Example Reading ADSI Attributes

Forums

My Profile

Inbox

Address Book

My Subscription

My Forums

Example Reading ADSI Attributes

Logged in as: Guest

arrSession:exec spGetSession 2,16,55477

	Active Users: There are 0 members and 0 guests.
	Users viewing this topic: none

Printable Version

All Forums >> [Scripting] >> Post a VBScript >> Example Reading ADSI Attributes
Do you like VisualBasicScript.com? Link to us and help spread the word about our forum. Thanks!

Page: [1]

Message

<< Older Topic Newer Topic >>

Example Reading ADSI Attributes - 1/15/2008 6:37:53 PM

aresu

Posts: 1
Score: 0
Joined: 1/15/2008
Status: offline

Windows Active Directory Dormant ID Review

Hi All,

I just want to share it with you, some of you maybe as security administrator know and have the same experience that we should do dormant id review every month to maintenance our system and to ensure that our system is clean from dormant ID as recommended by IT auditor.

Usually, I have generated the report using DumpSec to produce windows ID report (truelastlogon) and review it whether any user id that never login below to 90 days (base on company policy) or over 90 days.

How can we easily review if we have thousand user id and several companies separately by organization unit (OU)?
For this reason, I have made clone DumpSec function (Dump Users as Table) using visual basic script (VBS) to access Windows Active Directory (ADSI) and exported to text file delimited format with tab.

The Advantage:

With this script you can generate user list base on OU that you have specified
If you have limited network connection between primary domain controller and backup domain controller and also you have many backup domain controller, this script will be generate report faster than DumpSec because the script will be collect information from specific domain controller name as your specified on the configuration header within the script.

How to using this script?
Please read the header script for more information.
But if you still have problem, please write down your comment in this post.

Thanks,
AresU

' Dormant-ID-Review.vbs
' ----------------------------------------------------------------------
' Copyright (c) 2007, [link=http://aresu.blogspot.com]http://aresu.blogspot.com[/link]
' Created by: AresU (5/14/2007 9:26AM)
' Last update:
' 10/8/2007 11:25AM : Add compare lastlogontime between DC
' 5/16/2007 2:07PM : First initial version
'
' Syntax: cscript //nologo dormant-id-review.vbs > result.txt
' Function: 
' - This script will generate userid id list similar with dumpsec report ([link=http://www.systemtools.com]http://www.systemtools.com[/link])
' - The output result (tab format) can be open with Microsoft Excel
' Parameter can be change, below are: arrstrDCs, strDNSDomain, PolExpirePwd
' ----------------------------------------------------------------------
' This script modified from: lastlogon.vbs
' created by: Richard L. Mueller
' Hilltop Lab web site - [link=http://www.rlmueller.net]http://www.rlmueller.net[/link]
' ----------------------------------------------------------------------
Option Explicit
'Column Header Fields
Dim UserName,FullName,Comment,Comments,HomeDrive,HomeDir,Profile,LogonScript,PswdCanBeChanged,PswdLastSetTime,PswdRequired,PswdExpires,PswdExpiresTime,AcctDisabled,AcctLockedOut,AcctExpiresTime,LastLogonTime,LastLogonServer
'Variable declaration
Dim adoConnection, adoCommand, strQuery
Dim adoRecordset, objDC, objDate
Dim strDNSDomain, objShell, lngBiasKey, lngBias, k, arrstrDCs
Dim lngDate, strUser, userAccountControl
Dim strBase, strFilter, strAttributes, lngHigh, lngLow
Const UF_DISABLED=2,LOCKOUT=16,PASSWD_NOTREQD=32,PASSWD_CANT_CHANGE=64,DONT_EXPIRE_PASSWORD=65536,PASSWORD_EXPIRED=8388608
Const ForReading = 1, ForWriting = 2, ForAppending = 8
Dim FSO, FHandle, FHandle2,aLogs,buffHeader
Dim WshShell,oArgs,oShell,buffOut,tmparrstrDCs,narrstrDCs,strarrstrDCs
Dim Row,Col,x,y,UserID,tmpLastLogonTime,aTmp1,aTmp2,aTmp3,ResultLogs
'**** Please set this variables according to your local domain server ****
arrstrDCs="domaincontroller-servername1|domaincontroller-servername2"
strDNSDomain = "OU=Users and Groups,DC=your-subdomain,DC=your-topdomain"
Const PolExpirePwd=90 'Expire password policy on DC
Const HowManyRows=10000 'how many rows will be return? depend on your user accounts
'**** DO NOT CHANGES THIS SCRIPT BELOW *****
strAttributes = "sAMAccountName,displayName,description,homeDrive,homeDirectory,profilePath,scriptPath,userAccountControl,pwdLastSet,accountExpires,lastLogon"
aLogs=Split(arrstrDCs,"|")
                                                                    
' Obtain local Time Zone bias from machine registry.                     
Set objShell = CreateObject("Wscript.Shell")                             
lngBiasKey = objShell.RegRead("HKLM\System\CurrentControlSet\Control\" _ 
  & "TimeZoneInformation\ActiveTimeBias")                              
If (UCase(TypeName(lngBiasKey)) = "LONG") Then                           
  lngBias = lngBiasKey                                                 
ElseIf (UCase(TypeName(lngBiasKey)) = "VARIANT()") Then                  
  lngBias = 0                                                          
  For k = 0 To UBound(lngBiasKey)                                      
      lngBias = lngBias + (lngBiasKey(k) * 256^k)                      
  Next                                                                 
End If                                                                   
                                                                       
' Use ADO to search Active Directory for ObjectClass nTDSDSA.            
' This will identify all Domain Controllers.
' Repeat each local domain controller, Comment & statement added on: 10/2/2007 4:34PM
tmparrstrDCs=Split(arrstrDCs,"|")
For narrstrDCs=0 To UBound(tmparrstrDCs)
  buffOut=""
  'Print Column Header
  buffHeader="UserName" & vbTab & "FullName" & vbTab & "Comment" & vbTab & "HomeDrive" & vbTab & "HomeDir" & vbTab & "Profile" & vbTab & "LogonScript" & vbTab & "PswdCanBeChanged" & vbTab & "PswdLastSetTime" & vbTab & "PswdRequired" & vbTab & "PswdExpires" & vbTab & "PswdExpiresTime" & vbTab & "AcctDisabled" & vbTab & "AcctLockedOut" & vbTab & "AcctExpiresTime" & vbTab & "LastlogonTime" & vbCrLf
  strarrstrDCs = tmparrstrDCs(narrstrDCs)
  Set adoCommand = CreateObject("ADODB.Command")                           
  Set adoConnection = CreateObject("ADODB.Connection")                     
  adoConnection.Provider = "ADsDSOObject"
  adoConnection.Open "Active Directory Provider"
  'adoCommand.Properties("Sort On") = "sAMAccountName"
  adoCommand.ActiveConnection = adoConnection                              
  adoCommand.Properties("Page Size") = HowManyRows
                                                                       
' Retrieve lastLogon attribute for each user on each Domain Controller.  
  strBase = "<LDAP://" & strarrstrDCs & "/" & strDNSDomain & ">"       
  strFilter = "(&(objectCategory=person)(objectClass=user))"
  strQuery = strBase & ";" & strFilter & ";" & strAttributes _         
      & ";subtree"                                                     
  adoCommand.CommandText = strQuery                                    
  On Error Resume Next
  Set adoRecordset = adoCommand.Execute
  
  If (Err.Number <> 0) Then                                            
      On Error GoTo 0                                                  
      Wscript.Echo "Domain Controller not available: " & strarrstrDCs
  Else                                                                 
      On Error GoTo 0                                                  
      Do Until adoRecordset.EOF                                        
          UserName = adoRecordset.Fields("sAMAccountName").Value
          FullName = adoRecordset.Fields("displayName").Value
          Comments = adoRecordset.Fields("Description").Value
          HomeDrive = adoRecordset.Fields("HomeDrive").Value
          HomeDir = adoRecordset.Fields("homeDirectory").Value
          Profile = adoRecordset.Fields("profilePath").Value
          LogonScript = adoRecordset.Fields("scriptPath").Value
          userAccountControl = adoRecordset.Fields("userAccountControl").Value
          lngDate = adoRecordset.Fields("pwdLastSet")
          PswdLastSetTime=Integer8Date(lngDate,lngBias)
          lngDate = adoRecordset.Fields("accountExpires")
          AcctExpiresTime=Integer8Date(lngDate,lngBias)
          lngDate = adoRecordset.Fields("lastLogon")
          LastLogonTime = Integer8Date(lngDate,lngBias)
          
          '*** Special Process
          'Status account
          If userAccountControl AND UF_DISABLED Then AcctDisabled="Yes" Else AcctDisabled="No"
          If userAccountControl AND PASSWD_CANT_CHANGE Then PswdCanBeChanged="No" Else PswdCanBeChanged="Yes"
          If userAccountControl AND DONT_EXPIRE_PASSWORD Then PswdExpires="No" Else PswdExpires="Yes"
          If userAccountControl AND LOCKOUT Then AcctLockedOut="Yes" Else AcctLockedOut="No"
          If userAccountControl AND PASSWD_NOTREQD Then PswdRequired="No" Else PswdRequired="Yes"
          
          'Increase PswdLastSetTime to get ExpirePasswordTime
          If PswdLastSetTime<>"" Then PswdExpiresTime=DateAdd("d",PolExpirePwd,CDate(PswdLastSetTime))
          
          'Decrease one day for AcctExpiresTime
          If AcctExpiresTime<>"" Then AcctExpiresTime=DateAdd("d",-1,AcctExpiresTime)
          
          'Get comments from array
          If VarType(Comments)=8204 Then
           Comment=Comments(0)
          Else
           Comment=Comments
          End If
          
          'Print Field
          'wscript.echo "UserName" & vbTab & "FullName" & vbTab & "Comment" & vbTab & "HomeDrive" 
          '& vbTab & "HomeDir" & vbTab & "Profile" & vbTab & "LogonScript" & vbTab & 
          '"PswdCanBeChanged" & vbTab & "PswdLastSetTime" & vbTab & "PswdRequired" & vbTab 
          '& "PswdExpires" & vbTab & "PswdExpiresTime" & vbTab & "AcctDisabled" & vbTab 
          '& "AcctLockedOut" & vbTab & "AcctExpiresTime" & vbTab & "LastlogonTime" & vbTab 
          '& "LastLogonServer"
          buffOut = buffOut & UserName & vbTab & FullName & vbTab & Comment & vbTab & HomeDrive & vbTab & HomeDir & vbTab & Profile & vbTab & LogonScript & vbTab & PswdCanBeChanged & vbTab & PswdLastSetTime & vbTab & PswdRequired & vbTab & PswdExpires & vbTab & PswdExpiresTime & vbTab & AcctDisabled & vbTab & AcctLockedOut & vbTab & AcctExpiresTime & vbTab & LastlogonTime & vbCrLf
          adoRecordset.MoveNext                                        
      Loop                                                             
      adoRecordset.Close                                               
  End If                                                               
                                                                       
  ' Clean up.                                                              
  adoConnection.Close                                                      
  Set adoConnection = Nothing                                              
  Set adoCommand = Nothing                                                 
  Set adoRecordset = Nothing                                               
  Set objDC = Nothing                                                      
  Set objShell = Nothing
  
  aLogs(narrstrDCs)=buffOut
  'Write Buffer Output to file, added on 10/2/2007 4:43PM
  WriteFile strarrstrDCs & ".txt",buffHeader & buffOut
Next
'*****************************
'* Reconcelation each server *
'*****************************
'Select 1 logs and compare the lastlogon time on each logs/server
On Error Resume Next
Row=Split(aLogs(0),vbCrLf)
For x=0 To UBound(Row)
Col=Split(Row(x),vbTab)
UserID=Col(0)
LastLogonTime=Col(15)
'Find it to other Logs
For y=1 to UBound(aLogs)
aTmp1=Split(aLogs(y),UserID) 'Find row by userid
aTmp2=Split(aTmp1(1),vbCrLf) 'Find 1 row
aTmp3=Split(aTmp2(0),vbTab)  'Split each column
'If userid="DITD115" Then Call Gedebug(aTmp3(15))
tmpLastLogonTime=aTmp3(15)       'Get Lastlogon
'wscript.echo userid,tbTab,LastLogonTime,vbTab,tmpLastLogonTime 'debug only
'Find the latest
If DateDiff("d",LastLogonTime,Now()) > DateDiff("d",CDate(tmpLastLogonTime),Now()) Then
 LastLogonTime=tmpLastLogonTime
End If
Next
Col(15)=LastLogonTime
Row(x)=Join(Col,vbTab)
Next
'ResultLogs=Join(Row,vbCrLf)
'ResultLogs=Replace(ResultLogs,vbCrLf & vbCrLf,vbCrLf) 'double enter removed
'wscript.echo ResultLogs
'WriteFile "ResultLogs.txt",buffHeader & ResultLogs
'wscript.echo "End..."
ResultLogs=Join(Row,vbCrLf)
ResultLogs=Replace(ResultLogs,vbCrLf & vbCrLf,"") 'double enter removed
Row=Split(ResultLogs,vbCrLf)
Call ArraySort(Row)
ResultLogs=Join(Row,vbCrLf)
WriteFile "ResultLogs.txt",buffHeader & ResultLogs
wscript.echo "End..."
Function Integer8Date(ByVal objDate, ByVal lngBias)
  ' Function to convert Integer8 (64-bit) value to a date, adjusted for
  ' local time zone bias.
  Dim lngAdjust, lngDate, lngHigh, lngLow, sDate
  If Not IsObject(objDate) Then
   Integer8Date=""
   Exit Function
  End If
  lngAdjust = lngBias
  lngHigh = objDate.HighPart
  lngLow = objdate.LowPart
  ' Account for error in IADslargeInteger property methods.
  If (lngLow < 0) Then
      lngHigh = lngHigh + 1
  End If
  If (lngHigh = 0) And (lngLow = 0) Then
      lngAdjust = 0
  End If
  lngDate = #1/1/1601# + (((lngHigh * (2 ^ 32)) _
      + lngLow) / 600000000 - lngAdjust) / 1440
  ' Trap error if lngDate is ridiculously huge.
  On Error Resume Next
  sDate = CDate(lngDate)
  If sDate=#1/1/1601# Then Integer8Date = "" Else Integer8Date = sDate
  If (Err.Number <> 0) Then
      On Error GoTo 0
      'Integer8Date = #1/1/1601#
      Integer8Date = ""
  End If
  On Error GoTo 0
End Function
'************** SUB/FUNCTIONS ********************
Function ReadFile(fName)
          Set FSO = CreateObject("Scripting.FileSystemObject")
          Set FHandle = FSO.OpenTextFile(fName,ForReading)
          ReadFile = FHandle.ReadAll
          FHandle.Close
          Set FHandle=Nothing
End Function
Sub WriteFile(fName,txt)
Set FSO = CreateObject("Scripting.FileSystemObject")
Set FHandle = FSO.OpenTextFile(fName,ForWriting,True)
FHandle.WriteLine txt
FHandle.Close
Set FHandle=Nothing
End Sub
'FileExist
'Param:
' filespec = Path Location and Filename
'Return:
' True = File is exist
' False = File is not found
Function FileExist(filespec)
Dim fso
Set fso = CreateObject("Scripting.FileSystemObject")
FileExist = fso.FileExists(filespec)
End Function
'FolderExist
'Param:
' folderspec = Path Location and Filename
'Return:
' True = Folder is exist
' False = Folder is not found
Function FolderExist(folderspec)
Dim fso
Set fso = CreateObject("Scripting.FileSystemObject")
FolderExist = fso.FolderExists(folderspec)
End Function
'CreateFolder
'Param:
' folderspec = Path Location and Foldername
'Return:
' success=folder path or fail
Function CreateFolder(folderspec)
Dim fso, f
Set fso = CreateObject("Scripting.FileSystemObject")
Set f = fso.CreateFolder(folderspec)
CreateFolder = f.Path
End Function
'FileSize
'Param:
' filespec = Path Location and Filename
'Return:
' Size of filespec
Function FileSize(filespec)
Dim fs,fso, f, s
If FileExist(filespec) Then
 Set fso = CreateObject("Scripting.FileSystemObject")
 Set f = fso.GetFile(filespec)
 If f.size<1024 Then
  fs=f.size & " bytes"
 Else
  fs=Round(f.size/1024,2)
  fs=FormatNumber(fs,2,false,false,True) & " kb"
 End If
Else
fs=""
End If
FileSize=fs
End Function
'FileDelete
'Param:
' filespec= Path Location and Filename
'Return:
' true if success
' false if failed
Function FileDelete(filepath)
  Set fso = CreateObject("Scripting.FileSystemObject")
  If fso.FileExists(filepath) Then
     retBol=fso.DeleteFile(filepath)
  Else
     retBol=false
  End If
  FileDelete = retBol
End Function
Function ArraySort(ByRef arlist)
Dim x,y,temp
For x=UBound(arlist) - 1 To 0 Step -1
For y=0 to x
 If arlist(y)>arlist(y+1) Then
  temp=arlist(y+1)
  arlist(y+1)=arlist(y)
  arlist(y)=temp
 End If
Next
Next
End Function

_____________________________

Share of The Day (SOTD)
How can you discover your world by reading my blog? You will find tips&tricks, news, knowledge, fun, etc.

http://aresu.blogspot.com

Revisions: 1 | Post #: 1

RE: Example Reading ADSI Attributes - 3/6/2008 3:46:19 AM

crapapelada

Posts: 1
Score: 0
Joined: 2/12/2008
Status: offline

I REALLY needed this, thank you!!!!

(in reply to aresu)

Post #: 2

RE: Example Reading ADSI Attributes - 3/6/2008 11:04:18 PM

DiGiTAL.SkReAM

Posts: 1157
Score: 7
Joined: 9/6/2005
From: Florida, USA
Status: offline

Can vbscripts actually be copyrighted?!?

_____________________________

"Would you like to touch my monkey?" - Dieter (Mike Meyers)

"It is better to die like a tiger, than to live like a pussy."
-Master Wong, from Balls of Fury

(in reply to crapapelada)

Post #: 3

RE: Example Reading ADSI Attributes - 3/7/2008 12:34:52 AM

TomRiddle

Posts: 165
Score: 4
Joined: 2/7/2008
Status: offline

I would say yes and no.

"YES" If I write or work on a script at work, that script is owned by my employer, I can not take it with me when I leave and delete all other copies. The employer owns it. If I write a script that does some revolutionary new function that has never been done before and I write in it "script by TomRiddle" and then some dork at a later date writes same script, copywrite by dork and starts to make money I could sue him to get my share. That assuming a patent or copywrite on a script can actually be made.

and "NO" because you can't really sell them, you can't encrypt them, code is code, it can only be written written in a certain way i.e the syntax must be correct enough for it to work, two people could in theory come up with the same script, same syntax and even same variable names, especially since there is so much sample code out there, no one will reinvent the wheel when a perfectly good wheel already exists.

This script says it is copywrite aresu.blogspot.com, created by AresU but original code from Richard L. Mueller.
This site states that "All posts and images are owned by VisualBasicScript.com"

So in conclusion, can a script be copyrighted? this one probably NO, since it is a blatant functional copy of DumpSec. Other vbscripts probably can not be copywrighted either. Show me a vbscript that actually is copywrighted.

But this script in particular, since all posts on this site are owned by VisualBasicScript.com, aresu has relinquishing ownership of it to VisualBasicScript.com and can only claim to have written it which he did not.

< Message edited by TomRiddle -- 3/7/2008 12:37:19 AM >

(in reply to DiGiTAL.SkReAM)

Revisions: 1 | Post #: 4

RE: Example Reading ADSI Attributes - 3/8/2008 8:49:32 PM

TNO

Posts: 1064
Score: 10
Joined: 12/18/2004
From: thenewobjective.com
Status: offline

This explains the details behind the legality (Don't worry, its a simple read):

http://www.piercelaw.edu/tfield/copynet.htm

_____________________________

To iterate is human, to recurse divine. -- L. Peter Deutsch

(in reply to TomRiddle)

Post #: 5

If you found our site useful please link to us <a href="http://www.visualbasicscript.com">VisualBasicScript.com</a>.

All Forums >> [Scripting] >> Post a VBScript >> Example Reading ADSI Attributes

Page: [1]

Jump to:

New Messages	No New Messages
Hot Topic w/ New Messages	Hot Topic w/o New Messages
Locked w/ New Messages	Locked w/o New Messages

Post New Thread

Reply to Message

Post New Poll

Submit Vote

Delete My Own Post

Delete My Own Thread

Rate Posts