Active Directory Cookbook for windows server 2003- P18 ppt

6.8.4 See Also Recipe 6.9 for finding locked out users, Recipe 6.11 for viewing the account lockout policy, MS KB 250873 Programmatically Changing the Lockout Flag in Windows 2000, and

Trang 1

strUserDN = "<UserDN>" ' e.g cn=rallen,cn=users,dc=rallencorp,dc=com strOUDN = "<NewParentDN>" ' e.g ou=Sales,dc=rallencorp,dc=com

' - END CONFIGURATION -

Set objUser = GetObject("LDAP://" & strUserDN)

Set objOU = GetObject("LDAP://" & strOUDN)

objOU.MoveHere objUser.ADsPath, objUser.Name

6.5.3 Discussion

Moving a user object between OUs in the same domain has no direct impact to the actual user The only thing to be cautious of is the impact of moving the user to a new OU that may have different security or GPOs applied to it

6.5.4 See Also

Recipe 4.17 for moving objects between OUs

Recipe 6.6 Renaming a User

6.6.1 Problem

You want to rename a user

6.6.2 Solution

6.6.2.1 Using a graphical user interface

1 Open the Active Directory Users and Computers snap-in

2 In the left pane, right-click on the domain and select Find

3 Type the name of the user and click Find Now

4 In the Search Results, right-click on the user and select Rename

5 You can modify the Full Name, Last Name, First Name, Display Name, User Principal Name (logon name), and SAM Account Name (pre-Windows 2000)

6 Click OK after you are done

6.6.2.2 Using a command-line interface

The following command will rename the RDN of the user:

> dsmove "<UserDN>" -newname "<NewUserName>"

You can modify the UPN (-upn), First Name (-fn), Last Name (-ln), and Display Name ( -display) using the dsmod user command For example, the following command would change the user's UPN and last name:

Trang 2

6.6.2.3 Using VBScript

' This code renames the RDN of a user and the sAMAccountName attribute

' - SCRIPT CONFIGURATION -

strParentDN = "<ParentDN>" ' e.g cn=Users,dc=rallencorp,dc=com

strUserOldName = "<OldUserName>" ' e.g jsmith

strUserNewName = "<NewUserName>" ' e.g jim

set objCont = GetObject("LDAP://" & strParentDN)

objCont.MoveHere "LDAP://cn=" & strUserOldName & "," & strParentDN, _

"cn=" & strUserNewName

set objUser = GetObject("LDAP://cn=" & strUserNewName & "," & strParentDN) objUser.Put "sAMAccountName", strUserNewName

objUser.SetInfo

WScript.Echo "Rename successful"

Renaming a user object can have a couple different meanings in Active Directory In the generic object sense, renaming an object consists of changing the RDN for the object to something else, such as if cn=jsmith became cn=joe Typically, you need to rename more than that with users For example, let's say you had a username naming convention of FirstInitialLastName so Joe Smith's username would be jsmith Let's pretend that Joe decides one day that Smith is way too common and he wants to be more unique by changing his last name to Einstein Now his

username should be jeinstein The following attributes would need to change to complete a rename of his object:

• His RDN should change from cn=jsmith to cn=jeinstein

• His sAMAccountName should change to jeinstein

• His userPrincipalName (UPN) should change to jeinstein@rallencorp.com

• His mail (email address) attribute should change to jeinstein@rallencorp.com

• His sn (last name) attribute should change to Einstein

While this example may be contrived, it shows that renaming Joe Smith to Joe Einstein can take

up to five attribute changes in Active Directory It is also important to note that if you change any of the first three in the bulleted list (RDN, UPN, or SAM Account Name), you should have the user log off and log back on after the changes have replicated Since most applications and services rely on user GUID or SID, which doesn't change during a user rename, the person should not be impacted, but you want to have him log off and back on anyway just in case

6.6.4 See Also

Recipe 4.19 for renaming objects

Trang 3

Recipe 6.7 Copying a User

6.7.1 Problem

You want to copy an existing user account, which may be serving as a template, in order to create a new account

6.7.2 Solution

2 In the left pane, browse to the parent container of the template user object

3 In the right pane, right-click on the user and select Copy

4 Enter the name information for the new user and click Next

5 Enter a password, check any options you want enabled, and click Next

6 Click Finish

' This code copies the attributes in the Attrs array from an

' existing object to a new one

arrAttrs = Array("department","co","title","l", "c", "st")

strParentDN = "<ParentContainer>" ' e.g cn=Users,dc=rallencorp,dc=com strTemplateUser = "<TemplateUserName>" ' e.g template-user-sales

strNewUser = "<NewUserName>" ' e.g jdoe

strPassword = "<Password>"

Const ADS_UF_NORMAL_ACCOUNT = 512 ' from ADS_USER_FLAG_ENUM

Set objTemplate = GetObject("LDAP://cn=" & strTemplateUser & _

"," & strParentDN)

Set objParent = GetObject("LDAP://" & strParentDN)

Set objUser = objParent.Create("user", "cn=" & strNewUser)

objUser.Put "sAMAccountName", strNewUser

objUser.Put "userAccountControl", ADS_UF_NORMAL_ACCOUNT

for each strAttr in arrAttrs

objUser.Put strAttr, objTemplate.Get(strAttr)

objUser.SetPassword(strPassword)

objUser.AccountDisabled = FALSE

objUser.SetInfo

WScript.Echo "Successfully created user"

Trang 4

Copying a user consists of copying the attributes that are common among a certain user base, which can include department, address, and perhaps even organizational information ADUC actually uses attributes that are marked in the schema as "Copied when duplicating a user" to determine which attributes to copy The VBScript solution just used a hardcoded set of attributes

If you are interested in finding the attributes that are configured in the schema to get copied, see Recipe 10.12

In order to copy a user in ADUC, you have to browse to the user object If you locate the user

by using Find instead, the Copy option is not available when right-clicking a user in the search results window

ADSI has a CopyHere method, but it is available only for the NDS provider It was not

implemented for the LDAP provider and so copying a user via a single method is not supported

6.7.4 See Also

Recipe 10.12 for finding the attributes that should be copied when duplicating a user

Recipe 6.8 Unlocking a User

6.8.1 Problem

You want to unlock a locked out user

6.8.2 Solution

2 In the left pane, right-click on the domain and select Find

3 Select the appropriate domain beside In

4 Type the name of the user beside Name and click Find Now

5 In the Search Results, right-click on the user and select Unlock

6 Click OK

' This code unlocks a locked user

Trang 5

set objUser = GetObject("WinNT://" & strDomain & "/" & strUsername)

if objUser.IsAccountLocked = TRUE then

objUser.IsAccountLocked = FALSE

objUser.SetInfo

WScript.Echo "Account unlocked"

else

WScript.Echo "Account not locked"

end if

If you've enabled account lockouts in a domain (see Recipe 6.11), users will inevitably get locked out A user can get locked out for a number of reasons, but generally it is either because a user mistypes his password a number of times, or he changes his password and does not log off and log on again, or has mapped drives

You can use ADSI's IADsUser::IsAccountLocked method to determine if a user is locked out You can set IsAccountLocked to FALSE to unlock a user Unfortunately, there is a bug with the LDAP provider version of this method so you have to use the WinNT provider instead See MS

KB 250873 for more information on this bug

6.8.4 See Also

Recipe 6.9 for finding locked out users, Recipe 6.11 for viewing the account lockout policy, MS

KB 250873 (Programmatically Changing the Lockout Flag in Windows 2000), and MSDN: Account Lockout

Recipe 6.9 Finding Locked Out Users

6.9.1 Problem

You want to find users that are locked out

6.9.2 Solution

The following command finds all locked-out users in the domain of the specified domain

controller:

> unlock <DomainControllerName> * -view

Unlock.exe was written by Joe Richards (http://www.joeware.net/) and can be downloaded from http://www.joeware.net/win32/zips/Unlock.zip

Trang 6

Finding the accounts that are currently locked out is a surprisingly complicated task You would imagine that you could run a query similar to the one to find disabled users, but unfortunately, it

is not that easy

The lockoutTime attribute is populated with a timestamp when a user is locked One way to find locked out users would be to find all users that have something populated in lockoutTime (i.e.,

lockoutTime=*) That query would definitely find all the currently locked users, but it would also find all the users that were locked, became unlocked, and have yet to log in since being unlocked This is where the complexity comes into place

To determine the users that are currently locked out, you have to query the lockoutDuration

attribute stored on the domain object (e.g., dc=rallencorp,dc=com) This attribute defines the

number of minutes that an account will stay locked before becoming automatically unlocked We need to take this value and subtract it from the current time to derive a timestamp that would be the outer marker for which users could still be locked We can then compare this timestamp with the lockoutTime attribute of user objects The search filter to find all locked users once you've determined the locked timestamp would look something like this:

(&(objectcategory=Person)(objectclass=user)(lockoutTime>DerivedTimestamp))

For any users that have a lockoutTime that is less than the derived timestamp, their account has already been automatically unlocked per the lockoutDuration setting

None of the current standard GUI or CLI tools incorporate this kind of logic, but fortunately, Joe Richards wrote the unlock.exe utility, which does And as its name implies, you can also

unlock locked accounts with it as well Thanks, Joe!

6.9.4 See Also

MS KB 813500 (Support WebCast: Microsoft Windows 2000 Server and Windows Server 2003: Password and Account Lockout Features)

Recipe 6.10 Troubleshooting Account Lockout

Problems

6.10.1 Problem

A user is having account lockout problems and you need to determine where it is getting locked from and how it is getting locked out

6.10.2 Solution

Trang 7

LockoutStatus is a new tool available for Windows 2000 or Windows Server 2003 that can help identify which domain controllers users are getting locked out It works by querying the lockout status of a user against all domain controllers in the user's domain

To determine the lockout status of a user

1 Open LockoutStatus and select File Select Target from the menu

2 Enter the target user name and the domain of the user

3 Click OK

At this point, each domain controller in the domain will be queried and the results will be

displayed

The Lockoutstatus.exe tool is just one of many that are available in the new "Account

Lockout and Management" tool set provided by Microsoft These new lockout tools are intended

to help administrators with account lockout problems that are very difficult to troubleshoot given the tools available under Windows 2000 Along with the tool mentioned in the Solution Section, here are a few others that are included in the set:

ALockout.dll

A script that uses this DLL called EnableKerbLog.vbs is included with the tool set that

can be used to enable logging of application authentication This can help identify

applications using bad credentials that are causing account lockouts

ALoInfo.exe

Displays services and shares that are using a particular account name It can also print all the users and their password age

NLParse.exe

Filter tool for the netlogon.log files You can use it to extract just the lines that relate to

account lockout information

All of the new Account Lockout tools can be downloaded from:

http://microsoft.com/downloads/details.aspx?familyid=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

6.10.4 See Also

Trang 8

Recipe 6.11 Viewing the Account Lockout and

Password Policies

6.11.1 Problem

You want to view the account lockout and password policies for a domain

6.11.2 Solution

1 Open the Domain Security Policy snap-in

2 In the left menu, expand Default Domain Policy Computer Configuration

Windows Settings Security Settings Account Policies

3 Click on Password Policy or Account Lockout Policy and double-click the property you want to set or view in the right frame

> enumprop /ATTR:[RETURN]

lockoutduration,lockoutthreshold,lockoutobservationwindow,maxpwdage,minpwdage

,[RETURN]

minpwdlength,pwdhistorylength,pwdproperties "LDAP://<DomainDN>"

' This code displays the current settings for the password

' and account lockout policies

strDomain = "<DomainDN>" ' e.g rallencorp.com

set objRootDSE = GetObject("LDAP://" & strDomain & "/RootDSE")

set objDomain = GetObject("LDAP://" & _

objRootDSE.Get("defaultNamingContext") )

' Hash containing the domain password and lockout policy attributes

' as keys and the units (e.g minutes) as the values

set objDomAttrHash = CreateObject("Scripting.Dictionary")

objDomAttrHash.Add "lockoutDuration", "minutes"

objDomAttrHash.Add "lockoutThreshold", "attempts"

objDomAttrHash.Add "lockoutObservationWindow", "minutes"

objDomAttrHash.Add "maxPwdAge", "minutes"

objDomAttrHash.Add "minPwdAge", "minutes"

objDomAttrHash.Add "minPwdLength", "characters"

objDomAttrHash.Add "pwdHistoryLength", "remembered"

objDomAttrHash.Add "pwdProperties", " "

' Iterate over each attribute and print it

for each strAttr in objDomAttrHash.Keys

Trang 9

value = 0

else

value = Abs(objLargeInt.HighPart * 2^32 + objLargeInt.LowPart)

value = int ( value / 10000000 )

value = int ( value / 60 )

end if

else

value = objDomain.Get(strAttr)

end if

WScript.Echo strAttr & " = " & value & " " & objDomAttrHash(strAttr)

Set objDomPassHash = CreateObject("Scripting.Dictionary")

objDomPassHash.Add "DOMAIN_PASSWORD_COMPLEX", &h1

objDomPassHash.Add "DOMAIN_PASSWORD_NO_ANON_CHANGE", &h2

objDomPassHash.Add "DOMAIN_PASSWORD_NO_CLEAR_CHANGE", &h4

objDomPassHash.Add "DOMAIN_LOCKOUT_ADMINS", &h8

objDomPassHash.Add "DOMAIN_PASSWORD_STORE_CLEARTEXT", &h16

objDomPassHash.Add "DOMAIN_REFUSE_PASSWORD_CHANGE", &h32

' The PwdProperties attribute requires special processing because

' it is a flag that holds multiple settings

for each strFlag In objDomPassHash.Keys

if objDomPassHash(strFlag) and objDomain.Get("PwdProperties") then

WScript.Echo " " & strFlag & " is enabled"

else

WScript.Echo " " & strFlag & " is disabled"

end If

Account lockout duration

Number of minutes an account will be locked before being automatically unlocked A value of 0 indicates accounts will be locked out indefinitely, i.e., until an administrator manually unlocks them

Account lockout threshold

Number of failed logon attempts after which an account will be locked

Reset account lockout counter after

Number of minutes after a failed logon attempt that the failed logon counter for an

Trang 10

Enforce password history

Number of passwords to remember before a user can reuse a previous password

Maximum password age

Maximum number of days a password can be used before a user must change it

Minimum password age

Minimum number of days a password must be used before it can be changed

Minimum password length

Minimum number of characters a password must be

Password must meet complexity requirements

If enabled, passwords must meet all of the following criteria:

• Not contain all or part of the user's account name

• Be at least six characters in length

• Contain characters from three of the following four categories:

o English uppercase characters (A-Z)

o English lowercase characters (a-z)

o Base 10 digits (0-9)

o Nonalphanumeric characters (e.g., !, $, #, %)

Store passwords using reversible encryption

If enabled, passwords are stored in such a way that they can be retrieved and decrypted This is essentially the same as storing passwords in plain text

On a domain controller or machine that has adminpak.msi installed, the Domain Security Policy

snap-in is present from the Start menu under Administrative Tools On a member server, you need to open the GPO snap-in and locate the Domain Security policy See Introduction in

Chapter 9 for more information on GPOs

There is no standard CLI that can be used to modify a GPO, but you can use enumprop to view each of the attributes on the domain object that make up the account lockout and password policy

Định dạng
Số trang	10
Dung lượng	42,81 KB