BobA
Fri Oct 13 08:05:02 CDT 2006
Richard,
Here is the code I modified per your suggestions. It will not return the
groups.
input = inputbox("ID")
On Error Resume Next
if UserExists(Input, sDisplayName, arrGroups) then
wscript.echo "Found " & sDisplayName
If IsNull(arrGroups) then
Wscript.Echo "No group memberships"
ElseIf (TypeName (arrGroups = "Administrators")) then
Wscript.Echo "Member of group " & arrGroups
Else
For Each strGroup In arrGroups
Wscript.Echo "Member of group " & strGroup
Next
End If
else
wscript.echo "Not valid account"
end if
'if UserExists(Input,sDisplayName) then
' wscript.echo "User is member of the Administrators Group " & sDisplayName
'else
' wscript.echo "Not a member of Administrators"
'end if
Function UserExists(sUser,sDisplayName, arrGroups)
Dim oConnection, oCommand, oRoot, sDNSDomain, sQuery, sFilter, oResults
UserExists = False
sDisplayName = sUser
On Error Resume Next
' Use ADO to search the domain for all users.
Set oConnection = CreateObject("ADODB.Connection")
Set oCommand = CreateObject("ADODB.Command")
oConnection.Provider = "ADsDSOOBject"
oConnection.Open "Active Directory Provider"
Set oCommand.ActiveConnection = oConnection
' Determine the DNS domain from the RootDSE object.
Set oRoot = GetObject("LDAP://RootDSE")
sDNSDomain = oRoot.Get("DefaultNamingContext")
sFilter = "(&(ObjectClass=user)(ObjectCategory=person)(samAccountName=" &
sUser & "))"
'sFilter =
"(&(objectClass=user)(objectCategory=person)(memberOf=CN=Administrators,CN=Builtin)(samAccountName=" & sUser & "))"
sQuery = "<LDAP://" & sDNSDomain & ">;" & sFilter &
";displayName,memberOf;subtree"
oCommand.CommandText = sQuery
oCommand.Properties("Page Size") = 100
oCommand.Properties("Timeout") = 30
oCommand.Properties("Cache Results") = False
Set oResults = oCommand.Execute
'Do Until oResults.EOF
' if oResults.Fields("displayName") <> "" then
' sDisplayName = oResults.Fields("displayName")
' UserExists = True
' End if
' oResults.MoveNext
'Loop
'On Error Goto 0
'End Function
Do Until oResults.EOF
sDisplay = oResults.Fields("displayName").Value & ""
arrGroups = oResults.Fields("memberOf").Value
UserExists = True
oResults.MoveNext
Loop
End Function
"Bob A" wrote:
> Richard,
> Thanks alot for your help.
> Here is my final goal...
> To check if the userid entered into the input box is valid and a member of
> the builtin administrators group. I have been editing the sFilter to try and
> grab just members of the group but I dont think Im doing it right (or if this
> is even the correct way)
> Here is the code:
>
> input = inputbox("ID")
> if UserExists(Input,sDisplayName) then
> wscript.echo "User is member of the Administrators Group " & sDisplayName
> else
> wscript.echo "Not a member of Administrators"
> end if
> Function UserExists(sUser,sDisplayName)
> Dim oConnection, oCommand, oRoot, sDNSDomain, sQuery, sFilter, oResults
> UserExists = False
> sDisplayName = sUser
> On Error Resume Next
> ' Use ADO to search the domain for all users.
> Set oConnection = CreateObject("ADODB.Connection")
> Set oCommand = CreateObject("ADODB.Command")
> oConnection.Provider = "ADsDSOOBject"
> oConnection.Open "Active Directory Provider"
> Set oCommand.ActiveConnection = oConnection
> ' Determine the DNS domain from the RootDSE object.
> Set oRoot = GetObject("LDAP://RootDSE")
> sDNSDomain = oRoot.Get("DefaultNamingContext")
> 'sFilter = "(&(ObjectClass=user)(ObjectCategory=person)(samAccountName=" &
> sUser & "))"
> sFilter =
> "(&(objectClass=user)(objectCategory=person)(memberOf=CN=Administrators,CN=Builtin)(samAccountName=" & sUser & "))"
> sQuery = "<LDAP://" & sDNSDomain & ">;" & sFilter &
> ";displayName,memberOf;subtree"
> oCommand.CommandText = sQuery
> oCommand.Properties("Page Size") = 100
> oCommand.Properties("Timeout") = 30
> oCommand.Properties("Cache Results") = False
> Set oResults = oCommand.Execute
> Do Until oResults.EOF
> if oResults.Fields("displayName") <> "" then
> sDisplayName = oResults.Fields("displayName")
> UserExists = True
> End if
> oResults.MoveNext
> Loop
> On Error Goto 0
> End Function
>
> Thanks Alot for your help!
>
> Bob
>
> "Richard Mueller" wrote:
>
> > Hi,
> >
> > You have a few options. One is to add the memberOf attribute to the comma
> > delimited list of attribute values to be retrieved by the ADO query:
> >
> > sQuery = "<LDAP://" & sDNSDomain & ">;" & sFilter &
> > ";displayName,memberOf;subtree"
> >
> > The memberOf attribute is a multi-valued collection of the Distinguished
> > Names of the groups the object is a direct member of (except the group
> > designated as the "primary" group, which is usually "Domain Users" for
> > users). You could return this collection, then loop through it and check if
> > the group of interest is included. Modify Function UserExists to return
> > arrGroups:
> > ================
> > Function UserExists(sUser, sDisplayName, arrGroups)
> > .....
> > sQuery = "<LDAP://" & sDNSDomain & ">;" & sFilter _
> > & ";displayName,memberOf;subtree"
> > .....
> > Do Until oResults.EOF
> > sDisplay = oResults.Fields("displayName").Value & ""
> > arrGroups = oResults.Fields("memberOf").Value
> > UserExists = True
> > oResults.MoveNext
> > Loop
> > End Function
> > =========
> > I would recommend not using "On Error Resume Next". You can prevent an error
> > raised when there is no value assigned to displayName by appending a blank
> > string to the value retrieved, as above. This also means the function will
> > return True even though the user has no value for this attribute. sDisplay
> > will be a blank string. Then in the main part of the program:
> > =========
> > if UserExists(Input, sDisplayName, arrGroups) then
> > wscript.echo "Found " & sDisplayName
> > If IsNull(arrGroups) then
> > Wscript.Echo "No group memberships"
> > ElseIf (TypeName(arrGroups = "String") then
> > Wscript.Echo "Member of group " & arrGroups
> > Else
> > For Each strGroup In arrGroups
> > Wscript.Echo "Member of group " & strGroup
> > Next
> > End If
> > else
> > wscript.echo "Not account found for 'Dave'"
> > end if
> > =========
> > Note that ADO returns memberOf as an array if there is more than one group
> > DN in the collection. However, if there are no group memberships it will be
> > Null, and if there is one group it will have datatype "String". You must
> > account all possibilities. How you handle this depends on how many group
> > memberships you want to check. You could simply check each group as they are
> > enumerated, instead of echoing the names.
> >
> > Another approach would be to return the distinguishedName of the user in
> > Function UserExists, then to check if this user is a member of a group, bind
> > to the group and use the IsMember method of the group object. You pass the
> > distinguishedName of the user to this method. Again, you add to the comma
> > delimited list of attribute values to be retrieved by the ADO query:
> >
> > sQuery = "<LDAP://" & sDNSDomain & ">;" & sFilter _
> > & ";displayName,distinguishedName;subtree"
> >
> > You would modify Function UserExists to return this value, perhaps as strDN.
> > Then, to check group membership:
> >
> > Set objGroup = GetObject("LDAP://cn=TestGroup,ou=Sales,dc=MyDomain,dc=com")
> > If (objGroup.IsMember(strDN) = True) Then
> > Wscript.Echo "User is a member of the group"
> > Else
> > Wscript.Echo "User is NOT a member of the group"
> > End If
> >
> > --
> > Richard
> > Microsoft MVP Scripting and ADSI
> > Hilltop Lab -
http://www.rlmueller.net
> >
> > "Bob A" <BobA@discussions.microsoft.com> wrote in message
> > news:76EE2F97-5843-4621-8DF4-37D9A3339F77@microsoft.com...
> > >I am using this script to check to see if a user exists in AD. Since there
> > >is
> > > already a connection to AD would it be possible to check for group
> > > membership
> > > at the same time??...and if so..how?
> > >
> > > Thanks
> > >
> > > input = inputbox("Enter UserID")
> > >
> > > if UserExists(Input,sDisplayName) then
> > > wscript.echo "Found " & sDisplayName
> > > else
> > > wscript.echo "Not account found for 'Dave'"
> > > end if
> > >
> > >
> > > Function UserExists(sUser,sDisplayName)
> > > Dim oConnection, oCommand, oRoot, sDNSDomain, sQuery, sFilter, oResults
> > > UserExists = False
> > > sDisplayName = sUser
> > > On Error Resume Next
> > > ' Use ADO to search the domain for all users.
> > > Set oConnection = CreateObject("ADODB.Connection")
> > > Set oCommand = CreateObject("ADODB.Command")
> > > oConnection.Provider = "ADsDSOOBject"
> > > oConnection.Open "Active Directory Provider"
> > > Set oCommand.ActiveConnection = oConnection
> > > ' Determine the DNS domain from the RootDSE object.
> > > Set oRoot = GetObject("LDAP://RootDSE")
> > > sDNSDomain = oRoot.Get("DefaultNamingContext")
> > > sFilter = "(&(ObjectClass=user)(ObjectCategory=person)(samAccountName=" &
> > > sUser & "))"
> > > sQuery = "<LDAP://" & sDNSDomain & ">;" & sFilter &
> > > ";displayName;subtree"
> > > oCommand.CommandText = sQuery
> > > oCommand.Properties("Page Size") = 100
> > > oCommand.Properties("Timeout") = 30
> > > oCommand.Properties("Cache Results") = False
> > > Set oResults = oCommand.Execute
> > > Do Until oResults.EOF
> > > if oResults.Fields("displayName") <> "" then
> > > sDisplayName = oResults.Fields("displayName")
> > > UserExists = True
> > > End if
> > > oResults.MoveNext
> > > Loop
> > > On Error Goto 0
> > > End Function
> > >
> > >
> >
> >
> >