Active Directory on Remko's Blog

Error 1787 when logging in with domain account

Tue, 21 Aug 2012 11:43:35 +0000

After joining a new Windows 2008 R2 Server to the domain I could not login to the domain.

I would get the following error message:

Additionally the following error was logged in the Eventlog:

Create Active Directory Group with PowerShell

Thu, 15 Mar 2012 15:51:23 +0000

If you want to Create an Active Directory group with PowerShell there are a few things you need to be aware of:

First of all there is no direct way to create new objects in Active Directory. You always need to bind to the Domain or an Organizational Unit and call the Create method.

Example:

powershell Download

# Bind to OU
$ou = [ADSI]"LDAP://OU=OU=Groups,DC=Contoso,DC=COM"

# Create the Group
$group = $ou.Children.Add("CN=TestGroup", "Group")
$group.CommitChanges()

However the group is not yet complete:

Script to Get Computer OU

Tue, 14 Feb 2012 11:12:30 +0000

Just some quick code to get the OU Name of the computer we run the script on.

VBS:

vbnet Download

Function GetComputerOU
	Dim objSysInfo: Set objSysInfo = CreateObject("ADSystemInfo")
	Dim objComputer: Set objComputer = GetObject("LDAP://" & objSysInfo.ComputerName)
	Dim objOU : Set objOU = GetObject(objComputer.Parent)
	GetComputerOU = objOU.OU
End Function

Wscript.Echo GetComputerOU

PowerShell:

powershell Download

function GetComputerOU
{
	$SysInfo = New-Object -ComObject "ADSystemInfo"
	$Computer = [ADSI]("LDAP://{0}" -f $SysInfo.GetType().InvokeMember("ComputerName", [System.Reflection.BindingFlags]::GetProperty, $null, $SysInfo, $null))
	return ([ADSI]$Computer.Parent).OU
}

GetComputerOU

Read Maximum Password Age with PowerShell

Fri, 02 Dec 2011 13:47:44 +0000

I needed to read out the Maximum Password age with a PowerShell script in a Windows 2003 domain.

Reading out the maxPwdAge attribute is a trivial task in PowerShell (I am re-using the function AdsLargeIntegerToInt64):

Read maxPwdAge · powershell Download

$domain = New-Object System.DirectoryServices.DirectoryEntry

# Read maxPwdAge attribute and convert to Int64
$maxPwdAge = AdsLargeIntegerToIn64 $Domain.maxPwdAge.Value

In my case this returns the value -78624000000000 but how do we interpret this?

Convert IADsLargeInteger to Int64 in PowerShell

Thu, 01 Dec 2011 16:03:46 +0000

Some Active Directory attributes return an 8 byte integer in the form of an IADsLargeInteger interface. An example is the pwdLastSet attribute from a user object.

Because the IADsLargeInteger object doesn’t provide type information PowerShell cannot read the HighPart and LowPart properties.

So I wrote the function below to get the Int64 value of an IADsLargeInteger:

Settings NTFS Permissions by SID in PowerShell

Fri, 02 Sep 2011 17:21:42 +0000

I am currently creating a PowerShell script that creates a user with all needed Active Directory attributes, Exchange mailbox, (TS) Home- and Profile directories and so on.

In such a script you can easily get failures because of Active Directory replication.

Check if a useraccount exists with PowerShell

Fri, 02 Sep 2011 11:51:37 +0000

Function below can be used to check if a given Username exists in Active Directory:

powershell Download

function UserExists([string]$Username)
{
	$strFilter = "(&(objectCategory=person)(sAMAccountName=$Username))"

	$objDomain = New-Object System.DirectoryServices.DirectoryEntry

	$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
	$objSearcher.SearchRoot = $objDomain
	$objSearcher.PageSize = 1000
	$objSearcher.Filter = $strFilter
	$objSearcher.SearchScope = "Subtree"

	$colResults = $objSearcher.FindAll()
	return [bool]($colResults -ne $null)
}

AD Internals: Display RID Allocation Pools

Mon, 27 Jun 2011 15:37:04 +0000

In my previous post I wrote about a problem I had with duplicate RID Allocation pools.

But how do we get more insight into these RID Allocation pools?

The DCDIAG tool can display this information per domain controleler using the following syntax

batch Download

dcdiag /s:server /v /test:ridmanager

Example output:

But where in Active Directory is this information stored and can we display it for all Domain Controllers at once for larger environments?

The case of the duplicate SID’s

Mon, 27 Jun 2011 10:04:01 +0000

I encountered another interesting error during Exchange 2010 installation today. During the Organization Preparation I got the following error:

The setup.log doesn’t give us much more detailed info:

text Download

[06-22-2011 11:16:29.0614] [2] [ERROR] Active Directory operation failed on dc001.zorg.local. This error is not retriable. Additional information: The requested object has a non-unique identifier and cannot be retrieved.
Active directory response: 0000219D: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0

[06-22-2011 11:16:29.0630] [2] [ERROR] The server cannot handle directory requests.
[06-22-2011 11:16:29.0630] [2] Ending processing initialize-ExchangeUniversalGroups
[06-22-2011 11:16:29.0630] [1] The following 1 error(s) occurred during task execution:
[06-22-2011 11:16:29.0630] [1] 0. ErrorRecord: Active Directory operation failed on dc001.zorg.local. This error is not retriable. Additional information: The requested object has a non-unique identifier and cannot be retrieved.
Active directory response: 0000219D: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0

[06-22-2011 11:16:29.0630] [1] 0. ErrorRecord: Microsoft.Exchange.Data.Directory.ADOperationException: Active Directory operation failed on dc001.zorg.local. This error is not retriable. Additional information: The requested object has a non-unique identifier and cannot be retrieved.
Active directory response: 0000219D: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0

I remembered from a Tweet by Helge Klein recently that the Active Directory schema has no mechanism for enforcing uniqueness of an attribute.

Exchange 2010 well-known object entry install error

Fri, 24 Jun 2011 12:52:30 +0000

Today I was testing the installation of Exchange 2010 in a VMWare sandbox environment. We created the sandbox to test migration from a 2003 AD and Exchange environment to 2008 R2 with Exchange 2010.

We used a P2V to get real copies of the Active Directory and the AD upgrade to 2008 R2 was already tested.

But during the Exchange installation in the sandbox I got the following error:

Reading the otherWellKnownObjects attribute with PowerShell

Fri, 24 Jun 2011 11:19:25 +0000

I wanted to read the otherWellKnownObjects attribute from an Active Directory object.

In my case this was the Microsoft Exchange container in the Configuration partition:

The otherWellKnownObjects attribute is of type ADSTYPE_DN_WITH_BINARY which unfortunately cannot be viewed or edited with ADSI Edit:

Adding a hidden Exchange mailbox to Outlook

Tue, 25 Jan 2011 13:11:42 +0000

In Exchange it’s possible to hide a Mailbox from the (Global) Address List. You can do that in the Exchange System Manager:

But after you have hidden a Mailbox you cannot create an Outlook profile for it (or add it as an extra mailbox).

When you click Check Name in the wizard you’ll get an error:

The common workaround is to remove the “Hide from Exchange address lists” setting, create the profile (or add the Mailbox) and afterwards set it again.

Once the profile is created it all keeps working.

There is an easier solution though!

Recursive Groups #2

Tue, 18 Jan 2011 19:51:15 +0000

In my previous post I explained how to get the recursive group membership with a very simple Powershell Script.

Commenter Michel thought that the script only tested one level deep but it doesn’t.

But let’s prove that!

Create 3 Global Groups in your Active Directory and name them Level1, 2 and 3:

Make Level3 a Member of Level 2 and make Level a member of Level 1 and finally add an account to the Level 3 group:

Recursive group Membership in Powershell

Tue, 18 Jan 2011 12:54:17 +0000

In this post I will show an easy way to get the recursive group membership for the current user.

I use this in a logon script to handle certain tasks based on group membership.

Most scripts I see for this task do a manual recursive enumeration but in a large environment this could be very slow.

A better way would be to use the tokenGroups attribute of the Active Directory user object.

The tokenGroups attribute is an array of SIDs computed by Active Directory and is used to verify user access.

We need to translate these SIDs to their sAMAccountNames to get the actual group names.

In unmanaged code this could be accomplished by calling the DsCrackNames API or the IADsNameTranslate interface.

The case of the failing Exchange 2007 Install

Mon, 08 Nov 2010 20:56:24 +0000

I was creating an unattended Exchange 2007 install job today and while testing it, it failed with the following error:

text Download

Active Directory operation failed on nl-dc001.MYDOMAIN.LAN. The object 'CN=Default Global Address List,CN=All Global Address Lists,CN=Address Lists Container,CN=My Organisation,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=MYDOMAIN,DC=LOCAL' already exists

I opened the Exchange System Manager and expanded the Tree (Recipient | All Address Lists | All Global Address Lists) and I found 2 Global Address Lists but not the Default Global Address List:

The case of the failing Deployment Server Install

Tue, 26 Oct 2010 16:47:15 +0000

I was trying to install HP Insight Control server deployment (previously called HP Rapid Deployment Pack) on Sql Server 2008 Express. I will just call it Deployment Server or DS from here.

I first installed SQL 2008 Express with Advanced Services and configured it to listen op Port 1433 as required by DS.

The installation of the first part (Deployment Server version 6.9.4) indicated a successfull install but the prereqisuites check of the Hotfix version 2.0 installer failed on the last step:

This was strange because I didn’t yet startup the console, so I decided to start it and close it as this would perhaps allow me to continue.

The next screen was a clear indication something went wrong:

I presumed that the ODBC connection was missing so I went to Adminstrative Tools | Data Sources (ODBC). But the ODBC connection was present. I then fired up SQL Server Management Studio which showed me the eXpress database was missing.

Active Directory Properties Commandline Tool

Sun, 12 Sep 2010 21:56:01 +0000

I have written a small commandline tool that shows the Active Directory Property Sheet for a given account.

The Property sheet is what you get when you doubleclick an object in Active Directory & Computers. Basically this tool is meant to make it easy to quickly view or change properties without needing to start a GUI tool and looking up the account in the AD Tree.

Obtain Fully Qualified Domain Name from Netbios Domain Name

Thu, 17 Jun 2010 14:34:42 +0000

I needed to obtain the Fully Qualified Domain Name (FQDN) for a given NetBios domain name. Eg from MYDOMAIN to dc=mydomain,dc=local.

I did some tests with the TranslateName API and if you append a \ to the domain name it returns the FQDN.

Here is a short example:

Random Active Directory Notes #4

Tue, 30 Mar 2010 15:04:51 +0000

Previously I discussed IDirectoryObject, today I will show how to change a user’s password with IDirectoryObject.

I didn’t find any documentation except a kb article describing how to use pure ldap to do it. Of course I could have used IADsUser::SetPassword but I decided not to because of the following reasons:

IADs interfaces are terribly slow (although for one use you probably wouldn't really notice).
IADsUser::SetPassword tries 3 different methods to set the password (ldap over ssl, kerberos and finally NetUserSetInfo) which makes it even slower (most domain controllers do not have an ssl certificate) and unpredictable.

All example code I found was .NET based using the .NET wrappers for Active Directory and seemed to be meant for use in Adam rather than full Active Directory (it set port number to 389 and password mode to cleartext).

In the end it’s not very difficult but nonetheless it took me a while before I got it right.

We can write to the unicodePwd attribute which wants the password as a double quoted unicode string. If you look at this attribute with AdsiEdit you’ll see that the type is Octet String and that it can be written only.

I was tricked with Delphi’s QuotedStr function for a while because it doesn’t return a double but single quoted string ;-)

Below a small snippet from the upcoming JwsclActiveDirectory that shows how to use it:

Using Windows Dialogs from Delphi

Wed, 24 Mar 2010 11:48:41 +0000

Today I reused a unit I wrote a long time ago for TSAdminEx that shows Resource Dialogs from DLL’s or Executables. I wrote it for a couple of reasons:

Reusing existing dialogs is conventient since the user already knows it.
Windows takes care of translating it into the user's language.
I am too lazy to recreate them ;-)

The code is hardly rocket science and could probably be improved and made more sophisticated but it works for me. I decided to share it since you may find it usefull.

Here is a small usage example that shows the Reset Password dialog from Active Directory Users & Computers. This dialog is in dsadmin.dll (on Windows Vista/7 you will find it in ds.admin.dll.mui in the language subfolder eg %systemroot%\system32\en-US but you can load it using just the dll name).

It looks like this:

c Download

215 DIALOGEX 0, 0, 252, 139
STYLE DS_MODALFRAME | DS_CONTEXTHELP | WS_POPUP | WS_CAPTION | WS_SYSMENU
EXSTYLE WS_EX_CONTEXTHELP
CAPTION "Reset Password"
LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
FONT 8, "MS Shell Dlg"
{
 CONTROL "&New password:", -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 7, 10, 79, 10
 CONTROL "", 220, EDIT, ES_LEFT | ES_PASSWORD | ES_AUTOHSCROLL | WS_CHILD | WS_VISIBLE | WS_BORDER | WS_TABSTOP, 92, 7, 153, 14
 CONTROL "&Confirm password:", -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 7, 28, 79, 10
 CONTROL "", 222, EDIT, ES_LEFT | ES_PASSWORD | ES_AUTOHSCROLL | WS_CHILD | WS_VISIBLE | WS_BORDER | WS_TABSTOP, 92, 25, 153, 14
 CONTROL "&User must change password at next logon", 261, BUTTON, BS_AUTOCHECKBOX | BS_LEFT | BS_TOP | BS_MULTILINE | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 7, 46, 237, 10
 CONTROL "The user must logoff and then logon again for the change to take effect.", -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 14, 61, 231, 8
 CONTROL "", 8327, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 7, 76, 238, 16
 CONTROL "Unlock the user's &account", 8328, BUTTON, BS_AUTOCHECKBOX | BS_LEFT | BS_TOP | BS_MULTILINE | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 14, 96, 230, 10
 CONTROL "OK", 1, BUTTON, BS_DEFPUSHBUTTON | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 140, 118, 50, 14
 CONTROL "Cancel", 2, BUTTON, BS_PUSHBUTTON | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 195, 118, 50, 14
}

Random Active Directory Notes #3

Mon, 22 Mar 2010 22:57:30 +0000

Last time I talked briefly about IDirectoryObject and IDirectorySearch, let’s go into a little more detail today.

IDirectoryObject is an Interface that we can use to query anything in Active Directory, users, groups, organizational units, containers and so on.

I thought the best explanation would be to build a very small sample project, so let’s do that!

First we need some units, so please add the following units to your uses clause:

ComObj (for EOleException and it calls CoInitialize for us)
JwaWindows for the proper Adsi declarations

Next declare the following types:

objectpascal Download

type
 // For Delphi < 2009 use WideString
 UString = {$IFDEF UNICODE}UnicodeString{$ELSE}WideString{$ENDIF};

 // Array of ADS_ATTR_INFO records
 TAdsAttrInfoArray = array[0..ANYSIZE_ARRAY-1] of ADS_ATTR_INFO;
 PAdsAttrInfoArray = ^TAdsAttrInfoArray;

Random Active Directory Notes #2

Fri, 12 Mar 2010 16:57:32 +0000

If you have ever used Adsi you have probably used the IADs interface or derived interfaces such as IADsUser or IADsGroup (maybe even without realising this).

What you need to know is that these interfaces were created to support scripting languages such as VBScript. The reason is that these scripting language have no support at all for structures such as ADSVALUE and don’t work with Pointers.

Random Active Directory Notes

Wed, 10 Mar 2010 11:19:29 +0000

I am working on an Customer Management Console that will present all adminstrative tasks that customers will need in their environment in a single console.

It will handle Active Directory, Terminal Server and Citrix, Printers and will offer specific Views and Reporting. For the Active Directory stuff I decided to create some classes that enabled me to work with AD in a more Delphi OOP way.

Random Active Directory Notes #1

Wed, 10 Mar 2010 11:11:13 +0000

If you are going to use the Active Directory Service Interface (ADSI) in Delphi, the first thing you will need is the typelibrary (TLB). This TLB is in the windows\system32 folder and has the name activeds.tlb.

We can import this tlb in Delphi (the procedure differs somewhat, depending on the Delphi version), but there are quite some problems with the resulting pas file of this import:

Ugly and non meaningfull names such as __MIDL___MIDL_itf_ads_0000_0000_001.
Record sizes are sometimes (read: usually) wrong due to alignment errors.
Some Interfaces have wrong declarations resulting in Access Violations or just hard to use (eg using var for input parameters).
Delphi works with Typed Pointer but since it has no clue on the proper name it uses PUserTypexx (eg PUserType1 = ^_ADS_CASEIGNORE_LIST). It's hard to recognise later on what the real type is.

A version of the imported tlb is also in the Jedi Apilib (JwaAdsTLB) and basically it had the same errors. Because I was wondering how this would work in c++ I checked the SDK and found the header file Iads.h.

Reading accountExpires attribute from Active Directory (in Delphi)

Wed, 10 Feb 2010 15:11:48 +0000

I am writing a class that wraps Active Directory into Objects that live in an Objectlist, much like my Terminal Server class in the Jedi Windows Security Library.

One of the classes is TJwADUser that represents an Active Directory user with all kinds of properties. So while I was implementing them I stumbled upon the accountExpires attribute which is implemented as an 8 byte integer so I figured I could read it as Int64, cast this to TFileTime (FILETIME) and convert to TDateTime.

Registry editing has been disabled by your administrator (not anymore!)

Tue, 12 Aug 2008 23:09:32 +0000

Most administrator will want to prevent normal users from opening Regedit and a command prompt. Usually this is done by activating the “Prevent access to registry editing tools” and “Prevent access to the command prompt” policy settings. They are located under User Configuration | Administrative Templates | System:

Activating the policies will set the matching keys in the registry:

If we try to open regedit we are denied access:

So how does this work?

Microsoft Remote Server Administration Tools released

Wed, 26 Mar 2008 20:59:20 +0000

Microsoft has releaseed the Remote Server Administration Tools (RSAT) for Vista SP1. RSAT enables IT administrators to remotely manage roles and features in Windows Server 2008 from a computer running Windows Vista with SP1. It includes support for remote management of computers running either a Server Core installation or the full installation option of Windows Server 2008. It provides similar functionality to Windows Server 2003 Administration Tools Pack.

Query Active Directory from Excel

Thu, 01 Nov 2007 18:23:55 +0000

I had to lookup some users in Active Directory today which I received by mail. Offcourse I got full users name while I needed either samAccountName or full adsPath. Usually I write a small VBS script to do the lookup and paste this in Excel for further processing. But today I decided that an Excel function to do the lookup would be nice. So I wrote it.

The function is called GetAdsProp and allows you to search on a specific AD field in the whole AD tree and return the value of another field.