An ADSI Primer, Part 6: Using ADSI to Create and Manipulate User Accounts

Editor's note: This article is the sixth part of a 12-part series about Active Directory Service Interfaces (ADSI) The series started in the January 1999 issue. Refer to previous installments for definitions and background information.

In the previous five articles, I discussed the basics of ADSI and how ADSI works. In the remaining articles, I'll show you how to use ADSI to help you with daily tasks, such as manipulating user accounts, services, shares, and sessions in Windows NT's SAM and Windows 2000's (Win2K's) Active Directory (AD). This month, I show you how to automate two fundamental administrative tasks: creating and manipulating user accounts.

Although tools to create user accounts already exist (e.g., the Microsoft Windows NT Server 4.0 Resource Kit's Addusers utility), ADSI's versatility lets you quickly write a script that creates one or many user accounts and manipulate existing accounts. For example, you can write a script that creates one standard or full-featured user account or a script that creates 1000 full-featured user accounts. You can even create a command-line utility that unlocks locked-out user accounts. . . .

Is there a way to check if a user account exists on Win 2000 to determine if the container::create (username...) is necessary?
 
Charles - Use the SearchAD function from article 5 in the ADSI Primer series (May 1999) to search the AD first using ADO. 
 
Note that September 1999 contained a correction to that article. 
--Alistair

Charles Schmidt March 27, 2001

Can I disable the sAMAccountName property of the user class? When I try to set the sAMAccountName property data to more than 25 characters, it gives me an error like Automation error. Are there other possibilities?
 
Sneha - No, I'm afraid you cannot disable the sAMAccountName. As this MSDN page http://msdn.microsoft.com/library/default.asp?url=/library/en-us/netdir/ad/naming_properties.asp indicates, it's an important property for Win2K servers and needs to be unique on a per-domain basis. It should be less than 20 characters to support downlevel servers and clients. The exact definitions are here: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/netdir/adschema/w2k/A_sAMAccountName.asp 
--Alistair

sneha February 13, 2002

Hi! You mentioned the following in the article: "You can't use VBScript to access all the read-write attributes. For example, ADSI returns the ObjectSID attribute as a byte array. Unfortunately, VBScript understands only variant arrays, which renders the returned data useless. As a result, you must use Perl, Visual Basic (VB), or C++ if you want to use ObjectSID." 
 
I'm trying to search for a specific objectSID using LDAP, and I'm using VB.NET to run the search. Might you have any idea what the objectSID type would be in order to search for that user in the directory (e.g., convert objectSID byte array into a string? or search for the hex alphanumberic values? or something else?). I've been making baby steps in my application and this is possibly the last hurdle. I've attempted a number of things--even hardcoding my objectSID's ASCII value--but nothing worked. Any help would be GREATLY appreciated!
 
Jerermy - If you check MSDN, you’ll find that the Object-SID is described here: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/netdir/adschema/w2k/A_objectSid.asp?frame=true. Its syntax is 2.1.1.17, which according to the page at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/netdir/adschema/w2k/syntaxList.asp is a String(Sid). If you click the String(Sid) link (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/netdir/adschema/w2k/S_String(Sid).asp), you can see String(Sid) is the type ADSTYPE_OCTET_STRING and the variant VT_UI1 | VT_ARRAY. You can find out more from MSDN at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/netdir/adschema/schemahelp.asp. Hope that helps. 
--Alistair

Jeremy April 30, 2002

How can I set a user's UPN from vbscript? I am having a tough go of it! Thanks!

BDakis August 23, 2004 (Article Rating:

)

You must log on before posting a comment.

If you don't have a username & password, please register now.