joeware - never stop exploring... :)

Have you been around long enough to remember ASCII art… You can generate some with the code at the following link:

http://www.codeproject.com/KB/recipes/ASCII_Imager.aspx

Dear joe,

The next time you get an error 0x8007232B aka DNS name does not exist on Vista or Windows Server 2008 don’t forget to do

slmgr.vbs –ipk “activation key”

slmgr.vbs –ato

 

   thanks, joe

The primary updates I was looking to put into AdFind V01.39.00 are now done. Now I am adding/updating shortcuts. After that, I have to do the part I hate the most, update the usage… Ugh.

As I look at the usage I think, I really need to write a book that goes into depth on all of the switches and variations thereof and what you can do with it because I don’t even recall all of the cute pieces I put into it at this point. I visualized a book on AdFind/AdMod before. It was sort of an AD/LDAP primer with basic ideas explained and then sort of a cookbook / reference for AdFind/Admod. That is a lot of work though and would be something I would write and then use something like cafepress to publish to pay for the labor it would take as I couldn’t get other tool type stuff done while working on it.

 

Here is the rough listing of what was done so far from V01.37.00 (don’t mind the typos, people don’t usually get to see this…). I will discuss the changes more in depth later, maybe. 😉

//* V01.38.00  2007.0630      o 06/30   Add more longhorn decodes           *
//*                                     Changed -noctl to display chars     *
//*                                     -csv now sets -noctl                *
//*                                     Removed crash bug in -dn / -dsq     *
//*                                     Added -sc admincountdmp             *
//*                                     **NEVER RELEASED**                  *
//* V01.39.00  2008.1022      o 10/22   Add more longhorn decodes           *
//*                                     Change references to longhorn       *
//*                           o 10/23   added -rootdseanon                  *
//*                                     BugFix: Transformed filter display  *
//*                                     BugFix: Removed extra line with list*
//*                                     BugFix: Misc usage errors           *
//*                                     BugFix: Misc shortcut errors        *
//*                                     BugFix: replacedn with csv issue    *
//*                                     Added check for y for mvfilter x=y  *
//*                                     BugFix: removed trailing space from *
//*                                        generic binary output            *
//*                           o 10/27   Added -nirs and -nirsx              *
//*                                     Added useraccountcontrol decodes    *
//*                                     Added search flags decodes          *
//*                                     Decode schemaFlagsEx                *
//*                           o 10/29   More accurate SD Decode             *
//*                                     Arbitrary text for csv  header:value*
//*                           o 11/03   BugFix: CSVquote escape             *
//*                                     BugFix: CSVMVDelim escape           *
//*                                     Resolve msExchAdmins SID            *
//*                           o 11/04   -rawsddl no longer requires -sddl   *
//*                           o 11/06   Ranging disabled by attr if range   *
//*                                     Added -writeable                    *
//*                           o 11/07   Added -sslignoresrvcert             *
//*                           o 11/11   If no base specified, use default   *
//*                           o 11/13   Decode objecversion of schema       *
//*                           o 11/16   mvfilter will take attrib and clean *
//*                                      off ;extension for match           *
//*                           o 11/17   Decode dsheuristics                 *
//*                                     Cleanup metadata output             *
//*                                     Added -mvsort and -mvrsort          *
//*                                     Updated -sc sdump to have -mvsort   *
//*                           o 11/26   Added -filterbreakdown              *
//*                                     Allow multiple values for attr for  *
//*                                       mvfilter and mvnotfilter          *
//*                           o 11/27   Added -binenc CURRENT option        *
//*                           o 11/28   Added -enccurrent                   *
//*                                     Added -tdcd                         *
//*                                     Decode msPKIRoamingTimeStamp        *

 

Anyway, I am still on schedule for a December release of AdFind V01.39.00….

As you all know, I have been working away on AdFind lately. I added the ability to decode msPKIRoamingTimeStamp to its two components (create and update time). I wanted to test it and because I don’t have that attrib set on my test environments I needed to compile AdFind in a non-debug mode… And my excitement commenced…

Right off I knew something was wrong, the compiler normally spits AdFind.exe out in about 15-30 seconds or so, after 2 minutes it was still chewing on it… Uh oh. Finally boom, 2 errors. The linker blew up with some error (IMP327 Access Violation) I can’t find a solution for for my case, it seems it usually is a problem with large projects but in Debug mode, my problem was in Release mode and it works great in debug mode….

So I started thinking, well debug versus release is a compiler thing so I looked at the OBJ (object file to you non-devs) file and saw that it was about 6 times larger than it normally is… That could definitely be a cause for the linker to get antsy. It shouldn’t blow up like that but I am more concerned about the compiler issue than the linker issue at the moment as I don’t want an OBJ that is normally 2MB or smaller in a debug compile to be 12MB in a release compile…

So I jump out of the IDE and start playing with the command line compiler BCC32 and eventually realize that the problem is related to inline function expansion. This is something you do to increase speed in your apps, but it causes them to get bigger for all but the most trivial of applications. Now this is something I already knew about because Borland started automatically selecting inline function expansion as the default in BDS 2006 and I had to learn to turn it off on each project or have horribly bloated executables. So I had ALREADY turned it off in the IDE…

I then look closer at the message output in CodeGear C++ Builder 2009 and see that the IDE was specifying the switches “-vi-” and “-v-“. These should mean

-vi-  :  Disable inline function expansion (opposite of -vi  : this is the default setting if you specify nothing)

-v-   : Disable debug (opposite of -v) The default setting if you don’t specify anything should be -v- (i.e. don’t be in debug)

 

So that looked right but after extensive testing I realized that the BCC32 compiler has a bug in it. If you specify “-vi-” it will happily disable the inline function expansion, but if you specify “-vi- -v-” it won’t… Theoretically “-vi-” and “-vi- -v-” should be functionally the same, but it isn’t being treated that way with my compiler.

 

The upshot of all of this is that I have to compile and link by hand at the command line instead of using the nice IDE that I paid so much money for whenever I want to produce a release copy of AdFind right now which annoys the heck out of me.

So I found 3 bugs…

1. “-vi- -v-” should be functionally identical with “-vi-“, they aren’t.

2. The IDE uses “-vi- -v-” instead of “-vi-“

3. The linker blows up because the OBJ produced by compiling with “-vi- -v-” is wrong.

 

After I finally got it compiled and took it to a network that I thought had the msPKIRoamingTimeStamp  attribute set I found out it actually didn’t so I can’t even run the test I wanted to run!!!

 

    joe

 

More Detail:

I logged this all with Code Gear under Code Gear Quality Central Report 69444

Here are the details in the report (doing this so it can be found by anyone searching for any of these terms on the web)

Running on Windows Vista 32 Bit SP1

There appears to be three problems.

1. BCC32 does something different when using “-vi- -v-” than it does if just specifying “-vi-” w/o “-v-“.

When specifying “-vi- -v-” the compile of my project (sorry I cannot provide the project) is extremely slow taking minutes to complete and when it finally completes the OBJ size is 12,437,373 bytes. When I specify “-vi-” without the “-v-” the project compiles within seconds and has an OBJ size of 1,542,100 bytes.  If I specify “-vi- -v” the project compiles within seconds and has an OBJ size of 2,890,523.

If I add the -B switch to compile to ASM, I get sizes of

“-vi-”            : 10,271,585

“-vi- -v”        : 15,991,499

“-vi -v-”        : 88,866,898

Obviously “-v-” is doing something different from not specifying it at all which is unexpected to me from what I see in the usage.

2. In the IDE when I specify release with inline functions not expanded it specifies a command line of “-vi- -v-” instead of “-vi-“, with the above information you can see how that impacts me. I do not see how I can modify that behavior.

3. When “-vi- -v-” is used and the OBJ is 12MB, the linker blows up with an access violation and the following:

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: BSS                 : 0x00000000 / 0x00400000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: CODE                : 0x0000033b / 0x00400000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: DATA                : 0x000000b5 / 0x00400000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: DEBSYM              : 0x0000000e / 0x00400000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: Extdef flags        : 0x00000021 / 0x00004000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: Extdefs             : 0x00000084 / 0x00004000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: Import symbols      : 0x0000030c / 0x00100000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: OBJ symbols         : 0x00000b94 / 0x00100000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: Public GSX          : 0x00000078 / 0x000c0000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: Publics             : 0x00000438 / 0x000c0000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: SegRelocs           : 0x00000820 / 0x00400000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: StringBlock         : 0x00000030 / 0x00400000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: UNKNOWN             : 0x00000006 / 0x00400000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: Virdefs             : 0x00000060 / 0x00020000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: BSS                 : 0x00000000 / 0x00400000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: CODE                : 0x003e4089 / 0x00400000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: DATA                : 0x0002dac1 / 0x00400000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: Extdef flags        : 0x00000000 / 0x00004000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: Extdefs             : 0x00000000 / 0x00004000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: F:/Dev/Current/CPP/AdFind/Release/AdFind.ilc: 0x00010000 / 0x08000000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: F:/Dev/Current/CPP/AdFind/Release/AdFind.ild: 0x00010000 / 0x08000000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: F:/Dev/Current/CPP/AdFind/Release/AdFind.ilf: 0x00016000 / 0x08000000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: F:/Dev/Current/CPP/AdFind/Release/AdFind.ils: 0x0004b000 / 0x03000000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: F:/Dev/Current/CPP/AdFind/Release/AdFind.tds: 0x00010000 / 0x06000000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: Import symbols      : 0x00000000 / 0x00100000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: OBJ symbols         : 0x00000000 / 0x00100000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: Public GSX          : 0x0000082c / 0x000c0000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: Publics             : 0x0000498c / 0x000c0000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: StringBlock         : 0x0000000b / 0x00400000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: Virdefs             : 0x0000082c / 0x00020000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets : warning : Warning: unknown heap name   : 0x08000000 / 0x08000000

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets(2089,3): error : Fatal: Error detected (IMP327)

e:\program files\codegear\rad studio\6.0\Bin\CodeGear.Cpp.Targets(2089,3): error : Fatal: Access violation.  Link terminated.

I’m on a roll…

This evening while partaking in a little turkey, ham, mashed potatoes, and some sautéed squash fries and visiting with friends and family the code I needed to write to add delta time filter capability popped into my head and this evening I inserted that code so now you can do something like

 

F:\Dev\Current\CPP\AdFind\Debug>adfind -default -binenc -f "lastlogontimestamp>={{current:-20d}}" lastlogontimestamp -tdcs

AdFind V01.39.00cpp ***BETA*** Joe Richards (joe@joeware.net) November 2008

Transformed Filter: lastlogontimestamp>=128706070664670000
Using server: JOEWARE-DC1.joeware.local:389
Directory: Windows Server 2003
Base DN: DC=joeware,DC=local

dn:CN=$jricha34,CN=Users,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/18-20:29:00 Eastern Standard Time

dn:CN=DC2,OU=Domain Controllers,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/24-09:38:47 Eastern Standard Time

dn:CN=JOEWARE-DC1,OU=Domain Controllers,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/18-15:53:36 Eastern Standard Time

dn:CN=MBX01,CN=Computers,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/22-23:34:48 Eastern Standard Time

dn:CN=$joe,CN=Users,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/17-21:42:24 Eastern Standard Time

dn:CN=mvp,OU=Users,OU=joeware.net,OU=Orgs,OU=Mail,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/18-08:35:01 Eastern Standard Time

dn:CN=joe,OU=Users,OU=joeware.net,OU=Orgs,OU=Mail,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/18-16:36:13 Eastern Standard Time

dn:CN=listmail1,OU=Users,OU=joeware.net,OU=Orgs,OU=Mail,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/25-23:37:40 Eastern Standard Time

dn:CN=support,OU=Users,OU=joeware.net,OU=Orgs,OU=Mail,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/18-22:48:57 Eastern Standard Time

9 Objects returned

 

Which basically says, show me all objects that have the lastLogonTimeStamp attribute updated with a value from the last 20 days. You could also do –20m for last 20 minutes. Or if you want to be very specific you can specify the days, hours, minutes and seconds with a dd:hh:mm:ss formatted string. The 20 days example would look like –20:00:00:00 or alternately –20:0:0:0.

This will make it even easier for folks to use AdFind for their custom cleanup scripts if OldCmp isn’t doing it for them… Instead of them having to calculate the actual int8 value, they can let AdFind do it for them.

    joe