Solved

Export AD info showing accounts with Allow Access Dial-In enabled

Posted on 2010-11-30
5
1,222 Views
Last Modified: 2012-05-10
Is there a way to export a csv showing just the users that have AD accounts with Allow Access Dial-In enabled (VPN access)?

Windows Server 2003 AD...

Thx in advance.
0
Comment
Question by:OdyChris
  • 3
  • 2
5 Comments
 
LVL 57

Expert Comment

by:Mike Kline
ID: 34239859
Several good ways (I'm not at my lab so can't take a screenshot)

John outlines some methods here  http://www.windowsitpro.com/article/tips/jsi-tip-10596-more-ways-to-determine-who-has-dial-in-permission-in-my-domain-.aspx

I'm partial to the adfind tool from Joe Richards.   Try that out and let me know how that works.  In John's example he only outputted the DN but you can output any attributes you wish (i.e. samaccountname sn givenname etc...)

Thanks

Mike
0
 

Author Comment

by:OdyChris
ID: 34267815
Thanks for your help mkline... I have been trying to use the ADFIND program, I am just not having any luck with this... I dont think I know how to enter the right commands for this to work... Is there a forum somewhere that you could recommend that has help with using ADFIND? I know I know... Google is my friend :)

Thanks...
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 34267844
Joe used to have a forum but took it down.  I'll test tonight in my lab and get back with you.
0
 

Author Comment

by:OdyChris
ID: 34268060
That would be awesome, thank you for your help.
0
 
LVL 57

Accepted Solution

by:
Mike Kline earned 500 total points
ID: 34272592
I created two users that were set to allowed.  If you take a look at the screenshots you will see the command I'm using

adfind  -default -f "&(objectCategory=person)(objectClass=user)(msNPAllowDialin=TRUE)" samaccountname msnpallowdialin

Notice that the msNPAllowDialin=TRUE is case sensitive

in 2008 the text on the GUI changed (to network access permission)  You can see the differences (between 2003 and 2008) here  

http://www.selfadsi.org/user-attributes-w2k8.htm
http://www.selfadsi.org/user-attributes-w2k3.htm

Let me know if that helps

Thanks

Mike





Dialin-Query-ADUC.png
Dialin-Query.png
0

Join & Write a Comment

Installing a printer using group policy preferences is not that hard let’s take a look at it. First lets open up your group policy console and edit the policy you want to add it to. I recommend creating a new policy for each printer makes it a l…
[b]Ok so now I will show you how to add a user name to the description at login. [/b] First connect to your DC (Domain Controller / Active Directory Server) SET PERMISSIONS FOR SCRIPT TO UPDATE COMPUTER DESCRIPTION TO USERNAME 1. Open Active …
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now