views:

69

answers:

3

We are undergoing a migration from several domains into a single domain. As part of that process, user accounts are being moved around the various ADs a fair bit. This has resulted in some scripts breaking because they are trying to get the User objects from a specific location in AD.

How would I amend the following to not be AD location specific?

Set objBlahUser = GetObject("LDAP://CN=" & objNetwork.UserName & ",OU=ADMigration,OU=Blah Users,DC=blah,DC=loc")

Thanks in advance

A: 

Do you just want to specify the hostname? Assuming that the rest of the AD structure is identical then you can just specify the server name in your binding string:

Set objBlahUser = GetObject("LDAP://yourserver.com/CN=" & objNetwork.UserName & ",OU=ADMigration,OU=Blah Users,DC=blah,DC=loc")
Tuzo
Nope - the problem is within each domain. Domain Blah has some users in OU Blah Users, and other users in BlahBlah Users.
Izzy
Do you know in advance what users have moved to what location? If so, you can construct the binding string even more dynamically than you are now (appending the OU, DC information etc. based on some criteria you know). If you know the potential OUs the user could be in and you know there will not be duplicate CNs across the OUs then another alternative might be to attempt to bind to one OU but if that fails attempt to bind to the other OU. But that is ugly and a performance hit.
Tuzo
A: 

So, there is no way to intrinsically search and select the object from the directory. I had to employ a separate function to search and return the DN of the object for later use.

userDN = GetUserDN(objNetwork.UserName,"server001","blah.loc")
If Not userDN = "Error" Then
    Set objBlahUser = GetObject("LDAP://" & userDN)
End if              



Function GetUserDN(strUserName, strServer, strDomain)
    On Error Resume Next

    Set objConnection = CreateObject("ADODB.Connection")
        objConnection.Provider = "ADsDSOObject"
        objConnection.Properties("User ID") = strDomain & "\ReadADAccount"
        objConnection.Properties("Password") = "ReadADAccountPwd"
        objConnection.Open "Active Directory Provider"


    Set objCommand = CreateObject("ADODB.Command")
    objCommand.ActiveConnection = objConnection

    objCommand.CommandText = _
        "<LDAP://" & strServer & ">;(&(objectCategory=User)" & _
             "(samAccountName=" & strUserName & "));distinguishedname;subtree"

    Set objRecordSet = objCommand.Execute

    If objRecordset.RecordCount = 0 Then
        GetUserDN = "Error"
    Else
        GetUserDN = objRecordSet(0).value
    End If

    objConnection.Close
End Function
Izzy
+2  A: 

The simplest way to do this is use the NameTranslate object which is built-in to Windows

Const ADS_NAME_INITTYPE_GC = 3
Const ADS_NAME_TYPE_NT4 = 3
Const ADS_NAME_TYPE_1779 = 1

strNTName = "MyDomain\TestUser"
Set objTrans = CreateObject("NameTranslate")
objTrans.Init ADS_NAME_INITTYPE_GC, ""
objTrans.Set ADS_NAME_TYPE_NT4, strNTName
strUserDN = objTrans.Get(ADS_NAME_TYPE_1779)

There is a great write up on this object here:

http://www.rlmueller.net/NameTranslateFAQ.htm

mrTomahawk
That's awesome - thanks for the heads-up! Will definitely strip sizeable chunks of my future code out!
Izzy