Solved

Export AD info showing accounts with Allow Access Dial-In enabled

Posted on 2010-11-30
5
1,281 Views
Last Modified: 2012-05-10
Is there a way to export a csv showing just the users that have AD accounts with Allow Access Dial-In enabled (VPN access)?

Windows Server 2003 AD...

Thx in advance.
0
Comment
Question by:OdyChris
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 57

Expert Comment

by:Mike Kline
ID: 34239859
Several good ways (I'm not at my lab so can't take a screenshot)

John outlines some methods here  http://www.windowsitpro.com/article/tips/jsi-tip-10596-more-ways-to-determine-who-has-dial-in-permission-in-my-domain-.aspx

I'm partial to the adfind tool from Joe Richards.   Try that out and let me know how that works.  In John's example he only outputted the DN but you can output any attributes you wish (i.e. samaccountname sn givenname etc...)

Thanks

Mike
0
 

Author Comment

by:OdyChris
ID: 34267815
Thanks for your help mkline... I have been trying to use the ADFIND program, I am just not having any luck with this... I dont think I know how to enter the right commands for this to work... Is there a forum somewhere that you could recommend that has help with using ADFIND? I know I know... Google is my friend :)

Thanks...
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 34267844
Joe used to have a forum but took it down.  I'll test tonight in my lab and get back with you.
0
 

Author Comment

by:OdyChris
ID: 34268060
That would be awesome, thank you for your help.
0
 
LVL 57

Accepted Solution

by:
Mike Kline earned 500 total points
ID: 34272592
I created two users that were set to allowed.  If you take a look at the screenshots you will see the command I'm using

adfind  -default -f "&(objectCategory=person)(objectClass=user)(msNPAllowDialin=TRUE)" samaccountname msnpallowdialin

Notice that the msNPAllowDialin=TRUE is case sensitive

in 2008 the text on the GUI changed (to network access permission)  You can see the differences (between 2003 and 2008) here  

http://www.selfadsi.org/user-attributes-w2k8.htm
http://www.selfadsi.org/user-attributes-w2k3.htm

Let me know if that helps

Thanks

Mike





Dialin-Query-ADUC.png
Dialin-Query.png
0

Featured Post

Space-Age Communications Transitions to DevOps

ViaSat, a global provider of satellite and wireless communications, securely connects businesses, governments, and organizations to the Internet. Learn how ViaSat’s Network Solutions Engineer, drove the transition from a traditional network support to a DevOps-centric model.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
A hard and fast method for reducing Active Directory Administrators members.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question