How can I get the Active Directory DialIn Permission setting from LDAP using VBScript?

Question

In Active Directory, there is a tab called "Dial-In", and under that tab is a radio button control with three settings:

Allow Access
Deny Access
Control access through remote access policy

I'd like to write a VBScript to take a user name, and return the setting for that user. (I'm actually modifying an existing VBScript, which is why I am forced to use that tool).

What is the best way to do that?

Answer 1

Here is the best solution I was able to come up with. It is easy to modify it to output the setting for all users.

Main

Function Main
  'Usage: cscript /nologo lookup.vbs mydomain username
  Wscript.Echo CanDialIn(Wscript.Arguments(0), Wscript.Arguments(1))
  Main = 0
End Function

Function CanDialIn(domainname, username)
  'Take a user name and query whether they have permission to Dial in or not
  'http://www.microsoft.com/technet/scriptcenter/resources/qanda/aug05/hey0825.mspx
  Const ADS_SCOPE_SUBTREE = 2
  Dim objConnection
  Dim objCommand
  Dim objRecordSet

  Set objConnection = CreateObject("ADODB.Connection")
  Set objCommand =   CreateObject("ADODB.Command")
  objConnection.Provider = "ADsDSOObject"
  objConnection.Open "Active Directory Provider"
  Set objCommand.ActiveConnection = objConnection

  objCommand.Properties("Page Size") = 1000
  objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE 

  'Three possible values for msNPAllowDialin:
  'TRUE = "Allow Access"
  'FALSE = "Deny Access"
  'EMPTY = "Control access through remote access policy"
  objCommand.CommandText = _
    "SELECT msNPAllowDialin FROM 'LDAP://dc=" & domainname & ",dc=com' WHERE objectCategory='user' AND sAMAccountName = '" & username & "'"
  On Error Resume Next
  Set objRecordSet = objCommand.Execute
  if objRecordSet.EOF then
    CanDialIn = "Could not find user " & username
  else
    if objRecordSet.Fields("msNPAllowDialin").Value = True then
      CanDialIn = "Allow"
    else
      if objRecordSet.Fields("msNPAllowDialin").Value = False then
        CanDialIn = "Deny"
      else
        CanDialIn = "Control"
      end if
    end if  
  end if
End Function