Active Directory Cookbook for windows server 2003- P10 pps

101
Chapter 4. Searching and Manipulating
Objects
Introduction
Recipe 4.1. Viewing the RootDSE

Recipe 4.2. Viewing the Attributes of an Object
Recipe 4.3. Using LDAP Controls
Recipe 4.4. Using a Fast or Concurrent Bind
Recipe 4.5. Searching for Objects in a Domain
Recipe 4.6. Searching the Global Catalog
Recipe 4.7. Searching for a Large Number of Objects
Recipe 4.8. Searching with an Attribute-Scoped Query
Recipe 4.9. Searching with a Bitwise Filter
Recipe 4.10. Creating an Object
Recipe 4.11. Modifying an Object
Recipe 4.12. Modifying a Bit-Flag Attribute
Recipe 4.13. Dynamically Linking an Auxiliary Class
Recipe 4.14. Creating a Dynamic Object

Recipe 4.15. Refreshing a Dynamic Object
Recipe 4.16. Modifying the Default TTL Settings for Dynamic Objects
Recipe 4.17. Moving an Object to a Different OU or Container
Recipe 4.18. Moving an Object to a Different Domain
Recipe 4.19. Renaming an Object

102
Recipe 4.20. Deleting an Object
Recipe 4.21. Deleting a Container That Has Child Objects
Recipe 4.22. Viewing the Created and Last Modified Timestamp of an Object

Recipe 4.23. Modifying the Default LDAP Query Policy
Recipe 4.24. Exporting Objects to an LDIF File
Recipe 4.25. Importing Objects Using an LDIF File
Recipe 4.26. Exporting Objects to a CSV File
Recipe 4.27. Importing Objects Using a CSV File
Introduction
Active Directory is based on the Lightweight Directory Access Protocol (LDAP) and supports
the LDAP v3 specification defined in RFC 2251. And while many of the AD tools and interfaces,
such as ADSI, abstract and streamline LDAP operations to make things easier, any good AD
administrator or developer must have a thorough understanding of LDAP to fully utilize Active
Directory. This chapter will cover the some of the basic LDAP-related tasks you may need to do
with Active Directory, along with other items related to searching and manipulating objects in
the directory.
The Anatomy of an Object
The Active Directory schema is composed of a hierarchy of classes. These classes support
inheritance, which enables reuse of existing class definitions. At the top of the inheritance tree is
the top class, from which every class in the schema is derived. Table 4-1 contains a list of some
of the attributes that are available from the top class, and subsequently are defined on every
object that is created in Active Directory.
Table 4-1. Common attributes of objects
Attribute Description
cn
Relative distinguished name (RDN) attribute for most object classes
createTimestamp
Timestamp when the object was created. See Recipe 4.22 for more
information
description
Multivalued attribute that can be used as a generic field for storing a
description of the object

103
Table 4-1. Common attributes of objects
Attribute Description
displayName
Name of the object displayed in administrative interfaces
distinguishedName
Distinguished name of the object
modifyTimestamp
Timestamp when the object was last changed. See Recipe 4.22
for
more information
name
RDN of the object. The value of this attribute will mirror the naming
attribute (e.g., cn, ou, dc)
nTSecurityDescriptor
Security descriptor assigned to the object
objectCategory
Used as a grouping mechanism for objects with a similar purpose
(e.g., Person)
objectClass
List of classes from which the object's class was derived
objectGUID
Globally unique identifier for the object
uSNChanged
Update sequence number (USN) assigned by the local server after the
last change to the object (can include creation)
uSNCreated
USN assigned when the object was created
Recipe 4.1 Viewing the RootDSE
4.1.1 Problem

You want to view attributes of the RootDSE, which can be useful for discovering basic
information about a forest, domain, or domain controller.
4.1.2 Solution
4.1.2.1 Using a graphical user interface
1. Open LDP.
2. From the menu, select Connection Connect.
3. For Server, enter a domain controller, domain name, or leave blank to do a serverless
bind.
4. For Port, enter 389.
5. Click OK.
6. The contents of the RootDSE will be shown in the right pane.
4.1.2.2 Using a command-line interface
> enumprop "LDAP://RootDSE"

104
4.1.2.3 Using VBScript
' This code prints the attributes of the RootDSE
set objRootDSE = GetObject("LDAP://RootDSE")
objRootDSE.GetInfo
for i = 0 to objRootDSE.PropertyCount - 1
set strProp = objRootDSE.Item(i)
WScript.Echo strProp.Name & " "
for each strPropval in strProp.Values
WScript.Echo " " & strPropval.CaseIgnoreString
next
next
4.1.3 Discussion
The RootDSE was originally defined in RFC 2251 as part of the LDAPv3 specification. It is not
part of the Active Directory namespace per se. It is a synthetic object that is maintained
separately by each domain controller.

The RootDSE can be accessed anonymously, and in fact, none of the three solutions used
credentials. In the CLI and VBScript solutions, I used serverless binds against the RootDSE. In
that case, the DC Locator process is used to find a domain controller in the domain you
authenticate against. This can also be accomplished with LDP by not entering a server name
from the Connect dialog box.
The RootDSE is key to writing portable AD-enabled applications. It provides a mechanism to
programmatically determine the distinguished names of the various naming contexts among
other things, which means you do not need to hardcode that information in scripts and programs.
Here is an example from LDP when run against a Windows Server 2003-based domain controller:
ld = ldap_open("dc01", 389);
Established connection to dc01.
Retrieving base DSA information . . .
Result <0>: (null)
Matched DNs:
Getting 1 entries:
>> Dn:
1> currentTime: 05/26/2003 15:29:42 Pacific Standard Time Pacific Daylight
Time;

1>
subschemaSubentry:CN=Aggregate,CN=Schema,CN=Configuration,DC=rallencorp,DC=co
m;

1> dsServiceName: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-
Name,CN=Sites,CN=Configuration,DC=rallencorp,DC=com;

5> namingContexts: DC=rallencorp,DC=com;
CN=Configuration,DC=rallencorp,DC=com;
CN=Schema,CN=Configuration,DC=rallencorp,DC=com;
DC=DomainDnsZones,DC=rallencorp,DC=com;

DC=ForestDnsZones,DC=rallencorp,DC=com;


105
1> defaultNamingContext: DC=rallencorp,DC=com;

1> schemaNamingContext: CN=Schema,CN=Configuration,DC=rallencorp,DC=com;

1> configurationNamingContext: CN=Configuration,DC=rallencorp,DC=com;

1> rootDomainNamingContext: DC=rallencorp,DC=com;

21> supportedControl: 1.2.840.113556.1.4.319; 1.2.840.113556.1.4.801;
1.2.840.113556.
1.4.473; 1.2.840.113556.1.4.528; 1.2.840.113556.1.4.417;
1.2.840.113556.1.4.619; 1.2.
840.113556.1.4.841; 1.2.840.113556.1.4.529; 1.2.840.113556.1.4.805;
1.2.840.113556.1.
4.521; 1.2.840.113556.1.4.970; 1.2.840.113556.1.4.1338;
1.2.840.113556.1.4.474; 1.2.
840.113556.1.4.1339; 1.2.840.113556.1.4.1340; 1.2.840.113556.1.4.1413;
2.16.840.1.
113730.3.4.9; 2.16.840.1.113730.3.4.10; 1.2.840.113556.1.4.1504;
1.2.840.113556.1.4.
1852; 1.2.840.113556.1.4.802;

2> supportedLDAPVersion: 3; 2;

12> supportedLDAPPolicies: MaxPoolThreads; MaxDatagramRecv; MaxReceiveBuffer;
InitRecvTimeout; MaxConnections; MaxConnIdleTime; MaxPageSize;

MaxQueryDuration;
MaxTempTableSize; MaxResultSetSize; MaxNotificationPerConn; MaxValRange;

1> highestCommittedUSN: 53242;

4> supportedSASLMechanisms: GSSAPI; GSS-SPNEGO; EXTERNAL; DIGEST-MD5;

1> dnsHostName: dc01.rallencorp.com;

1> ldapServiceName: rallencorp.com:dc01$@RALLENCORP.COM;

1> serverName: CN=DC01,CN=Servers,CN=Default-First-Site-
Name,CN=Sites,CN=Configuration,DC=rallencorp,DC=com;

3> supportedCapabilities: 1.2.840.113556.1.4.800; 1.2.840.113556.1.4.1670;
1.2.840.
113556.1.4.1791;

1> isSynchronized: TRUE;

1> isGlobalCatalogReady: TRUE;

1> domainFunctionality: 0 = ( DS_BEHAVIOR_WIN2000 );

1> forestFunctionality: 0 = ( DS_BEHAVIOR_WIN2000 );

1> domainControllerFunctionality: 2 = ( DS_BEHAVIOR_WIN2003 );
4.1.3.1 Using VBScript

106

All attributes of the RootDSE were retrieved and displayed. Typically, you will need only a few
of the attributes; in which case, you'll want to use Get or GetEx as in the following example:
strDefaultNC = objRootDSE.Get("defaultNamingContext")
Or if want to get an object based on the distinguished name (DN) of one of the naming contexts,
you can call GetObject using an ADsPath:
set objUser = GetObject("LDAP://cn=administrator,cn=users," & _
objRootDSE.Get("defaultNamingContext") )
4.1.4 See Also
RFC 2251, MS KB 219005 (Windows 2000: LDAPv3 RootDSE), MSDN: IADsPropertyEntry,
MSDN: IADsProperty Value, MSDN: IADs::Get, and MSDN: IADs::GetEx
Recipe 4.2 Viewing the Attributes of an Object
4.2.1 Problem
You want to view one or more attributes of an object.
4.2.2 Solution
4.2.2.1 Using a graphical user interface
1. Open LDP.
2. From the menu, select Connection Connect.
3. For Server, enter the name of a domain controller or domain that contains the object.
4. For Port, enter 389.
5. Click OK.
6. From the menu, select Connection Bind.
7. Enter credentials of a user that can view the object (if necessary).
8. Click OK.
9. From the menu, select View Tree.
10. For BaseDN, type the DN of the object you want to view.
11. For Scope, select Base.
12. Click OK.
4.2.2.2 Using a command-line interface
> dsquery * "<ObjectDN>" -scope base -attr *
For Windows 2000, use this command:

> enumprop "LDAP://<ObjectDN>"
4.2.2.3 Using VBScript

107
' This code prints all attributes for the specified object.
' SCRIPT CONFIGURATION
strObjectDN = "<ObjectDN>" ' e.g. cn=jsmith,cn=users,dc=rallencorp,dc=com
' END CONFIGURATION

DisplayAttributes("LDAP://" & strObjectDN)

Function DisplayAttributes( strObjectADsPath )

set objObject = GetObject(strObjectADsPath)
objObject.GetInfo

'Declare the hash (dictionary), constants and variables
'Values taken from ADSTYPEENUM
set dicADsType = CreateObject("Scripting.Dictionary")
dicADsType.Add 0, "INVALID"
dicADsType.Add 1, "DN_STRING"
dicADsType.Add 2, "CASE_EXACT_STRING"
dicADsType.Add 3, "CASE_IGNORE_STRING"
dicADsType.Add 4, "PRINTABLE_STRING"
dicADsType.Add 5, "NUMERIC_STRING"
dicADsType.Add 6, "BOOLEAN"
dicADsType.Add 7, "INTEGER"
dicADsType.Add 8, "OCTET_STRING"
dicADsType.Add 9, "UTC_TIME"
dicADsType.Add 10, "LARGE_INTEGER"

dicADsType.Add 11, "PROV_SPECIFIC"
dicADsType.Add 12, "OBJECT_CLASS"
dicADsType.Add 13, "CASEIGNORE_LIST"
dicADsType.Add 14, "OCTET_LIST"
dicADsType.Add 15, "PATH"
dicADsType.Add 16, "POSTALADDRESS"
dicADsType.Add 17, "TIMESTAMP"
dicADsType.Add 18, "BACKLINK"
dicADsType.Add 19, "TYPEDNAME"
dicADsType.Add 20, "HOLD"
dicADsType.Add 21, "NETADDRESS"
dicADsType.Add 22, "REPLICAPOINTER"
dicADsType.Add 23, "FAXNUMBER"
dicADsType.Add 24, "EMAIL"
dicADsType.Add 25, "NT_SECURITY_DESCRIPTOR"
dicADsType.Add 26, "UNKNOWN"
dicADsType.Add 27, "DN_WITH_BINARY"
dicADsType.Add 28, "DN_WITH_STRING"

for intIndex = 0 To (objObject.PropertyCount - 1)
set objPropEntry = objObject.Item(intIndex)
for Each objPropValue In objPropEntry.Values
value = ""

if (dicADsType(objPropValue.ADsType) = "DN_STRING") then
value = objPropValue.DNString

elseIf (dicADsType(objPropValue.ADsType) = "CASE_EXACT_STRING") then
value = objPropValue.CaseExactString

108
elseIf (dicADsType(objPropValue.ADsType) = "CASE_IGNORE_STRING")
then
value = objPropValue.CaseIgnoreString

elseIf (dicADsType(objPropValue.ADsType) = "PRINTABLE_STRING") then
value = objPropValue.PrintableString

elseIf (dicADsType(objPropValue.ADsType) = "NUMERIC_STRING") then
value = objPropValue.NumericString

elseIf (dicADsType(objPropValue.ADsType) = "BOOLEAN") then
value = CStr(objPropValue.Boolean)

elseIf (dicADsType(objPropValue.ADsType) = "INTEGER") then
value = objPropValue.Integer

elseIf (dicADsType(objPropValue.ADsType) = "LARGE_INTEGER") then
set objLargeInt = objPropValue.LargeInteger
value = objLargeInt.HighPart * 2^32 + objLargeInt.LowPart

elseIf (dicADsType(objPropValue.ADsType) = "UTC_TIME") then
value = objPropValue.UTCTime

else
value = "<" & dicADsType.Item(objPropEntry.ADsType) & ">"

end if
WScript.Echo objPropEntry.Name & " : " & value

next
next
End Function
4.2.3 Discussion
Objects in Active Directory are made up of a collection of attributes. Attributes can be single- or
multivalued. Each attribute also has an associated syntax that is defined in the schema. See
Recipe 10.7 for a complete list of syntaxes.
4.2.3.1 Using a graphical user interface
You can customize the list of attributes returned from a search with LDP by modifying the
Attributes: field under Options Search. To include all attributes enter *. For a subset enter a
semicolon-separated list of attributes.
4.2.3.2 Using a command-line interface
The -
attr option for the dsquery command accepts a whitespace-separated list of attributes to
display. Using a
* will return all attributes.
For the
enumprop command, you can use the /ATTR option and a comma-separated list of
attributes to return. In the following example, only the name and whenCreated attributes would
be returned:

109
> enumprop /ATTR:name,whenCreated "LDAP://<ObjectDN>"
4.2.3.3 Using VBScript
The DisplayAttributes function prints the attributes that contain values for the object passed
in. After using GetObject to bind to the object, I used the IADs::GetInfo method to populate
the local property cache with all of the object's attributes from AD. In order to print each value of
a property, I have to know its type or syntax. The ADsType method returns an integer from the
ADSTYPEENUM enumeration that corresponds with a particular syntax (e.g., boolean). Based on the
syntax, I call a specific method (e.g., Boolean) that can properly print the value. If I didn't

incorporate this logic and tried to print all values using the CaseIgnoreString method for
example, an error would get generated when the script encountered an octet string because octet
strings (i.e., binary data) do not have a
CaseIgnoreString representation.
I stored the values from the
ADSTYPEENUM enumeration in key/value pairs in a dictionary object
(i.e., Scripting.Dictionary). In the dictionary object, the key for the dictionary is the
ADSTYPEENUM integer, and the value is a textual version of the syntax. I used the dictionary object
so I could print the textual syntax of each attribute. I iterated over all the properties in the
property cache using IADsPropertyList and IADsPropertyEntry objects, which are
instantiated with the IADsPropertyList::Item method.

The DisplayAttributes function is used throughout the book in examples
where the attributes for a given type of object are displayed.

4.2.4 See Also
Chapter 19, IADs and the Property Cache, from Active Directory, Second Edition, MSDN:
IADsPropertyEntry, MSDN: IADsPropertyList, MSDN: ADSTYPEENUM, and MSDN:
IADs::GetInfo
Recipe 4.3 Using LDAP Controls
4.3.1 Problem
You want to use an LDAP control as part of an LDAP operation.
4.3.2 Solution
4.3.2.1 Using a graphical user interface
1. Open LDP.
2. From the menu, select Options Controls.
3. For the Windows Server 2003 version of LDP, select the control you want to use under
Load Predefined. The control should automatically be added to the list of Active Controls.

110

For the Windows 2000 version of LDP, you'll need to type the object identifier (OID) of
the control under Object Identifier.
4. Enter the value for the control under Value.
5. Select whether the control is server- or client-side under Control Type.
6. Check the box beside Critical if the control is critical.
7. Click the Check-in button.
8. Click OK.
9. At this point, you will need to invoke the LDAP operation (for example, Search) that will
use the control. In the dialog box for any operation, be sure that the "Extended" option is
checked before initiating the operation.
4.3.2.2 Using VBScript
None of the ADSI automation interfaces directly expose LDAP controls. That means they cannot
be utilized from VBScript. On the other hand, many of the controls, such as paged searching or
deleting a subtree, are wrapped within their own ADSI methods that can be used within
VBScript.
Any LDAP-based API, such as the Perl Net::LDAP modules, can be used to set controls as part
of LDAP operations.
4.3.3 Discussion
LDAP controls were defined in the LDAPv3 specification as a way to extend LDAP and its
operations without breaking the protocol. Many controls have been implemented, some of which
are used when searching the directory (e.g., paged searching, VLV, finding deleted objects, and
attribute scoped query), and some are needed to do certain modifications to the directory (e.g.,
cross-domain object moves, tree delete, and permissive modify). Controls can be marked as
critical, which means they must be processed with the request, or an error is returned. If an
unsupported control is not flagged as critical, the server can continue to process the request and
ignore the control.
The complete list of controls supported by Active Directory is included in Table 4-2
.
Table 4-2. LDAP controls supported by Active Directory
Name OID Description

Paged Results 1.2.840.113556.1.4.319
Instructs the server to return search results in
"pages."
Cross Domain
Move
1.2.840.113556.1.4.521 Used to move objects between domains.
DIRSYNC 1.2.840.113556.1.4.841 Used to find objects that have changed over a