Perform an AD Search Using Alternate Credentials

Perform a Search Using Alternate Credentials


Microsoft Windows XP - Create a shortcut using runas command parameters

'==========================================================================
'
' VBScript Source File -- Created with SAPIEN Technologies PrimalScript 2007
'
' NAME:
'
' AUTHOR: mike mccafferty , mmcc
' DATE : 12/2/2007
'
' COMMENT: sites of interest
' http://www.windowsitlibrary.com/Content/2026/08/2.html
' using runAs with a shortcut
' http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/windows_security_runas_shortcut.mspx?mfr=true
' ADU&C runas /user:DomainName\administrator "mmc %windir%\system32\dsa.msc"
' ADU&C runas /netonly /user:DomainName\UserName "mmc.exe dsa.msc"
'




'==========================================================================
Sub WMIalternateCreds1()

' From the book "Windows XP Cookbook"
' ISBN: 0596007256

' Note that you cannot use this to connect to the local machine.
' ------ SCRIPT CONFIGURATION ------
strServer = "" ' e.g. wks01
strUser = "" ' e.g. AMER\rallen.adm
strPasswd = ""
' ------ END CONFIGURATION ---------
on error resume next
set objLocator = CreateObject("WbemScripting.SWbemLocator")
set objWMI = objLocator.ConnectServer(strServer, "root\cimv2", _
strUser, strPasswd)
if Err.Number <> 0 then
WScript.Echo "Authentication failed: " & Err.Description
end if

' Now you can use the objWMI object to get an instance of a class
' or perform a WQL query. Here is an example:
colDisks = objWMI.InstancesOf("Win32_LogicalDisk")


End Sub


Sub ADalternateCreds2()
Dim objConn
Set objConn = CreateObject("ADODB.Connection")
objConn.ConnectionString = "Provider=ADSDSOObject;" & _
"User ID=MyUserID;Password=MyPassword;"
objConn.Open

End Sub

Sub ADalternateCreds3()

' You get a choice, you can either
' hard-code the Domain Name (or a Domain Controller Name) only,
' then get the Distinguished Name from Root DSE:
'



Const DOMAIN_NAME = ""

Set objLDAP = GetObject("LDAP:")
Set objRootDSE = objLDAP.OpenDSObject("LDAP://" & DOMAIN_NAME &_
"/RootDSE", strUsername, strPassword)


'Or Hardcode both, and just connect directly to the target container:


Const DOMAIN_NAME = ""
Const CONTAINER_PATH = "OU=SomeOU,DC=SomeDomain,DC=local"

Set objLDAP = GetObject("LDAP:")
Set objRootDSE = objLDAP.OpenDSObject("LDAP://" & DOMAIN_NAME &_
"/" & CONTAINER_PATH, strUsername, strPassword)


' You would have to specify a value for strUsername and strPassword in all cases.
'
' Personally, I favour pulling the Distinguished Name from RootDSE rather than hard-coding it. It just makes things easier to maintain for me.
'
' Chris

End Sub


Sub ADalternateCreds1()
On Error Resume Next

Const ADS_SCOPE_SUBTREE = 2

Set objConnection = CreateObject("ADODB.Connection")
Set objCommand = CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Properties("User ID") = "Administrator"
objConnection.Properties("Password") = "+77m5trgJo!"
objConnection.Properties("Encrypt Password") = TRUE
objConnection.Properties("ADSI Flag") = 1
objConnection.Open "Active Directory Provider"
Set objCommand.ActiveConnection = objConnection

objCommand.Properties("Page Size") = 1000
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE

objCommand.CommandText = _
"SELECT Name FROM 'LDAP://dc=fabrikam,dc=com' WHERE objectCategory='user'"
Set objRecordSet = objCommand.Execute
objRecordSet.MoveFirst

Do Until objRecordSet.EOF
Wscript.Echo objRecordSet.Fields("Name").Value
objRecordSet.MoveNext
Loop

end sub