使用 LDAP 列出所有密码设置对象 (PSO)

Question

我应该如何继续获取特定域上的所有活动 PSO。

我知道该域包含以下 PSO：

CN=PSO-Standard
CN=PSO-Sensitive

但我必须创建一个报告来显示它们，因此我必须以动态方式加载它们。

我猜想有一种过滤器可以获取 PSO 容器，然后循环遍历其记录集。

例如，

.filter = "(CN=Password Settings Container)"

.attributes = "msDS-PasswordSettingsContainer"

提前致谢。

使用经典的 ASP 和 VBScript

Answer 1

您正在寻找的过滤器是：“(objectClass=msDS-PasswordSettings)”

这是一个要测试的示例 Vbscript：

'==========================================================================
'
' NAME: SearchPSO.vbs
'
' AUTHOR: JPB , Silogix
' DATE  : 29/06/2011
'
' COMMENT: 
'
'==========================================================================
Option Explicit
Dim machine
Dim oRootDSE ' Root Directory Service Specific Entry
Dim DomainContainer ' The Roor of the Domain
Dim conn ' ADODB connexion
Dim ldapBase ' Base DN of the search
Dim ldapFilter ' Search filter
Dim ldapAttributes ' Attributs to get
Dim ldapScope ' Search scope
Dim ldapStr ' String to execute
Dim rs ' Search result
Dim f '
Dim oADSI ' ADSI access


' ADODB cooking
machine = "WM2008R2ENT"
Set oRootDSE = GetObject("LDAP://"&machine&"/"&"RootDSE")
DomainContainer = oRootDSE.Get("defaultNamingContext")

Set conn = CreateObject("ADODB.Connection")
conn.Provider = "ADSDSOObject"
conn.Properties("User ID") = "jpb"
conn.Properties("Password") = "test.2011"
conn.Properties("Encrypt Password") = True

conn.Open "ADs Provider"

' Building the request to exécute
ldapBase = "<LDAP://" & machine &"/"& DomainContainer & ">" 
ldapFilter = "(objectClass=msDS-PasswordSettings)"
ldapAttributes = "cn,msDS-LockoutDuration,msDS-MaximumPasswordAge"
ldapScope = "subtree"
ldapStr = ldapBase&";"&ldapFilter&";"&ldapAttributes&";"&ldapScope

' Search request execution
Set rs = conn.Execute(ldapStr)

' Restitution du résultat
While Not rs.EOF
  'For each f in rs.Fields
  '  WScript.Echo f.Name & ":" & f.Value
  'Next
  WScript.Echo rs.Fields("cn").Value
  rs.MoveNext
Wend