Active Directory PSO细粒度密码msDS-MaximumPasswordAge

Question

寻找如何创建vbscript来提取PSO策略设置的最大天数。它回归为...的价值，我不知道如何获得设定的真实价值。

这是我到目前为止有：

Option Explicit 

Const ADS_UF_PASSWD_CANT_CHANGE = &H40 
Const ADS_UF_DONT_EXPIRE_PASSWD = &H10000 

Dim strFilePath, objFSO, objFile, adoConnection, adoCommand, objCDOConf 
Dim objRootDSE, strDNSDomain, strFilter, strQuery, adoRecordset, objMaxPwdAge 
Dim strDN, objShell, lngBiasKey, lngBias, blnPwdExpire, strDept, strAdd 
Dim objDate, dtmPwdLastSet, lngFlag, k, address, objAdd, objMessage 

' Check for required arguments. 
If (Wscript.Arguments.Count < 1) Then 
    Wscript.Echo "Arguments <FileName> required. For example:" & vbCrLf _ 
     & "cscript PwdLastChanged.vbs c:\MyFolder\UserList.txt" 
    Wscript.Quit(0) 
End If 

strFilePath = Wscript.Arguments(0) 
Set objFSO = CreateObject("Scripting.FileSystemObject") 

' Open the file for write access. 
On Error Resume Next 
Set objFile = objFSO.OpenTextFile(strFilePath, 2, True, 0) 
If (Err.Number <> 0) Then 
    On Error GoTo 0 
    Wscript.Echo "File " & strFilePath & " cannot be opened" 
    Wscript.Quit(1) 
End If 
On Error GoTo 0 

Set objShell = CreateObject("Wscript.Shell") 
lngBiasKey = objShell.RegRead("HKLM\System\CurrentControlSet\Control\" _ 
    & "TimeZoneInformation\ActiveTimeBias") 
If (UCase(TypeName(lngBiasKey)) = "LONG") Then 
    lngBias = lngBiasKey 
ElseIf (UCase(TypeName(lngBiasKey)) = "VARIANT()") Then 
    lngBias = 0 
    For k = 0 To UBound(lngBiasKey) 
     lngBias = lngBias + (lngBiasKey(k) * 256^k) 
    Next 
End If 

' Use ADO to search the domain for all users. 
Set adoConnection = CreateObject("ADODB.Connection") 
Set adoCommand = CreateObject("ADODB.Command") 
adoConnection.Provider = "ADsDSOOBject" 
adoConnection.Open "Active Directory Provider" 
Set adoCommand.ActiveConnection = adoConnection 

' Determine the DNS domain from the RootDSE object. 
Set objRootDSE = GetObject("LDAP://RootDSE") 
strDNSDomain = objRootDSE.Get("DefaultNamingContext") 

' Filter to retrieve all user objects. 
strFilter = "(&(objectClass=msDS-PasswordSettings))" 

' Filter to retrieve all computer objects.  
strQuery = "<LDAP://CN=PSO-Information Systems,CN=Password Settings Container,CN=System,DC=yrmc,DC=org>;" _ 
    & ";cn,msDS-LockoutDuration,msDS-MaximumPasswordAge,msDS- 

PasswordSettingsPrecedence;subtree" 

    adoCommand.CommandText = strQuery 
    adoCommand.Properties("Page Size") = 100 
    adoCommand.Properties("Timeout") = 30 
    adoCommand.Properties("Cache Results") = False 

Set adoRecordset = adoCommand.Execute 
Do Until adoRecordset.EOF 
    objFile.WriteLine adoRecordset.Fields("cn").Value 
    adoRecordset.MoveNext 
Loop 
adoRecordset.Close 

我可以得到CN和值甚至msDS-PasswordSettingsPrecedence而不是msDS-MaximumPasswordAge。任何帮助，将不胜感激。

Answer 1

这是最好的一个部分的答案，但我做了一些搜索，我相信你会需要以下的一种或多种：

1. DSGet/DSQUERY
2. LDIFDE管理PSO的。
3. 任务的 “Free PowerShell Commands for Active Directory”

使用Quest的免费工具，你可能会发现这个link方便

Answer 2

把平方左右我们的Active Directory的括号属性名称：

查看博客文章"How can I retrieve the value of an active directory attribute that has a hyphen in its name"更多。

Answer 3

你在你的AD像

domainLookupString = ""CN=UsersPSO,CN=Password Settings Container,CN=System,DC=COMPAY,DC=ORG"; 

找到UsersPSO位置，然后在年底运行LDAP查询

ldapFilterString = "(&(objectClass=msDS-PasswordSettings))"; 

，获得与当前的密码最长使用期限的LDAP属性PSO政策

"msDS-MaximumPasswordAge"