Solved

ADsEnumerateNext failing enumerating Global Catalog

Posted on 2008-10-19
2
966 Views
Last Modified: 2013-12-19
Hi all

I've been searching for a day now for information on why ADsEnumerateNext can fail enumerating the global catalog.  

I've a client whose debug log files show me that this function is failing with S_FALSE.  The code is below.

I just get a debug trace back with enumerated 0 objects.

The process is a system service, running in an account which has domain administrator privileges.

I'm wondering what the possible failure modes for this are, e.g.

1. There is nothing in the GC (is this even possible)?
2. Service does not have permission to enumerate the GC (but can connect to it?)
3. There's some referral required?
4. User is in wrong domain without proper trust relation to the forest

Any ideas to check?
IADsContainer *pCont = NULL;
HRESULT rc = ADsOpenObject( L"GC:", NULL, NULL, ADS_SECURE_AUTHENTICATION, IID_IADsContainer, (void**)&pCont);
if( S_OK == rc )
{
	IEnumVARIANT *pEnum = NULL;
	FileTrace("[*] GetIADs -> Opened IID_IADsContainer");
	rc = ADsBuildEnumerator(pCont, &pEnum);
	if(S_OK == hResult) 
	{
		FileTrace("[*] GetIADs -> Built enumeration VARIANT");
		IDispatch *pDisp = NULL;
		ULONG lFetch = 0;
		VARIANT var;
		VariantInit( &var );
 
		// Now enumerate. There is only one child of the GC: object.
		rc = ADsEnumerateNext(pEnum, 1, &var, &lFetch);
		if (( rc == S_OK ) && ( lFetch == 1 ) )     
		{    
			FileTrace("[*] GetIADs -> Enumerated 1 object");
			pDisp = V_DISPATCH(&var);
			rc = pDisp->QueryInterface( IID_IADs, (void**)&pIADS); 
			if (pDisp)(pDisp)->Release();
		}
		else
		{
			FileTrace("[*] GetIADs -> Enumerated %d objects (hResult: %x)",lFetch,rc);
		}
 
		// clean up the variant.
		VariantClear(&var);
 
		if (pEnum) ADsFreeEnumerator(pEnum);
	}				
	else
	{
		FileTrace("[*] GetIADs -> ADsBuildEnumerator failed (rc: %x)", hResult);
	}
	if( pCont ) pCont->Release( );
}
else
{
	FileTrace("[*] GetIADs -> ADsOpenObject failed (hResult: %x)", rc);
}

Open in new window

0
Comment
Question by:Adrien de Croy
2 Comments
 
LVL 6

Expert Comment

by:meugen
ID: 22994855
According to MSDN website: S_FALSE means The call succeeded, but the number of items returned is less than those requested.
Maybe this helps you: http://msdn.microsoft.com/en-us/library/aa772181(VS.85).aspx
0
 
LVL 3

Accepted Solution

by:
Adrien de Croy earned 0 total points
ID: 23031431
Hi

was already aware of that, since I was only asking for 1 item, to return S_FALSE would still mean there are no items.

Turns out the problem was to do with the client's AD configuration, they reinstalled their OS, and the problem went away
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Impact to changing AD username 2 22
Problems creating account in AD with Powershell, data from SQL 57 46
Changing logon server question 5 61
Unable to hit site 2 23
This article outlines the process to identify and resolve account lockout in an Active Directory environment.
A project that enables an administrator to perform actions within a user session context not just at the time of login but any time later on day(s) or week(s) later.
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

679 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question