Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

Export AD info showing accounts with Allow Access Dial-In enabled

Posted on 2010-11-30
5
Medium Priority
?
1,416 Views
Last Modified: 2012-05-10
Is there a way to export a csv showing just the users that have AD accounts with Allow Access Dial-In enabled (VPN access)?

Windows Server 2003 AD...

Thx in advance.
0
Comment
Question by:OdyChris
  • 3
  • 2
5 Comments
 
LVL 57

Expert Comment

by:Mike Kline
ID: 34239859
Several good ways (I'm not at my lab so can't take a screenshot)

John outlines some methods here  http://www.windowsitpro.com/article/tips/jsi-tip-10596-more-ways-to-determine-who-has-dial-in-permission-in-my-domain-.aspx

I'm partial to the adfind tool from Joe Richards.   Try that out and let me know how that works.  In John's example he only outputted the DN but you can output any attributes you wish (i.e. samaccountname sn givenname etc...)

Thanks

Mike
0
 

Author Comment

by:OdyChris
ID: 34267815
Thanks for your help mkline... I have been trying to use the ADFIND program, I am just not having any luck with this... I dont think I know how to enter the right commands for this to work... Is there a forum somewhere that you could recommend that has help with using ADFIND? I know I know... Google is my friend :)

Thanks...
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 34267844
Joe used to have a forum but took it down.  I'll test tonight in my lab and get back with you.
0
 

Author Comment

by:OdyChris
ID: 34268060
That would be awesome, thank you for your help.
0
 
LVL 57

Accepted Solution

by:
Mike Kline earned 2000 total points
ID: 34272592
I created two users that were set to allowed.  If you take a look at the screenshots you will see the command I'm using

adfind  -default -f "&(objectCategory=person)(objectClass=user)(msNPAllowDialin=TRUE)" samaccountname msnpallowdialin

Notice that the msNPAllowDialin=TRUE is case sensitive

in 2008 the text on the GUI changed (to network access permission)  You can see the differences (between 2003 and 2008) here  

http://www.selfadsi.org/user-attributes-w2k8.htm
http://www.selfadsi.org/user-attributes-w2k3.htm

Let me know if that helps

Thanks

Mike





Dialin-Query-ADUC.png
Dialin-Query.png
0

Featured Post

[Webinar On Demand] Database Backup and Recovery

Does your company store data on premises, off site, in the cloud, or a combination of these? If you answered “yes”, you need a data backup recovery plan that fits each and every platform. Watch now as as Percona teaches us how to build agile data backup recovery plan.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

It’s time for spooky stories and consuming way too much sugar, including the many treats we’ve whipped for you in the world of tech. Check it out!
Transferring FSMO roles is done when an admin wants to split roles between certain Domain Controllers or the Domain Controller holding the Roles has been forcefully demoted using dcpromo / forceremoval
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

580 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question