Incorrect UPN's and Active Directory

Posted on 2009-05-21
Medium Priority
Last Modified: 2012-05-07
Hi Experts!

      One thing that is constantly causing issues for us is accounts in AD that have incorrect UPNs.  By incorrect, I mean the suffix is not @abc.com, but rather @test.abc.com.  If the UPN of the AD account is not always employeeID@abc.com, lots of stuff breaks, like IWA, password sync, user attribute import/export.  Is it possible to run something that enumerates the UPN for all users and dump the ones that don't have the correct suffix?  This way, I can get the output list that this script generates and contact those folks that are creating accounts incorrectly.  Any help with this  would be greatly appreciated.  Thanks.
Question by:itsmevic
  • 2
  • 2
LVL 71

Accepted Solution

Chris Dent earned 2000 total points
ID: 24443227

Sure, that's not too tricky.

This vbscript will drop them to a tab delimited text file. Should be easy enough to drop that into Excel or similar if required. It will have columns for the distinguishedName, name and current UPN.

The Filter at the top says which it will find, not that it's currently looking for those with *@test.abc.com.



strFilter = "(userPrincipalName=*@test.abc.com)"
strFields = "distinguishedName,name,userPrincipalName"
Set objFileSystem = CreateObject("Scripting.FileSystemObject")
Set objFile = objFileSystem.OpenTextFile("IncorrectUPN.txt", 2, True, 0)
objFile.WriteLine Replace(strFields, ",", VbTab)
Set objConnection = CreateObject("ADODB.Connection")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objRootDSE = GetObject("LDAP://RootDSE")
Set objRecordSet = objConnection.Execute( _
  "<LDAP://" & objRootDSE.Get("defaultNamingContext") & ">;" & _
  strFilter & ";" & strFields & ";subtree")
Set objRootDSE = Nothing
Dim arrLine()
While Not objRecordSet.EOF
  arrFields = Split(strFields, ",")
  ReDim arrLine(0)
  For i = 0 to UBound(arrFields)
    ReDim Preserve arrLine(i) : arrLine(i) = ""
    arrLine(i) = objRecordSet.Fields(arrFields(i)).Value
  objFile.WriteLine Join(arrLine, VbTab)

Open in new window

LVL 71

Expert Comment

by:Chris Dent
ID: 24443350

I should have noted that I posted VbScript because of the zones it was posted, but you can do the same thing through anything that can use the LDAP Filter (AD Users and Computers, DSQuery, ADFind, etc, etc).

This is the important part:


That's used to find the results, everything else is just a wrapper to make it do it and write the results out.

There's only one other modification I can think might be useful. If you wanted this to search an entire forest you would modify this line:

  "<LDAP://" & objRootDSE.Get("defaultNamingContext") & ">;" & _

Changing it to:

  "<GC://" & objRootDSE.Get("rootDomainNamingContext") & ">;" & _

Although it falls apart a bit if you have a disjointed namespace.


Author Comment

ID: 24443555
YOU sir ARE tha MAN!

Author Closing Comment

ID: 31584022
Awesome work!!!

Featured Post

Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Active Directory can easily get cluttered with unused service, user and computer accounts. In this article, I will show you the way I like to implement ADCleanup..
Wouldn't it be nice if objects in Active Directory automatically moved into the correct Organizational Units? This is what AutoAD aims to do and as a plus, it automatically creates Sites, Subnets, and Organizational Units.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question