Solved

How do I Create a Computer Account object in remote domain specifying alternative credentials - VBscript / LDAP bind ?

Posted on 2015-01-18
3
243 Views
Last Modified: 2015-01-31
On Computer A in Domain A I am trying to run a vbscript which will bind to the Domain Controller B in Domain B and create a computer account specifying credentials with appropriate permissions in Domain B.

There is no trust between the domains.
The firewall only has ports 389 and 636 open between Computer A and Domain Controller B.
For this reason DNS is not an option as 53 is not open so I need to reference Domain Controller B in my LDAP bind by IP address.
Using PowerShell is not an option (2003 domain without ADMGS), has to be VBscript.

I know I need to use OpenDSObject instead of GetObject but I cannot figure out the connection.

Once the computer account is created, all the necessary ACLs need to be created as per this MS script (for same domain)
http://support.microsoft.com/kb/315273

I have spent a few days trying to get this working, clearly I am not a scripter, really appreciate some help!
0
Comment
Question by:xxmp
  • 2
3 Comments
 
LVL 28

Expert Comment

by:Ryan McCauley
ID: 40562502
This might be a bit round-about, but how is the script actually being executed? If you don't have authentication access to the domain and there's no trust set up, you won't be able to launch an application with remote credentials. However, you can do a little-known trick with the RUNAS application using the "/NETONLY" switch:

http://codebetter.com/jameskovacs/2009/10/12/tip-how-to-run-programs-as-a-domain-user-from-a-non-domain-computer/

The net effect is that the process runs as the current local user, but when accessing remote resources (like other computers or a DC), it will provide the NETONLY credentials - as long as that remote resource can use them to authenticate properly, you're good to go. In this way, you could provide credentials from your remote domain when connecting to the domain controller.

All that said, I don't know that there's any way to do this automatically from a script, as you're suggesting - you can run the script as another user by using NETONLY, but you'd still have to initiate it (and provide the password) manually.
0
 

Accepted Solution

by:
xxmp earned 0 total points
ID: 40570436
strComputer = "COMPUTER NAME"
strLDAPServer = "LDAP SERVER TO CONNECT TO"
strContainer = "OU FOR COMPUTER ACCOUNT TO BE CREATED"
strUser = "USERNAME WITH PERMISSIONS TO JOIN MACHINE TO DOMAIN"
strPass = "PASSWORD"

Const ADS_SECURE_AUTHENTICATION = 1
Const ADS_SERVER_BIND = &h0200

Set dso = GetObject("LDAP:")
Set ObjContainer = dso.OpenDSObject("LDAP://" & strLDAPServer & "/" & strContainer, strUser, strPass, 1)

Set objComputer = objContainer.Create("Computer",_
"cn=" & strComputer)
objComputer.Put "sAMAccountName", strComputer & "$"
objComputer.Put "userAccountControl", 4096
objComputer.SetInfo

WScript.Quit
0
 

Author Closing Comment

by:xxmp
ID: 40581251
Through trial and error, found this to work perfectly.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Please explain "Multi-Tenant Services" 5 107
What are the Scan to network folder ports? 7 148
VIDEO DATASOURCE Control Resize issue 2 42
Developing a front end to SPLUNK 1 50
A theme is a collection of property settings that allow you to define the look of pages and controls, and then apply the look consistently across pages in an application. Themes can be made up of a set of elements: skins, style sheets, images, and o…
The Need In an Active Directory enviroment, the PDC emulator provide time synchronization for the domain. This is important since Active Directory uses Kerberos for authentication.  By default, if the time difference between systems is off by more …
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

679 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question