vRO 7.0.1 - Get AD Computer Attributes

[zimit]

hi all,

I'm trying to retrieve specific attribute of specific AD computer.

I saw that there are api in vRO 7.0.1 but I'm not sure how to use it.

can someone please help with it and show me some examples to achieve this goal?

thank you

[SeanKohler]

Sure. I will try to remember to put something together tomorrow that explains how to get any attribute on any AD object.

How is your JavaScript?

[zimit]

hi,

My JS is fine...

actually I wrote some JS to retrieve AD_Computer attribute, the issue comes when trying to retrieve specific AD Computer object attribute (Microsoft LAPS attribute named: "ms-Mcs-AdmPwd").

Any other AD computer object attribute shows without any problem...

I must say that when retrieving this attribute with PowerShell, I have no issue an everything is fine.

you can see the script I wrote to retrieve the attribute:

var compObj = ActiveDirectory.getComputerAD(inServerName,attADHost); // Retrieves AD Computer object from AD
if(compObj) // checks if computer found
{
 if(compObj.getAttribute(attADCompAttribute)) // checks if has any value in attribute
 {
 System.log("Computer Attribute Value: " + compObj.getAttribute(attADCompAttribute));
 }
 else
 {
 System.log("Attribute '" + attADCompAttribute + "' seems as empty or null");
 }
}
else
{
 System.log("Computer not found in AD, please try again");
}

[daphnissov]

It's possible the vRO AD plug-in just doesn't store or can retrieve that attribute. I'm not super familiar with LAPS, but some quick reading shows this attribute requires special permissions and not just any account can read it.

[SeanKohler · Accepted solution]

Hmmm...

That does not seem to be plugin related.  You have the right mechanism to read the attribute.

Does your VRO service account for the AD plugin have permission to read the attribute in AD?  Are you using shared session user?

Set-AdmPwdReadPasswordPermission -OrgUnit <name of OU on which you want to delegate the permissions> -AllowedPrincipals <identification of users/groups that should be allowed to read password> LINK

Are there others you cannot read?

[zimit]

thanks a lot!!!

I totally forgot about LAPS permissions

[Vagdeviketha]

Can you please tell me to get ad computer object that if matchs th starting name 

I will be thankful to you if you can help me with this