deletes each of those certificates from the MyerKen Active Directory user account.
On Error Resume Next
Const ADS_PROPERTY_DELETE = 4
Set objUserTemplate = _
GetObject("LDAP://cn=userTemplate,OU=Management,dc=NA,dc=fabrikam,dc=com")
arrUserCertificates = objUserTemplate.GetEx("userCertificate")
Set objUser = _
GetObject("LDAP://cn=MyerKen,OU=Management,dc=NA,dc=fabrikam,dc=com")
objUser.PutEx ADS_PROPERTY_DELETE, "userCertificate", arrUserCertificates
objUser.SetInfo
Deletes selected attributes from a user account. Demonstrates how to delete single-valued attributes as well as how to delete a single entry from a multi-valued attribute.
On Error Resume Next
Set objUser = GetObject _
("LDAP://cn=myerken,ou=management,dc=fabrikam,dc=com")
dtmAccountExpiration = objUser.AccountExpirationDate
If err.number = -2147467259 Or _
dtmAccountExpiration = "1/1/1970" Then
WScript.echo "No account expiration specified"
Else
WScript.echo "Account expiration:" & _
objUser.AccountExpirationDate
End If
Determines the date when a user password will expire.
Const SEC_IN_DAY = 86400
Const ADS_UF_DONT_EXPIRE_PASSWD = &h10000
Set objUserLDAP = GetObject _
("LDAP://CN=myerken,OU=management,DC=fabrikam,DC=com")
intCurrentValue = objUserLDAP.Get("userAccountControl")
If intCurrentValue and ADS_UF_DONT_EXPIRE_PASSWD Then
wscript.echo "The password does not expire."
Else
dtmValue = objUserLDAP.PasswordLastChanged
Wscript.echo "The password was last changed on " & _
DateValue(dtmValue) & " at " & TimeValue(dtmValue) & VbCrLf & _
"The difference between when the password was last set" & VbCrLf & _
"and today is " & int(now - dtmValue) & " days"
intTimeInterval = int(now - dtmValue)
Set objDomainNT = GetObject("WinNT://fabrikam")
intMaxPwdAge = objDomainNT.Get("MaxPasswordAge")
If intMaxPwdAge < 0 Then
WScript.Echo "The Maximum Password Age is set to 0 in the " & _
"domain. Therefore, the password does not expire."
Else
intMaxPwdAge = (intMaxPwdAge/SEC_IN_DAY)
Wscript.echo "The maximum password age is " & intMaxPwdAge & " days"
If intTimeInterval >= intMaxPwdAge Then
Wscript.echo "The password has expired."
Else
Wscript.echo "The password will expire on " & _
DateValue(dtmValue + intMaxPwdAge) & " (" & _
int((dtmValue + intMaxPwdAge) - now) & " days from today" & ")."
End If
End If
End If
Identifies whether a user account is enabled or disabled.
Set objUser = GetObject _
("LDAP://cn=myerken,ou=management,dc=fabrikam,dc=com")
If objUser.AccountDisabled = FALSE Then
WScript.Echo "The account is enabled."
Else
WScript.Echo "The account is disabled."
End If
Reports the date that the MyerKen Active Directory user account expires.
On Error Resume Next
Set objUser = GetObject _
("LDAP://cn=MyerKen,ou=Management,dc=NA,dc=fabrikam,dc=com")
dtmAccountExpiration = objUser.AccountExpirationDate
If Err.Number = -2147467259 Or dtmAccountExpiration = "1/1/1970" Then
WScript.Echo "No account expiration specified"
Else
WScript.Echo "Account expiration: " & objUser.AccountExpirationDate
End If
Dim arrLogonHoursBytes(20)
Dim arrLogonHoursBits(167)
arrDayOfWeek = Array _
("Sun", "Mon", "Tue", "Wed", _
"Thu", "Fri", "Sat")
Set objUser = GetObject _
("LDAP://cn=myerken,ou=management,dc=fabrikam,dc=com")
objUser.GetInfoEx Array("logonHours"), 0
arrLogonHours = objUser.Get("logonHours")
For i = 1 To LenB(arrLogonHours)
arrLogonHoursBytes(i-1) = AscB(MidB(arrLogonHours, i, 1))
Next
intCounter = 0
intLoopCounter = 0
WScript.Echo "Day Byte 1 Byte 2 Byte 3"
For Each LogonHourByte In arrLogonHoursBytes
arrLogonHourBits = GetLogonHourBits(LogonHourByte)
If intCounter = 0 Then
WScript.STDOUT.Write arrDayOfWeek(intLoopCounter) & Space(2)
intLoopCounter = intLoopCounter + 1
End If
For Each LogonHourBit In arrLogonHourBits
WScript.STDOUT.Write LogonHourBit
intCounter = 1 + intCounter
If intCounter = 8 or intCounter = 16 Then
WScript.STDOUT.Write Space(1)
End If
If intCounter = 24 Then
WScript.echo VbCr
intCounter = 0
End If
Next
Next
Function GetLogonHourBits(x)
Dim arrBits(7)
For i = 7 to 0 Step -1
If x And 2^i Then
arrBits(i) = 1
Else
arrBits(i) = 0
End If
Next
GetLogonHourBits = arrBits
End Function
Disables the option allowing a password to be stored using reversible encrypted text.
Const ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED = &H80
Set objUser = GetObject _
("LDAP://cn=myerken,ou=management,dc=fabrikam,dc=com")
intUAC = objUser.Get("userAccountControl")
If intUAC AND _
ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED Then
objUser.Put "userAccountControl", intUAC XOR _
ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED
objUser.SetInfo
End If
Disables the setting that required MyerKen to use a smartcard when logging on to Active Directory.
Const ADS_UF_SMARTCARD_REQUIRED = &h40000
Set objUser = GetObject _
("LDAP://cn=MyerKen,ou=Management,dc=NA,dc=fabrikam,dc=com")
intUAC = objUser.Get("userAccountControl")
If (intUAC AND ADS_UF_SMARTCARD_REQUIRED) <> 0 Then
objUser.Put "userAccountControl", intUAC XOR ADS_UF_SMARTCARD_REQUIRED
objUser.SetInfo
End If
Disables the User Cannot Change Password option, allowing the user to change their password.
Const ADS_ACETYPE_ACCESS_DENIED_OBJECT = &H6
Const CHANGE_PASSWORD_GUID = _
"{ab721a53-1e2f-11d0-9819-00aa0040529b}"
Set objUser = GetObject _
("LDAP://cn=myerken,ou=management,dc=fabrikam,dc=com")
Set objSD = objUser.Get("nTSecurityDescriptor")
Set objDACL = objSD.DiscretionaryAcl
arrTrustees = Array("nt authority\self", "everyone")
For Each strTrustee In arrTrustees
For Each ace In objDACL
If(LCase(ace.Trustee) = strTrustee) Then
If((ace.AceType = ADS_ACETYPE_ACCESS_DENIED_OBJECT) And _
(LCase(ace.ObjectType) = CHANGE_PASSWORD_GUID)) Then
objDACL.RemoveAce ace
End If
End If
Next
Next
objUser.Put "nTSecurityDescriptor", objSD
objUser.SetInfo
Returns the allowed logon hours for the MyerKen Active Directory user account.
On Error Resume Next
Dim arrLogonHoursBytes(20)
Dim arrLogonHoursBits(167)
arrDayOfWeek = Array _
("Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat")
Set objUser = GetObject _
("LDAP://cn=MyerKen,ou=Management,dc=NA,dc=fabrikam,dc=com")
arrLogonHours = objUser.Get("logonHours")
For i = 1 To LenB(arrLogonHours)
arrLogonHoursBytes(i-1) = AscB(MidB(arrLogonHours, i, 1))
WScript.Echo "MidB returns: " & MidB(arrLogonHours, i, 1)
WScript.Echo "arrLogonHoursBytes: " & arrLogonHoursBytes(i-1)
wscript.echo vbcrlf
Next
intCounter = 0
intLoopCounter = 0
WScript.echo "Day Byte 1 Byte 2 Byte 3"
For Each LogonHourByte In arrLogonHoursBytes
arrLogonHourBits = GetLogonHourBits(LogonHourByte)
If intCounter = 0 Then
WScript.STDOUT.Write arrDayOfWeek(intLoopCounter) & Space(2)
intLoopCounter = intLoopCounter + 1
End If
For Each LogonHourBit In arrLogonHourBits
WScript.STDOUT.Write LogonHourBit
intCounter = 1 + intCounter
If intCounter = 8 or intCounter = 16 Then
Wscript.STDOUT.Write Space(1)
End If
If intCounter = 24 Then
WScript.echo vbCr
intCounter = 0
End If
Next
Next
Function GetLogonHourBits(x)
Dim arrBits(7)
For i = 7 to 0 Step -1
If x And 2^i Then
arrBits(i) = 1
Else
arrBits(i) = 0
End If
Next
GetLogonHourBits = arrBits
End Function
Set objHash = CreateObject("Scripting.Dictionary")
objHash.Add "DOMAIN_PASSWORD_COMPLEX", &h1
objHash.Add "DOMAIN_PASSWORD_NO_ANON_CHANGE", &h2
objHash.Add "DOMAIN_PASSWORD_NO_CLEAR_CHANGE", &h4
objHash.Add "DOMAIN_LOCKOUT_ADMINS", &h8
objHash.Add "DOMAIN_PASSWORD_STORE_CLEARTEXT", &h16
objHash.Add "DOMAIN_REFUSE_PASSWORD_CHANGE", &h32
Set objDomain = GetObject("LDAP://dc=fabrikam,dc=com")
intPwdProperties = objDomain.Get("PwdProperties")
WScript.Echo "pwdProperties = " & intPwdProperties
For Each Key In objHash.Keys
If objHash(Key) And intPwdProperties Then
WScript.Echo Key & " is enabled"
Else
WScript.Echo Key & " is disabled"
End If
Next
Displays password-related attributes for an individual user account.
Const ADS_UF_PASSWORD_EXPIRED = &h800000
Const ADS_ACETYPE_ACCESS_DENIED_OBJECT = &H6
Const CHANGE_PASSWORD_GUID = "{ab721a53-1e2f-11d0-9819-00aa0040529b}"
Set objHash = CreateObject("Scripting.Dictionary")
objHash.Add "ADS_UF_PASSWD_NOTREQD", &h00020
objHash.Add "ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED", &h0080
objHash.Add "ADS_UF_DONT_EXPIRE_PASSWD", &h10000
Set objUser = GetObject _
("LDAP://CN=MyerKen,OU=management,DC=Fabrikam,DC=com")
intUserAccountControl = objUser.Get("userAccountControl")
Set objUserNT = GetObject("WinNT://fabrikam/myerken")
intUserFlags = objUserNT.Get("userFlags")
If ADS_UF_PASSWORD_EXPIRED And intUserFlags Then
blnExpiredFlag = True
Wscript.Echo "ADS_UF_PASSWORD_EXPIRED is enabled"
Else
Wscript.Echo "ADS_UF_PASSWORD_EXPIRED is disabled"
End If
For Each Key In objHash.Keys
If objHash(Key) And intUserAccountControl Then
WScript.Echo Key & " is enabled"
Else
WScript.Echo Key & " is disabled"
End If
Next
Set objSD = objUser.Get("nTSecurityDescriptor")
Set objDACL = objSD.DiscretionaryAcl
For Each Ace In objDACL
If ((Ace.AceType = ADS_ACETYPE_ACCESS_DENIED_OBJECT) And _
(LCase(Ace.ObjectType) = CHANGE_PASSWORD_GUID)) Then
blnACEPresent = True
End If
Next
If blnACEPresent Then
Wscript.Echo "ADS_UF_PASSWD_CANT_CHANGE is enabled"
Else
Wscript.Echo "ADS_UF_PASSWD_CANT_CHANGE is disabled"
End If
If blnExpiredFlag = True Then
Wscript.echo "pwdLastSet is null"
Else
Wscript.echo "pwdLastSet is " & objUser.PasswordLastChanged
End If
Uses the MoveHere method of IADsContainer to move a user account to another domain. Note that there are a number of restrictions associated with performing this type of move operation. For details, see the Directory Services Platform SDK.
Set objOU = GetObject("LDAP://ou=management,dc=na,dc=fabrikam,dc=com")
objOU.MoveHere _
"LDAP://cn=AckermanPilar,OU=management,dc=fabrikam,dc=com", vbNullString
Configures the MyerKen user account so that the user must use a smartcard in order to logon to Active Directory.
Const ADS_UF_SMARTCARD_REQUIRED = &h40000
Set objUser = GetObject _
("LDAP://cn=MyerKen,ou=Management,dc=NA,dc=fabrikam,dc=com")
intUAC = objUser.Get("userAccountControl")
If (intUAC AND ADS_UF_SMARTCARD_REQUIRED) = 0 Then
objUser.Put "userAccountControl", intUAC XOR ADS_UF_SMARTCARD_REQUIRED
objUser.SetInfo
End If
Configures the domain password for a user account to ensure that the password will never expire.
Const ADS_UF_DONT_EXPIRE_PASSWD = &h10000
Set objUser = GetObject _
("LDAP://cn=myerken,ou=management,dc=fabrikam,dc=com")
intUAC = objUser.Get("userAccountControl")
If ADS_UF_DONT_EXPIRE_PASSWD AND intUAC Then
Wscript.Echo "Already enabled"
Else
objUser.Put "userAccountControl", intUAC XOR _
ADS_UF_DONT_EXPIRE_PASSWD
objUser.SetInfo
WScript.Echo "Password never expires is now enabled"
End If
ActiveXperts Network Monitor - Home page