joeware - never stop exploring... :)

Information about joeware mixed with wild and crazy opinions...

3/22/2011

AdFind V01.45.00 and AdMod V01.16.00

by @ 8:39 pm. Filed under tech, updates

So I slipped a new version of AdFind and AdMod out to the web site in the last week, AdFind on the Ides of March and AdMod today. They were both minor updates though the AdMod update allows me to do something with clearing protected DACLs that I will try to write up in a near term blog entry. Someone emailed me a question on how to do something with clearing the protected DACLs in an OU and I thought I had a good answer but really didn’t and it bothered me. I took a shower and while in the shower I realized that four simple lines of code could be added to AdMod and I WOULD have a good answer. Now I have a good answer. Winking smile

 

You can get the tools in the same place as always…

AdFind V01.45.00

http://www.joeware.net/freetools/tools/adfind/index.htm

AdMod V01.16.00

http://www.joeware.net/freetools/tools/admod/index.htm

 

   joe

Rating 4.50 out of 5

Say what you really know…

by @ 5:42 pm. Filed under quotes

Just because something is unexplained does not mean that it is paranormal, supernatural, extraterrestrial or conspiratorial. Before you say something is out of this world, first make sure that it is not in this world, for science is grounded in naturalism, not supernaturalism, paranormalism, or any other unnecessarily complicated explanations.

   – Houdini’s Principal

Rating 4.00 out of 5

Save 50% on Active Directory, 4th Ed E-Book and Help Japan – Tues 3/22 Only!

by @ 8:59 am. Filed under tech

(I stole this from Brian’s blog, it is worth repeating…)

Starting at 12:01 AM Pacific (GMT –7), O’Reilly will be offering the eBook version of my book, Active Directory, 4th Edition at 50% off. What’s more is they’ll be donating nearly all of the revenue to the Japanese Red Cross Society. If you don’t already own a copy, this is a great opportunity to get an easily searchable (and portable) DRM free version of my book. Here’s the page to order from.

The full text of the O’Reilly announcement:

O’Reilly, No Starch Press, and Tidbits will donate all revenues, less author royalties, from "Deal of the Day" sales to the Japanese Red Cross Society.

Thanks to the Internet, we understand more deeply than ever that everyone on the planet is connected. The disasters that have hit Japan feel close to home, and those of us at O’Reilly, No Starch, and Tidbits want to do something to help the Japanese people recover and rebuild. We know many of you do, too. Working with the O’Reilly Tokyo office, we will ensure that your valued contribution goes to the relief of those most in need. We’ll update the total amount donated throughout the day, as well as the final amount.

Take a look!

Rating 3.00 out of 5

3/18/2011

Building a chicken coop…

by @ 11:06 pm. Filed under alternatives

Build a chicken coop wiki

http://howto.wired.com/wiki/Build_a_Chicken_Coop

Rating 3.00 out of 5

New developer environment for joeware…

by @ 6:00 am. Filed under tech

I finally moved my software dev machine from Vista to Windows 7. Specifically a Windows 7 SP1 x64 (Intel Core i5) laptop. All source code has been moved to the new machine and the old Vista laptop will be put into a box for a few months before I attempt to reload it with Windows 7 and see if it can become a useful machine again – it is way slow under Vista but then it was ALWAYS way slow under Vista (but weren’t most systems that came out in the Vista timeframe?).

Sadly Borland/CodeGear C++ Builder is not making the move with me. Don’t get me wrong, I have loved Borland for years, I have Borland compilers going back to Turbo C days and possibly even Turbo C 1.0 if I really work hard to dig out old floppy disks from the 80’s/90’s. This despite nearly 10 years of having free access to Visual Studio through the Microsoft MVP program. So why now you ask? Three reasons mostly.

The first and major reason is that still, at this point in time, CodeGear C++ still does not have a 64 bit compiler. This has been on the horizon for them for some time and unfortunately still is. I was waiting but just don’t want to wait any longer. I have had quite a few people sending emails asking for the “64 bit versions” of the utilities. And while all of them, to my knowledge, are working fine on x64 systems as x86 binaries and I don’t really see any major benefits of pushing my current tools into the x64 realm, I don’t want to be one of those developers who sits in the past with all x86 binaries. I would rather be on the other side of the imaginary line of developers who can offer either/or.

The second is that Code Gear C++ Builder 2009 seemed to have an issue running on Windows 7 when I tested it. I could compile debug versions of AdFind just fine, but release versions would break with random memory errors. While I could sit and figure that out, I would rather spend that time writing and releasing code, my goal isn’t to become an expert on the vagaries of compiling code with CodeGear C++ builder but to continue to release utilities that make people’s lives easier.

The third is that it is silly to spend thousands of dollars on compilers when Visual Studio is available to me for free. I didn’t think this was so silly years ago when VS was horribly non-compliant with the ISO C++ standards and darn near everything I would try to write would fail with odd compiler errors but Herb Sutter, I believe, has really helped push Microsoft into becoming standards compliant.

I will still have Code Gear C++ Builder installed, just in case I need to validate how something compiles or to fix some egregious bug that I haven’t migrated to the new compiler. It will be running either in XP Mode or a Vista Virtual, I haven’t sorted that out yet. Also if I need a quick and dirty GUI tool which I do sometimes put together but rarely share, I think C++ Builder beats Visual Studio here hands down. The ability to produce NATIVE code GUIs with a RAD environment in C++ Builder is something I love having the ability to do. I HATE HATE HATE HATE the fact that if I want to do that in Visual Studio, I have no choice but to use the .NET Framework.

Anyway, I have spent the last couple of weeks trying to set things up with VS 2010 and yes, even taking some of the tutorials to try and learn the IDE and processes on VS. Part of me is excited though a large part of me knows I am going to be stumbling around in the environment for a bit trying to forget my previous experiences of using older versions of Microsoft’s C++ compilers and stumbling over its ISO issues.

I am also going to take this opportunity to start using the Boost libraries. It is something I have wanted to do for some time but just never took that jump to rewrite my personal libraries to utilize the Boost stuff. Since I am already going to be reworking things because of Visual Studio and  Visual C++ and x64 I figure adding in Boost makes sense. I am not sure why Visual Studio doesn’t have Boost built in… Anyway… Not worth the skull sweat to work that one out so I built the x86 version of the Boost libraries this morning, the x64 version of the libraries will be built,likely, this evening. What I am most excited about with Boost is <boost/regex.hpp>… yes Regular Expressions… I have long wanted to add Regular Expression capabilities to AdFind and this puts me that much closer…

     joe

Rating 3.00 out of 5

3/17/2011

Happy St. Patrick’s Day–AKA Carbon Monoxide Detector Day

by @ 5:25 pm. Filed under general

Buy a new one, replace an old one.

Test all of them but realize that the testing doesn’t test the ability to detect CO, just the ability to sound an alert.

Once again…

CARBON MONOXIDE DETECTORS EXPIRE.

BUY NEW ONES BEFORE THE OLD ONES EXPIRE.

Rating 3.00 out of 5

3/15/2011

Moral Responsibility…

by @ 6:53 pm. Filed under quotes

Don’t let yourself be victimized by the age you live in. It’s not the times that will bring us down, any more than it’s society. When you put the blame on society, you end up turning to society for the solution.

There’s a tendency today to absolve individuals of moral responsibility and treat them as victims of social circumstances. You buy that, you pay with your soul.

     – Tom Robbins (Still Life with Woodpecker)

 

Rating 3.50 out of 5

3/4/2011

Adding sAMAccountName and sAMAccountType to ADAM/ADLDS directories

by @ 12:37 am. Filed under tech

First and foremost… ADAM rocks. 🙂

With that being said… I regularly like to pull users and groups from AD and stuff them into ADAM. In general the normal ADAM schema is sufficient but for users and groups from an ADAM standpoint, ADAM is a positive step away from the SAM DB and as part of that step they did not put sAMAccountName nor sAMAccountType into the ADAM schema.

However… Sometimes I want the sAMAccountName and sAMAccountType attributes because I am importing user/group objects from AD and those values may be important for some reason and I may need to keep them, this could be for any number of reasons. Regardless of the reason, sometimes I want to do it, and that means I fairly regularly add those attributes to the schema of various ADAM instances I spin up. This can be done specifically for these couple of attributes or you can, if needed, import the whole Windows Server 2003 or Windows Server 2008 Schemas with the MS-adamschemaw2k3.LDF and MS-adamschemaw2k8.LDF files.

So it isn’t exciting to walk through using LDIF to import the K3 or K8 schemas and doing so doesn’t teach you anything about how you can use AdFind and AdMod so I will show how I import just those two attributes in case it proves useful to someone else trying to do something similar.

While you can do this with the older versions of AdFind and AdMod, I have added some features to the latest versions (AdFind V01.44.00 / AdMod V01.15.00) specifically to make it easier. Below I outline the process you can follow to update an ADAM instance on the local PC to have sAMAccountName and sAMAccountType for users and groups.

 

Step 1: Create a CSV file for the import (I ran this command against a Windows Server 2008 R2 Domain):

adfind -sc sdump -csv -af ldapdisplayname=samaccount* > SamAccount.csv

When run you see:

[Wed 03/02/2011 23:23:42.71]
F:\Dev\Current\CPP\SchemaMods>adfind -sc sdump -csv -af ldapdisplayname=samaccount* > SamAccount.csv

[Wed 03/02/2011 23:24:08.33]

This creates the file (it won’t look pretty here) ;o)

__SamAccount.csv__

"dn","adminDescription","adminDisplayName","attributeID","attributeSecurityGUID","attributeSyntax","auxiliaryClass","cn","defaultHidingValue","defaultObjectCategory","defaultSecurityDescriptor","description","extendedCharsAllowed","governsID","isDefunct","isMemberOfPartialAttributeSet","isSingleValued","lDAPDisplayName","linkID","mAPIID","mayContain","mustContain","objectClass","objectClassCategory","oMSyntax","possSuperiors","rangeLower","rangeUpper","rDNAttID","schemaIDGUID","searchFlags","showInAdvancedViewOnly","subClassOf","systemAuxiliaryClass","systemFlags","systemMayContain","systemMustContain","systemOnly","systemPossSuperiors"
"CN=SAM-Account-Name,<SCHEMA>","SAM-Account-Name","SAM-Account-Name","1.2.840.113556.1.4.221","{59BA2F42-79A2-11D0-9020-00C04FC2D3CF}","2.5.5.12","","SAM-Account-Name","","","","","","","","TRUE","TRUE","sAMAccountName","","","","","attributeSchema;top","","64","","0","256","","{3E0ABFD0-126A-11D0-A060-00AA006C33ED}","13","TRUE","","","18","","","FALSE",""
"CN=SAM-Account-Type,<SCHEMA>","SAM-Account-Type","SAM-Account-Type","1.2.840.113556.1.4.302","{59BA2F42-79A2-11D0-9020-00C04FC2D3CF}","2.5.5.9","","SAM-Account-Type","","","","","","","","TRUE","TRUE","sAMAccountType","","","","","attributeSchema;top","","2","","","","","{6E7B626C-64F2-11D0-AFD2-00C04FD930C9}","1","TRUE","","","18","","","FALSE",""

 

Then to import into ADAM with the new importschema shortcut (use –po switch with shortcut to see exact switches enabled for you if curious)…

[Wed 03/02/2011 23:24:08.33]
F:\Dev\Current\CPP\SchemaMods>admod -hh . -sc importschema:SamAccount.csv

AdMod V01.15.00cpp Joe Richards (joe@joeware.net) March 2011

DN Count: 2
Using server: hplt17:389
Directory: Windows Server 2008 Active Directory Application Mode

Adding specified objects…
   DN: CN=SAM-Account-Name,CN=Schema,CN=Configuration,CN={4DC12149-8F6B-4E24-BF3A-7A2E754CBB44}…
   DN: CN=SAM-Account-Type,CN=Schema,CN=Configuration,CN={4DC12149-8F6B-4E24-BF3A-7A2E754CBB44}…

The command completed successfully

 

After you import the attributes, you need to refresh the schema so you can attach them to the classes.

[Wed 03/02/2011 23:25:28.99]
F:\Dev\Current\CPP\SchemaMods>admod -hh . -sc refreshschema

AdMod V01.15.00cpp Joe Richards (joe@joeware.net) March 2011

Modifying ROOTDSE…
DN Count: 1
Using server: hplt17:389
Directory: Windows Server 2008 Active Directory Application Mode

Modifying specified objects…
   DN: ROOTDSE…

The command completed successfully

 

Now add the attributes to the user and group classes.

[Wed 03/02/2011 23:25:57.24]
F:\Dev\Current\CPP\SchemaMods>admod -hh . -schema -rb cn=user maycontain:++:samaccountname;samaccounttype -exterr

AdMod V01.15.00cpp Joe Richards (joe@joeware.net) March 2011

DN Count: 1
Using server: hplt17:389
Directory: Windows Server 2008 Active Directory Application Mode
Base DN: cn=user,CN=Schema,CN=Configuration,CN={4DC12149-8F6B-4E24-BF3A-7A2E754CBB44}

Modifying specified objects…
   DN: cn=user,CN=Schema,CN=Configuration,CN={4DC12149-8F6B-4E24-BF3A-7A2E754CBB44}…

The command completed successfully

[Wed 03/02/2011 23:26:29.42]
F:\Dev\Current\CPP\SchemaMods>admod -hh . -schema -rb cn=group maycontain:++:samaccountname;samaccounttype -exterr

AdMod V01.15.00cpp Joe Richards (joe@joeware.net) March 2011

DN Count: 1
Using server: hplt17:389
Directory: Windows Server 2008 Active Directory Application Mode
Base DN: cn=group,CN=Schema,CN=Configuration,CN={4DC12149-8F6B-4E24-BF3A-7A2E754CBB44}

Modifying specified objects…
   DN: cn=group,CN=Schema,CN=Configuration,CN={4DC12149-8F6B-4E24-BF3A-7A2E754CBB44}…

The command completed successfully

 

And finally now you can refresh the schema again so that you can use the attributes.

[Wed 03/02/2011 23:26:43.77]
F:\Dev\Current\CPP\SchemaMods>admod -hh . -sc refreshschema

AdMod V01.15.00cpp Joe Richards (joe@joeware.net) March 2011

Modifying ROOTDSE…
DN Count: 1
Using server: hplt17:389
Directory: Windows Server 2008 Active Directory Application Mode

Modifying specified objects…
   DN: ROOTDSE…

The command completed successfully

 

Now that you have this info in the schema you can do something like (using the new importpass1 and importpass2 switches)…

 

[Wed 03/02/2011 23:28:31.44]
F:\Dev\Current\CPP\SchemaMods>adfind -default -rb cn=users -sc export_x -csv | admod -hh . -add -importpass1 -unsafe -exterr

AdMod V01.15.00cpp Joe Richards (joe@joeware.net) March 2011

DN Count: 20
Using server: hplt17:389
Directory: Windows Server 2008 Active Directory Application Mode

Adding specified objects…
   DN: CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=$joe,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Administrator,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Allowed RODC Password Replication Group,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Cert Publishers,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Denied RODC Password Replication Group,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Domain Admins,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Domain Computers,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Domain Controllers,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Domain Guests,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Domain Users,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Enterprise Admins,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Enterprise Read-only Domain Controllers,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Group Policy Creator Owners,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Guest,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=krbtgt,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=RAS and IAS Servers,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Read-only Domain Controllers,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Schema Admins,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=testuser,CN=Users,DC=test,DC=loc,DC=adam…

The command completed successfully

 

and

 

[Wed 03/02/2011 23:28:41.20]
F:\Dev\Current\CPP\SchemaMods>adfind -default -rb cn=users -sc export_x -csv | admod -hh . -importpass2 -unsafe -exterr

AdMod V01.15.00cpp Joe Richards (joe@joeware.net) March 2011

DN Count: 20
Using server: hplt17:389
Directory: Windows Server 2008 Active Directory Application Mode

Modifying specified objects…
   DN: CN=Users,DC=test,DC=loc,DC=adam…  No LDAP updates to make.
   DN: CN=krbtgt,CN=Users,DC=test,DC=loc,DC=adam…  No LDAP updates to make.
   DN: CN=Domain Computers,CN=Users,DC=test,DC=loc,DC=adam…  No LDAP updates to make.
   DN: CN=Domain Controllers,CN=Users,DC=test,DC=loc,DC=adam…  No LDAP updates to make.
   DN: CN=Schema Admins,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Enterprise Admins,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Cert Publishers,CN=Users,DC=test,DC=loc,DC=adam…  No LDAP updates to make.
   DN: CN=Domain Admins,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Domain Users,CN=Users,DC=test,DC=loc,DC=adam…  No LDAP updates to make.
   DN: CN=Domain Guests,CN=Users,DC=test,DC=loc,DC=adam…  No LDAP updates to make.
   DN: CN=Group Policy Creator Owners,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=RAS and IAS Servers,CN=Users,DC=test,DC=loc,DC=adam…  No LDAP updates to make.
   DN: CN=Allowed RODC Password Replication Group,CN=Users,DC=test,DC=loc,DC=adam…  No LDAP updates to make.
   DN: CN=Denied RODC Password Replication Group,CN=Users,DC=test,DC=loc,DC=adam…
   DN: CN=Read-only Domain Controllers,CN=Users,DC=test,DC=loc,DC=adam…  No LDAP updates to make.
   DN: CN=Enterprise Read-only Domain Controllers,CN=Users,DC=test,DC=loc,DC=adam…  No LDAP updates to make.
   DN: CN=testuser,CN=Users,DC=test,DC=loc,DC=adam…  No LDAP updates to make.
   DN: CN=Administrator,CN=Users,DC=test,DC=loc,DC=adam…  No LDAP updates to make.
   DN: CN=Guest,CN=Users,DC=test,DC=loc,DC=adam…  No LDAP updates to make.
   DN: CN=$joe,CN=Users,DC=test,DC=loc,DC=adam…  No LDAP updates to make.

The command completed successfully

 

and you may be wondering… seriously, did it really update the group memberships with the proper members?

 

[Wed 03/02/2011 23:30:17.19]
F:\Dev\Current\CPP\SchemaMods>adfind -hh . -default -rb cn=users -f objectcategory=group member

AdFind V01.44.00cpp Joe Richards (joe@joeware.net) March 2011

Using server: hplt17:389
Directory: Windows Server 2008 Active Directory Application Mode
Base DN: cn=users,DC=test,DC=loc,DC=adam

dn:CN=Allowed RODC Password Replication Group,CN=Users,DC=test,DC=loc,DC=adam

dn:CN=Cert Publishers,CN=Users,DC=test,DC=loc,DC=adam

dn:CN=Denied RODC Password Replication Group,CN=Users,DC=test,DC=loc,DC=adam
>member: CN=Schema Admins,CN=Users,DC=test,DC=loc,DC=adam
>member: CN=Read-only Domain Controllers,CN=Users,DC=test,DC=loc,DC=adam
>member: CN=krbtgt,CN=Users,DC=test,DC=loc,DC=adam
>member: CN=Group Policy Creator Owners,CN=Users,DC=test,DC=loc,DC=adam
>member: CN=Enterprise Admins,CN=Users,DC=test,DC=loc,DC=adam
>member: CN=Domain Controllers,CN=Users,DC=test,DC=loc,DC=adam
>member: CN=Domain Admins,CN=Users,DC=test,DC=loc,DC=adam
>member: CN=Cert Publishers,CN=Users,DC=test,DC=loc,DC=adam

dn:CN=Domain Admins,CN=Users,DC=test,DC=loc,DC=adam
>member: CN=Administrator,CN=Users,DC=test,DC=loc,DC=adam
>member: CN=$joe,CN=Users,DC=test,DC=loc,DC=adam

dn:CN=Domain Computers,CN=Users,DC=test,DC=loc,DC=adam

dn:CN=Domain Controllers,CN=Users,DC=test,DC=loc,DC=adam

dn:CN=Domain Guests,CN=Users,DC=test,DC=loc,DC=adam

dn:CN=Domain Users,CN=Users,DC=test,DC=loc,DC=adam

dn:CN=Enterprise Admins,CN=Users,DC=test,DC=loc,DC=adam
>member: CN=Administrator,CN=Users,DC=test,DC=loc,DC=adam
>member: CN=$joe,CN=Users,DC=test,DC=loc,DC=adam

dn:CN=Enterprise Read-only Domain Controllers,CN=Users,DC=test,DC=loc,DC=adam

dn:CN=Group Policy Creator Owners,CN=Users,DC=test,DC=loc,DC=adam
>member: CN=Administrator,CN=Users,DC=test,DC=loc,DC=adam

dn:CN=RAS and IAS Servers,CN=Users,DC=test,DC=loc,DC=adam

dn:CN=Read-only Domain Controllers,CN=Users,DC=test,DC=loc,DC=adam

dn:CN=Schema Admins,CN=Users,DC=test,DC=loc,DC=adam
>member: CN=Administrator,CN=Users,DC=test,DC=loc,DC=adam

14 Objects returned

 

and AD looks like

 

[Wed 03/02/2011 23:31:03.87]
F:\Dev\Current\CPP\SchemaMods>adfind -default -rb cn=users -f objectcategory=group member

AdFind V01.44.00cpp Joe Richards (joe@joeware.net) March 2011

Using server: K8R2Dom-DC01.K8R2Dom.loc:389
Directory: Windows Server 2008 R2
Base DN: cn=users,DC=K8R2Dom,DC=loc

dn:CN=Domain Computers,CN=Users,DC=K8R2Dom,DC=loc

dn:CN=Domain Controllers,CN=Users,DC=K8R2Dom,DC=loc

dn:CN=Schema Admins,CN=Users,DC=K8R2Dom,DC=loc
>member: CN=Administrator,CN=Users,DC=K8R2Dom,DC=loc

dn:CN=Enterprise Admins,CN=Users,DC=K8R2Dom,DC=loc
>member: CN=$joe,CN=Users,DC=K8R2Dom,DC=loc
>member: CN=Administrator,CN=Users,DC=K8R2Dom,DC=loc

dn:CN=Cert Publishers,CN=Users,DC=K8R2Dom,DC=loc

dn:CN=Domain Admins,CN=Users,DC=K8R2Dom,DC=loc
>member: CN=$joe,CN=Users,DC=K8R2Dom,DC=loc
>member: CN=Administrator,CN=Users,DC=K8R2Dom,DC=loc

dn:CN=Domain Users,CN=Users,DC=K8R2Dom,DC=loc

dn:CN=Domain Guests,CN=Users,DC=K8R2Dom,DC=loc

dn:CN=Group Policy Creator Owners,CN=Users,DC=K8R2Dom,DC=loc
>member: CN=Administrator,CN=Users,DC=K8R2Dom,DC=loc

dn:CN=RAS and IAS Servers,CN=Users,DC=K8R2Dom,DC=loc

dn:CN=Allowed RODC Password Replication Group,CN=Users,DC=K8R2Dom,DC=loc

dn:CN=Denied RODC Password Replication Group,CN=Users,DC=K8R2Dom,DC=loc
>member: CN=Read-only Domain Controllers,CN=Users,DC=K8R2Dom,DC=loc
>member: CN=Group Policy Creator Owners,CN=Users,DC=K8R2Dom,DC=loc
>member: CN=Domain Admins,CN=Users,DC=K8R2Dom,DC=loc
>member: CN=Cert Publishers,CN=Users,DC=K8R2Dom,DC=loc
>member: CN=Enterprise Admins,CN=Users,DC=K8R2Dom,DC=loc
>member: CN=Schema Admins,CN=Users,DC=K8R2Dom,DC=loc
>member: CN=Domain Controllers,CN=Users,DC=K8R2Dom,DC=loc
>member: CN=krbtgt,CN=Users,DC=K8R2Dom,DC=loc

dn:CN=Read-only Domain Controllers,CN=Users,DC=K8R2Dom,DC=loc

dn:CN=Enterprise Read-only Domain Controllers,CN=Users,DC=K8R2Dom,DC=loc

14 Objects returned

 

    joe

Rating 4.60 out of 5

3/3/2011

AdFind V01.44.00 and AdMod V01.15.00 released

by @ 11:52 pm. Filed under tech

As mentioned previously, AdFind V01.43.00 had some issues with non-Microsoft LDAP directories due to a check I added to detect if paging was available[1]. I mistakenly assumed that RootDSE’s would all return the supportedControl attribute by default. I fixed that. 🙂 In the meanwhile I took the time to work on a few other things as well that I didn’t have time to get to before in the prior release,overall though, the main changes are in AdMod.

AdFind Update Summary

As mentioned, I fixed the paging check issue. I also set up some decodes of RootDSE OIDs for OpenLDAP. I also added a –nopagingcheck just in case a directory supports the paging control but for whatever reason isn’t returning it in the RootDSE request. Look at me worrying about non-Microsoft directories. ;o)

I fixed an output bug I introduced in V01.43.00 around value metadata output.

I tweaked the attributes in the –sc export_* shortcuts.

I put in a hard block and error message when you specify a special base and the –b switch. I call this the Burbidge update.

I modified the –sc dclist shortcut. I made it more flexible so that it can be used for all DCs in the forest or just the DCs in a single forest. Also you can now specify RODCs only. At the same time I also decided to add –sc gclist and –sc !gclist. These should all be really useful for FOR /F looping in Batch. I intend to write up a blog entry or two on this because it is tremendously useful if you need to quickly gather info across all of your DCs and everyone is telling you that you need to write a script to do it.

I added another similar shortcut, –sc domainlist which gives you DNS Names (dNSRoot attribute of NC Partition object) of all Domains in the forest.

 

AdMod Update Summary

Main changes in AdMod are that I was finally able to duplicate and find some long running –CSV and –Import issues. I had been getting sporadic reports of issues for some time and I could never narrow the problem down but finally got a break in the troubleshooting and sorted it out. I spent hours most nights since the last release stepping through the code line by line for various CSV files keeping manual tables of what should be happening, reminded me exercises from computer science classes back in the 80’s. 

 

I also took this time to add some other useful features to the import functionality to make it more friendly for imports including having AdMod look at the destination directory schema and automatically filtering out any attributes from the import that don’t exist in the destination directory. I also added two new import modes, importpass1 and importpass2. This is to help deal with DN attributes that may have references that aren’t already defined when the object is created. The idea is that you run the CSV file in ADD mode with importpass1 and it creates all of the objects with the DN attributes filtered out. Then you run the same CSV file through in update mode with importpass2 and it populates just the DN attributes. It worked really well in my limited tests and I think it is pretty cool but I look forward to the comments from the field… from you guys and gals. Oh I also added an –sc importschema switch that will also be the topic of a future blog entry.

I fixed a couple of bugs, the first was around the GUID## encoding mechanism with the braces. The second is with the –hd switch.

 

Anyway, I hope folks find the changes useful, as always, any bugs or suggestions, email me at joe@joeware.net

 

See the AdFind update info at http://www.joeware.net/freetools/tools/adfind/index.htm

See the AdMod update info at http://www.joeware.net/freetools/tools/admod/index.htm

 

    joe

 

[1] This was a self-preservation change. By far the biggest “AdFind is broken” email I get is due to people querying non-MSFT directories that don’t support paging and currently AdFind uses paging queries exclusively. This is something I have on the list to change someday, but today isn’t that day. ;)  Anyway, this change should make it clear to people why AdFind is not returning data when they query LDAP directory XYZ that doesn’t support paging.

Rating 4.50 out of 5

3/1/2011

Hey where did they get light sabers from?? I want one!

by @ 12:15 am. Filed under humour
Rating 3.00 out of 5

[joeware – never stop exploring… :) is proudly powered by WordPress.]