zimit
Contributor
Contributor

vRO 7.0.1 - Get AD Computer Attributes

Jump to solution

hi all,

I'm trying to retrieve specific attribute of specific AD computer.

I saw that there are api in vRO 7.0.1 but I'm not sure how to use it.

can someone please help with it and show me some examples to achieve this goal?

thank you

1 Solution

Accepted Solutions
SeanKohler
Expert
Expert

Hmmm...

That does not seem to be plugin related.  You have the right mechanism to read the attribute.

Does your VRO service account for the AD plugin have permission to read the attribute in AD?  Are you using shared session user?

pastedImage_3.png

Set-AdmPwdReadPasswordPermission -OrgUnit <name of OU on which you want to delegate the permissions> -AllowedPrincipals <identification of users/groups that should be allowed to read password> LINK

Are there others you cannot read?

View solution in original post

5 Replies
SeanKohler
Expert
Expert

Sure. I will try to remember to put something together tomorrow that explains how to get any attribute on any AD object.

How is your JavaScript?

0 Kudos
zimit
Contributor
Contributor

hi,

My JS is fine...

actually I wrote some JS to retrieve AD_Computer attribute, the issue comes when trying to retrieve specific AD Computer object attribute (Microsoft LAPS attribute named: "ms-Mcs-AdmPwd").

Any other AD computer object attribute shows without any problem...

I must say that when retrieving this attribute with PowerShell, I have no issue an everything is fine.

you can see the script I wrote to retrieve the attribute:

var compObj = ActiveDirectory.getComputerAD(inServerName,attADHost); // Retrieves AD Computer object from AD

if(compObj) // checks if computer found

{

if(compObj.getAttribute(attADCompAttribute)) // checks if has any value in attribute

{

System.log("Computer Attribute Value: " + compObj.getAttribute(attADCompAttribute));

}

else

{

System.log("Attribute '" + attADCompAttribute + "' seems as empty or null");

}

}

else

{

System.log("Computer not found in AD, please try again");

}

0 Kudos
daphnissov
Immortal
Immortal

It's possible the vRO AD plug-in just doesn't store or can retrieve that attribute. I'm not super familiar with LAPS, but some quick reading shows this attribute requires special permissions and not just any account can read it.

SeanKohler
Expert
Expert

Hmmm...

That does not seem to be plugin related.  You have the right mechanism to read the attribute.

Does your VRO service account for the AD plugin have permission to read the attribute in AD?  Are you using shared session user?

pastedImage_3.png

Set-AdmPwdReadPasswordPermission -OrgUnit <name of OU on which you want to delegate the permissions> -AllowedPrincipals <identification of users/groups that should be allowed to read password> LINK

Are there others you cannot read?

View solution in original post

zimit
Contributor
Contributor

thanks a lot!!!

I totally forgot about LAPS permissions

0 Kudos