使用 LDAP、vbScript 或 PowerShell 查询活动目录中的所有对象

Question

我希望有人已经开发了一个脚本来执行此操作。

我需要查询 AD 中的所有对象（用户、计算机、容器（OU）、林根目录的所有内容）并显示 AD 中的哪些对象不具有“包括来自该对象父级的可继承权限”属性检查。

非常感谢

Answer 1

如果你表现出一些主动性，我可以在 VBS 中提供帮助。我前段时间写了一个 VBS，通过 LDAP 查询 AD 中的所有内容以获取以下属性，并将结果放入 Excel 和纯文本文件中。

• “对象类别”
• “对象类”
• “objectGUID”
• “objectSid”
• “sIDHistory”
• “sAMAccountName”
• “说明”
• “sAMAccountType”
• “userAccountControl”
• “何时创建”
• “何时改变”
• “给定名称”
• “sn”
• “显示名称”
• “标题”
• “邮件”
• “physicalDeliveryOfficeName”
• “成员”
• “电话号码”
• “移动”
• “寻呼机”
• “公司”
• “上次登录”
• “badPwdCount”
• “错误密码时间”
• “街道地址”
• “l”
• “邮政编码”
• “圣”
• “合作”

我将向您展示我的前 50/360 行代码：

Const ADS_SCOPE_SUBTREE = 2
Const PageSize = 2000
Const GAP = "——————————————————————————————————————————————————"
'=== Public Variables ===
Dim aADProp, sRootLDAP, oRecordSet, oFSO, oLogFile, oExcel, oWB, oWS
Dim lObjects, lComputersEnabled, lUsersEnabled, lComputersDisabled, lUsersDisabled, lOtherDisabled, lExcelRow
Dim aUAC ' AD's UserAccountControl flags array
Dim aSAT ' AD's sAMAccountType flags array

'==================================================
Main
'==================================================
Sub Main
    Init
    ConnectAD
    If Err.Number = 0 Then ProcessRecords
    CleanUp
End Sub
'--------------------------------------------------
Sub Init
    Dim dNow
    dNow = Now
    Wscript.echo dNow & vbTab & "Init"
    DefineADProp
    DefineUACArray
    DefineSATArray
    Set oFSO = CreateObject("scripting.filesystemobject")
    Set oLogFile = oFSO.CreateTextFile(WScript.ScriptFullName & "_" & Join(Array(Year(dNow),Month(dNow),Day(dNow)),".") & ".log")
    sRootLDAP = "'LDAP://" & GetObject("LDAP://RootDSE").Get("defaultNamingContext") & "'"
    LogT vbCrlf & Q(WScript.ScriptFullName) & " started."
    Logg "RootLDAP: " & sRootLDAP
    Logg "Listing AD Attributes: " & Join(aADProp,", ")
    Logg GAP
    lObjects = 0
    lUsersEnabled = 0
    lUsersDisabled = 0
    lComputersEnabled = 0
    lComputersDisabled = 0
    lOtherDisabled = 0
    If Err.Number = 0 Then
        lExcelRow = 1
        Set oExcel = CreateObject("Excel.Application")
        oExcel.visible = True
        Set oWB = oExcel.Workbooks.Add
        Set oWS = oWB.Worksheets(1)
        oWS.Cells(lExcelRow,1) = "distinguishedName"
        oWS.Range(oWS.Cells(lExcelRow,2),oWS.Cells(lExcelRow,UBound(aADProp)+2)) = aADProp
    End If
End Sub

Answer 2

是的，我犯了一个错误，最初没有发布问题。当我最初发布时，我无法枚举所有 AD 对象并且对此有疑问，但它已经得到解决并且下面的代码有效（以防其他人需要它 - 共享是可以的）。如果代码已经存在，则无需尝试重​​新发明轮子。非常感谢Rems @ Petri

    '
    '//----------------------------- Code below -----------------------------//
    '

    Const SE_DACL_PROTECTED = &H1000

    Dim objRootDSE

    With WScript.CreateObject("WScript.Network")
       Set objRootDSE = GetObject ("LDAP://" & .UserDomain & "/RootDSE")
    End With

    strDomainDN = objRootDSE.Get("DefaultNamingContext")

    Set objCommand = CreateObject("ADODB.Command")
    Set objConnection = CreateObject("ADODB.Connection")

    objConnection.Provider = "ADsDSOObject"
    objConnection.Open "Active Directory Provider"

    objCommand.ActiveConnection = objConnection
    objCommand.Properties("Searchscope") = 2 ' SUBTREE
    objCommand.Properties("Page Size") = 250
    objCommand.Properties("Timeout") = 30
    objCommand.Properties("Cache Results") = False
    objCommand.CommandText = "SELECT ADsPath FROM 'LDAP://" & strDomainDN & "'"

    Set objRecordSet = objCommand.Execute

    On Error Resume Next
    If Not objRecordSet.eof Then 
       objRecordSet.MoveFirst

       Do Until objRecordSet.EOF
         ModUser objRecordSet.Fields("ADsPath").Value
         objRecordSet.MoveNext
       Loop
    End If
    objRecordset.Close : objConnection.Close

    wscript.echo vbCrLf & "-- All done --" : wscript.quit 0

    Sub ModUser(strADsPath)
       Dim objUser, objNtSecurityDescriptor, intNtSecurityDescriptorControl

       Set objuser = GetObject(strADsPath)

       Set objNtSecurityDescriptor = objUser.Get("ntSecurityDescriptor")
       intNtSecurityDescriptorControl = objNtSecurityDescriptor.Control

       If (intNtSecurityDescriptorControl And SE_DACL_PROTECTED) Then
        Wscript.Echo objUser.sAMAccountName & " (" & objUser.distinguishedName & ") is NOT checked"
       End If
    End Sub