I work in a network that contains a single forest made
up of many Active Directory (AD) domains. I need to verify that a user account
exists and in what domain it exists. I know I can use Active Directory Users
and Computers to find an account. How can I script this task instead?
You can accomplish this task by writing a script that queries a global catalog
server in your forest. Because each global catalog server in a forest contains
a partial replica of all objects in all domains within the forest, it's the
best place for locating AD objects such as user accounts. Listing
1, shows how you can use the ADSI OLE DB provider to search a global catalog
server in a forest for a user account whose common name (cn attribute) begins
with the letters eth. To make this script a bit more dynamic, I bind to the
rootDSE object.
The rootDSE object contains the base Directory System Agent (DSA) information
from any domain controller in the domain. DSA information includes data such
as the current DNS host name and the various naming contexts in an AD implementation,
such as the default schema, and configuration naming contexts. The code at callout
A in Listing 1 demonstrates how to bind to
the rootDSE, retrieve values from this object (in this case, the script retrieves
the distinguished name of the forest, which is stored in the rootDomainNamingContext),
and create a variable containing an AdsPath that uses the GC moniker. The GC
moniker instructs the script to connect to any domain controller serving as
a global catalog server. Under the covers, the GC moniker makes a connection
request by using port 3268, which is the listening port for all AD global catalog
servers. The actual bind operation performs authentication to an available global
catalog server by using the credentials of the currently logged-on user. . . .
)
)
)
)
Commandline used:
finduser.wsf /attrib:displayName=cr*
nitz@pabgames.net November 28, 2006 (Article Rating: