Page 1 of 1 1
Topic Options
#33613 - 2002-11-27 04:45 PM Access Control Entry's and Kix
cpoyner Offline
Fresh Scripter

Registered: 2002-11-06
Posts: 33
I am trying to use Kix and ADSI to add a group the ability to join an domain when I create the computer account. I'm creating the computer account via ADSI already but I'm having trouble working with the ACE

I found this VB script on the MS website, but I'm not familiar with VB or Kix enough to translate one to the other.

Can anyone pleaes help?

---VB script from Q222525
'*********************************************************************
'* Specify which user or group may activate/join this computer to the
'* domain. In this example, "MYDOMAIN" is the domain name and
'* "JoeSmith" is the account being given the permission. Note that
'* this is the downlevel naming convention used in this example.
'*********************************************************************

sUserOrGroup = "MYDOMAIN\joesmith"

'*********************************************************************
'* Bind to the Discretionary ACL on the newly created computer account
'* and create an Access Control Entry (ACE) that gives the specified
'* user or group full control on the machine account
'*********************************************************************

Set secDescriptor = oComputer.Get("ntSecurityDescriptor")
Set dACL = secDescriptor.DiscretionaryAcl
Set ACE = CreateObject("AccessControlEntry")

'*********************************************************************
'* An AccessMask of "-1" grants Full Control
'*********************************************************************

ACE.AccessMask = -1
ACE.AceType = ADS_ACETYPE_ACCESS_ALLOWED
ACE.AceFlags = ADS_ACEFLAG_INHERIT_ACE

'*********************************************************************
'* Grant this control to the user or group specified earlier.
'*********************************************************************

ACE.Trustee = sUserOrGroup

'*********************************************************************
'* Now, add this ACE to the DACL on the machine account
'*********************************************************************

dACL.AddAce ACE
secDescriptor.DiscretionaryAcl = dACL

'*********************************************************************
'* Commit (write) the security changes to the machine account
'*********************************************************************

oComputer.Put "ntSecurityDescriptor", Array(secDescriptor)
oComputer.SetInfo

Top
#33614 - 2002-12-02 03:48 PM Re: Access Control Entry's and Kix
cpoyner Offline
Fresh Scripter

Registered: 2002-11-06
Posts: 33
I got this far with this problem on my own. I have browsed the board, I have read the manuals. I am just stumped, the only problem I have with the script below is on the lines with "--" at the begining I get the error "IDispatch pointers not allowed in expressions!"

Can anyone help me?

$sContainer="OU=someou,OU=someotherou"
$id="testpc"
$desc="test"
$groupadd="domain\name"

$adsDomain = GetObject("LDAP://" + $sContainer + ",dc=domain,dc=com")
$adsComputer = $adsDomain.Create("computer","cn=" + $id)

$adsComputer.ComputerID="$id"
$adsComputer.Description="$desc"

$descriptor=$adsComputer.Get("ntSecurityDescriptor")
$dACL = $descriptor.DiscretionaryAcl
$ace = CreateObject("AccessControlEntry")
$ace.AccessMask=-1
$ace.AceType = 0
$ace.AceFlags =2
$ace.trustee = $groupadd
$dACL.AddAce $ace
--$descriptor.DiscretionaryAcl = $dACL
--$adsComputer.Put "ntSecurityDescriptor", Array($descriptor)
$adsComputer.SetInfo

Top
#33615 - 2002-12-02 03:50 PM Re: Access Control Entry's and Kix
Sealeopard Offline
KiX Master
*****

Registered: 2001-04-25
Posts: 11165
Loc: Boston, MA, USA
What does the ARRAY() UDF do? You didn't include that one in your code.
_________________________
There are two types of vessels, submarines and targets.

Top
#33616 - 2002-12-02 04:00 PM Re: Access Control Entry's and Kix
cpoyner Offline
Fresh Scripter

Registered: 2002-11-06
Posts: 33
Thats the literal VB code, I couldn't find a way to place an array of values like the access control entities into the computer object, in fact Im still searching right now on how to do this.
Top
Page 1 of 1 1


Moderator:  Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart 
Hop to:
Shout Box

Who's Online
1 registered (Glenn Barnas) and 955 anonymous users online.
Newest Members
Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users

Generated in 0.058 seconds in which 0.028 seconds were spent on a total of 13 queries. Zlib compression enabled.

Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org