ldap query to see which OU the user is in

Posted on 2009-02-22
Last Modified: 2013-12-24
Hi !
im currently auditing "user set to never expire" on my active directory users.
the notification is created once an event 624 is created on the dc with the never expire audit.

if this happens on a "generic" user (on our corperation) - it is fine.
a generic user is created in a certain OU.
since event 624 does not log the OU , i want to trigger an ldap query once a "user set to never expire trigger" occures .

how is it possible to do such thing (on a command line command) , and get a log back (so i can parse it back to the system and check if the user is in that certain OU or not..)

Question by:m0tek
    LVL 14

    Expert Comment

    what basicly do you want ,

    query that will return all users ou with password never expire ?

    vbscript solution will help you ?

    Author Comment

    i would like to run a script / command with a user (script.bat username) and the following will return in which OU'S does this user exist , i need it returned into a textfile which i can later on read (a security information event management system will read it)
    LVL 14

    Accepted Solution

    run from command line

    scriptname username

    the output will be in a txt file in the location you run the script
    Set objnet = CreateObject("")
    Set objHash = CreateObject("Scripting.Dictionary")
    Set objfso = CreateObject("scripting.filesystemobject")
    strDomain = "LDAP://" & objnet.UserDomain
    If WScript.Arguments.Count = 0 Then
    WScript.Echo "usage: " & WScript.ScriptName & " UserName"
    End if
    Set objlog = objfso.CreateTextFile(".\log.txt",true)
    objHash.Add "Password never expires", &h10000
    Set objUser = GetObject _
     ("LDAP://" & FindUserPath(WScript.Arguments(0)))
    intUAC = objUser.Get("userAccountControl")
    For Each Key In objHash.Keys
     If objHash(Key) And intUAC Then
     objlog.WriteLine Key & " is enabled" & vbnewline & FindUserPath(WScript.Arguments(0)) & vbcrlf
     objlog.WriteLine Key & " is disabled" & vbnewline & FindUserPath(WScript.Arguments(0)) & vbcrlf
     End If
    Function FindUserPath(User)
            selectedProperties = "Distinguishedname"
            Set oCn = CreateObject("ADODB.Connection")
            Set oCmd = CreateObject("ADODB.Command")
            oCn.Provider = "ADsDSOObject"
            oCn.Open "Active Directory Provider"
            Set oCmd.ActiveConnection = oCn
            oCmd.Properties("Page Size") = 1000
            oCmd.Properties("Searchscope") = 2 
            oCmd.CommandText = "SELECT " & selectedProperties & " FROM '" & strDomain & "' WHERE objectCategory='user' AND samAccountName = '" & User & "'"
            Set oRS = oCmd.Execute
            Do Until oRS.EOF
                    FindUserPath = oRS.Fields(selectedProperties).Value
    End Function

    Open in new window


    Author Closing Comment

    Good stuff ^^
    LVL 14

    Expert Comment


    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Join & Write a Comment

    Entering time in Microsoft Access can be difficult. An input mask often bothers users more than helping them and won't catch all typing errors. This article shows how to create a textbox for 24-hour time input with full validation politely catching …
    Read about achieving the basic levels of HRIS security in the workplace.
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
    Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

    755 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    23 Experts available now in Live!

    Get 1:1 Help Now