Solved

Help with VBS script and extracting user info from AD

Posted on 2010-11-18
1
1,077 Views
Last Modified: 2012-08-13
I have the script attached that I want to modify.  I am not a programmer by any stretch of the imagination.  I cannot find some of the user object attributes that I need, and the ones that I found I cannot get any output when I run the script.  I used both ADSI Edit and CSVDE -f Exportfile.csv to try and identify the attributes that I need.

I want to keep what it has so far and add the following to the script.
PswdCanBeChanged, PswdLastSetTime, PswdRequired, PswdExpires, PswdExpiresTime,AcctDisabled, AcctLockedOut, AcctExpiresTime,LastLogonTime, LastLogonServer, LogonHours , group membership
test-ad.vbs
0
Comment
Question by:asrvwiz
1 Comment
 
LVL 71

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 34187260
I advise you use PowerShell and Quests AD CmdLets to get these if you have no existing scripting background. You can download those here:

http://www.quest.com/powershell/activeroles-server.aspx

With that, you can get an approximation of this with:
Get-QADUser | Select-Object Name, DN, PasswordLastSet, PasswordNeverExpires, PasswordExpires, 
    AccountIsDisabled, AccountIsLockedOut, AccountExpires, LastLogon, MemberOf |
  Export-Csv "SomeFile.csv" -NoTypeInformation

Open in new window

If you must stick with VbScript then not all of the fields you've defined are helpful.

PswdCanBeChanged - Must enumerate account security. Not trivially available.
PswdLastSetTime - PwdLastSet: Needs conversion in VbScript interface
PswdRequired - No such field
PswdExpires - You can pull Never Expires from userAccountControl
PswdExpiresTime - Based on PwdLastSet plus expiry value (set in domain policy)
AcctDisabled - From userAccountControl
AcctLockedOut - From userAccountControl
AcctExpiresTime - accountExpirationDate: Needs conversion in the VbScript interface
LastLogonTime - LastLogon: Needs conversion in VbScript interface. Note: Value is *not* replicated between Domain Controllers
LastLogonServer - No such field
LogonHours - Complex hexadecimal array
group membership - MemberOf (DN of each group the user belongs to, except Primary Group)

Chris
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article shows how to deploy dynamic backgrounds to computers depending on the aspect ratio of display
A company’s centralized system that manages user data, security, and distributed resources is often a focus of criminal attention. Active Directory (AD) is no exception. In truth, it’s even more likely to be targeted due to the number of companies …
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question