高手今天都很忙吗
. x# f' b3 M4 `# P" @- }) u* f偶把现在查找的脚本放上来给大家看看.
, L- Y; B1 z3 i' ?( Q- p
7 h5 K1 x2 N1 I) `4 ~'Modified for US Date format m/d/y, file name ? still a problem
! V* V* {+ M ~ M- E9 F5 R
'Modified for disabled new account Notlogon and disabled >= 90 days
/ }) _8 ?4 |( d% P1 v
'Modified for new account not logon >= 30 days and not disabled
! {# v& |$ o; F! C+ _" B
. \" d7 ^0 L0 X& @3 @) j/ `( ~'ODD Users: disabled but not listed, sovled by using "m/d/y" format for condition
" v, H& _) G' F! g
- w3 B" ~) p/ q0 ^. w$ i& k'********************
* V6 L3 ~& [$ T* _" H, L
'* Define Constants *
4 ~9 I* x& l1 l' B2 V9 K, G
'********************
: t3 T+ N5 D0 W; C
Const MgmtDel = -90 'disabled or not logon for XX days, old account!
2 t6 R; T+ ^+ l( w& `Const MgmtDis = -30 'not logon for XX days, new account!
* V% B; z3 I4 w/ q+ |" ]
Const ADS_PROPERTY_APPEND = 3
& N5 D. b# B3 v' u! ^- @" {: s
Const ADS_NAME_TYPE_NT4 = 3
# Z0 K! l5 T$ W8 q* m }* W
Const ADS_NAME_TYPE_1779 = 1
- B/ i( Z5 X3 N2 n% ?
% b+ B4 a+ j$ \) C) D1 W'*********************
1 O2 ?/ V) |7 X( s
'* Declare Variables *
o# @- w1 m1 R6 k! s( M. E) n'*********************
0 @/ j$ k- P) x; q. h
Dim expDate 'expiration date
* q7 u& l; _% b7 {' y2 \1 q/ E8 w6 ~! JDim createDate 'account first created
: h7 J& p* J) ]( F
Dim lastLogDate 'account last logon date
* U5 [8 j4 F2 @' d0 ^- o
Dim lastmodDate 'last modified date
( c7 O; k8 j; _3 Z6 wDim accDisabled 'if account disabled, 514 for disable, 512 for enable
5 g- R, P5 @0 JDim mFile
+ w) M0 ^$ z7 n! s @
Dim WshShell
* `# h! t8 I; G- w9 W; A- H
Dim strFilter
- a# K+ [. {6 x& t1 v$ }- y# i
Dim strAttributes
b# A |8 @5 ] |- C
Dim strQuery
+ a0 d K) }2 |9 ]& _Dim objRootDSE
* x. ]" s1 J# `% K m# IDim strDNSDomain
, C7 r: i; z, T& h2 _. L. zDim objCommand
* b2 I1 M2 A. H$ {6 s
Dim objConnection
" E0 M( O9 J1 N9 N9 ~
Dim MyArr
6 y# @8 A. V8 I
Dim Upper
& _0 H' E2 @+ [
Dim strUserNTName
( P5 e1 }, O; a' ~7 B) g9 QDim objTrans
2 p, R; G8 I' f" G" u9 T4 `% N* N, D
Dim strNetBiOSDomain
, h* V; c% [. b4 z, I
Dim strUserDN
. o. K& h* m7 {
Dim objDate
' @8 h0 g) K% x; [1 \
# C4 s: [9 a) c: a+ X7 r
'*********************
/ `7 K8 Y5 F8 p4 R'* Get Required Info *
/ A/ R% x c6 y6 I; k
'* and Build Outputs *
9 b3 ^7 \ o; i5 ]# R! y
'*********************
5 L" x9 o) C0 u! A+ Z' Determine DNS domain name.
) ~* i! Y5 D4 X$ o" J- ?Set objRootDSE = GetObject("LDAP://RootDSE")
; L/ G4 g0 G9 K! d7 R* d& y; Z
strDNSDomain = objRootDSE.Get("defaultNamingContext") 'domain DNS name
- C8 B$ v: r5 l0 B4 ]7 ?: W+ rstrNetBiOSDomain = "ASIA_RRD_COM" 'domain NetBIOS name
* t5 j, w/ O Y& O! ^! |& u6 @
Set fso = CreateObject("Scripting.FileSystemObject")
9 J* H# z K, DSet mFile = fso.CreateTextFile("./" & strNetBiOSDomain & "-UserManage-" & Year(Date) & "-" & Month(Date) & "-" & Day(Date) & ".txt")
w) v0 a5 E' q$ l
mFile.Writeline("UserName,AccountType,SinceCreated,SinceLastModified,SinceLastLogon,Actions")
' s/ v( ]( M- X, v9 H* E# T$ Z'******************
9 r8 o% X, a! F/ e2 z'* Search the Domain * SHOULD USE ADO LDAP to support timestamp attr
4 V; V {. |% r
'******************
+ m/ G4 G6 C+ _, {6 {! [8 _' Use ADO to search Active Directory.
4 `0 w9 T% ^. r7 g5 e' V8 d Set objCommand = CreateObject("ADODB.Command")
8 F( W% u+ b9 Z9 H. J( ^ Set objConnection = CreateObject("ADODB.Connection")
2 f1 e4 P! p& W2 B
objConnection.Provider = "ADsDSOObject"
( R9 O* M& z; }% L4 b
objConnection.Open "Active Directory Provider"
. `1 j4 G/ G4 i$ Z& u3 u+ e! ~ objCommand.ActiveConnection = objConnection
1 t% O/ P+ O: g/ y# J( G strBase = "<LDAP://" & strDNSDomain & ">"
# M! [( ^1 H; U+ D f
strFilter = "(&(objectCategory=person)(objectClass=user))"
$ _; J( |/ [8 i, U4 i9 q9 Z4 q
strAttributes = "givenName,sn,sAMAccountName,name,displayName,userPrincipalName,whenCreated,lastLogon,whenChanged,userAccountControl"
8 _) u9 S1 c# n! r& B- w
strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
3 O. B% V, a F# } objCommand.CommandText = strQuery
" W+ q& S" j& B' Q' V
objCommand.Properties("
age Size") = 20
( q4 g$ m0 A' b
objCommand.Properties("Timeout") = 30
4 I6 u0 W5 X9 v5 q objCommand.Properties("Cache Results") = False
% }# b4 Y$ l. K: t+ P9 E) R
objCommand.Properties("Sort On") = "sAMAccountName"
4 t1 d7 h( |6 k2 ?# U7 x
Set objRecordSet = objCommand.Execute
+ f* r, H$ |. c/ a
Set objRecordSetArr = objCommand.Execute
; L4 V. g1 Y# V, A4 }; F
9 E c! T; L8 e5 f* K
If objRecordSet.EOF Then
8 b- a" x; \6 {7 J6 c+ N Wscript.Echo "No user found!!"
3 q9 r! b, D' u9 u
End If
9 e+ H% \8 H4 _5 B c% C* n5 _( W! j `" v9 |7 y9 g/ m! Y- N
'if user exists, then run search
+ b8 I% A% o& {: V2 ~) | '****************************
( v9 {" V, T: v' h( C! ^ '* Start Loop to find Users *
2 v2 }' g2 y& J8 O% ^5 x+ S '****************************
1 P) z* }; v% E; J7 H5 u. c" V Do Until objRecordSet.EOF
% s& O. z+ n. i9 i- l- S2 W# y. l! @" I/ \' ~( ^7 e ~
strUserNTName = objRecordSet.Fields("sAMAccountName").Value
0 F: z% R7 M* R8 N& `
, l6 ~$ P8 P& \7 n: v$ @7 j5 { 'Wscript.echo strUserNTName
0 \ J, O! \4 b9 O2 i) X Set objTrans = CreateObject("NameTranslate")
# d2 h7 w# X8 j7 B0 w3 y, r! C, Y
objTrans.Set ADS_NAME_TYPE_NT4, strNetBiOSDomain & "\" & strUserNTName
9 Q9 e8 {8 r$ m! o" s' G
5 \- H0 B1 \* t2 B( L strUserDN = objTrans.Get(ADS_NAME_TYPE_1779)
/ q: T2 [# }1 C/ _7 j$ v6 [. I2 T) H9 Z
' Bind to the user object in Active Directory with the LDAP provider.
P3 W, c7 y% w/ l- r
'On Error Resume Next
4 S5 j+ \3 L: y# L6 i& ~ If InStr(strUserDN,"SystemMailbox") = False Then
! Z- }$ V8 y6 Z+ v( }$ K
'MsgBox "bingo!"
# K& s' p6 N5 h8 P$ D Set objUser = GetObject("LDAP://" & strUserDN)
& y* t, x. }8 Q' R( s' r3 i& [$ j! w objUserNULL = 0 'False for non-exchange systemMailbox account
* R9 X [. v x! x Else
7 w# p8 f+ q4 E objUserNULL = 1 'true for exchange systemMailbox account
& u3 f+ r7 m$ D: i1 Z0 V End if
R% B$ r' a* M! |& m! j u; N
! {# F! z& ^, J 'Reset counter values
y# o4 |4 a2 H& u newAccountCreate = 0
0 M! m I; I' |/ t' T9 w% y* v/ \ accountLastLogon = 0
8 Z: u1 i% W" b' G I: w- [; P accountLastMod = 0
- G" v3 {- r6 r/ S% G accDisabled = 0
; f5 b9 G" f- b# K0 _3 M0 M
- c4 |/ M7 z9 i# n: P; m H
'************************************
- N9 o# v S1 U! X' j1 U* |! N
'* Calculate the difference between *
$ l4 r2 _" M0 J7 H '* now and the expiration date. date value xxxx-xx-xx can only be used with date functions!!! or converted by Integer8Date() *
7 Y. @3 K7 s9 X% _ '************************************
# L7 G+ l5 _" O# H7 `7 J6 \$ ? 'MsgBox strUserDN
9 f1 T3 N/ N7 Q b$ G9 H
If objUserNULL = 0 Then 'not a exchange system account
5 I( @8 \ C1 o2 ~& q- ~
6 `8 y1 |$ T2 Y* j+ u: u& L
'Wscript.Echo objUser.lastLogon
8 Y2 i4 _( E( Q, _& P ) {! H# F$ _) m; R
accDisabled = objUser.userAccountControl 'enabled(512)? disabled(514)?password never expire(66048)
6 a, |6 u3 q$ w) f. C% V
If IsEmpty(objUser.lastLogon) = False Then 'check if objUser.lastLogon exists, can be NOT Set,0,large integer
9 m) v; h! O1 ^
lastLogDate = Integer8Date(objUser.lastLogon, lngBias) 'lastlogon timestamp, converted to normal Date
9 }% s) I* t1 R
Else
2 x$ K) X0 Z: ~9 x lastLogDate = "1601-1-1" ' for Windows 2003 SP1 AD, lastLogon should be NULL for new user
1 w/ h. B- s+ ]" B! S( O. b5 k End If
, C0 S5 a9 ]; W: P7 |- _
y5 s$ S9 A# O* Y: e 'msgbox lastLogDate
/ |# b; Z0 a0 z; O
newAccountCreate = DateDiff("d",now,objUser.whenCreated) 'since first created, days?
, g9 z: M/ k3 \& K* I9 u$ V
- [( w( R: T- l If CStr(lastLogDate) <> "1601-1-1" And CStr(lastLogDate) <> "1/1/1601" Then 'new user last logon time should be like 1601-1-1
& m6 F% D! N3 |2 G
accountLastLogon = DateDiff("d",now,lastLogDate) 'since last logon, days? CAN BE 0 DAYS
- d3 T- X1 d5 A/ i% O
Else
3 ~% V& L4 Y2 x/ a" o& Q% D9 g
accountLastLogon = -36500 'Never logon to AD, should not be longer than 100 years
' q o: T2 ]+ M c6 G; K End If
5 M3 }3 ?. V a; R/ [2 Y6 F ' j! g0 K; D3 n |0 E' D! H! p
accountLastMod = DateDiff("d",now,objUser.whenChanged) 'since last changed, days?
+ l! h# @, B( x* b3 Y7 O & \5 f& }6 `2 J' A4 I
'MsgBox Objuser.sAMAccountName&"----"&newAccountCreate & "--" & accountLastMod & "--" & accountLastLogon
3 s7 Q' F& q( n# X4 \
. v- n7 j9 p/ }! v7 x '******************
* p2 q. B3 p% U* ?. Q '* Newly Created users (exists 30days) that already be disabled (and not modified for 30 days) should be deleted, >30 days*
- @, d- z: F3 u: T4 b6 e
'******************
* [% N# g& J4 |6 b: r If (newAccountCreate <= MgmtDis And accountLastMod <= MgmtDis And (CStr(lastLogDate) = "1601-1-1" Or CStr(lastLogDate) = "1/1/1601") And (accDisabled = 514 Or accDisabled = 66050)) Then
9 q7 Y% _ Y8 D$ S2 H5 Y1 @4 j
mFile.Writeline(Objuser.sAMAccountName & ", [[Disabled NEW Account]," & newAccountCreate*(-1) & "," & accountLastMod*(-1) & "," & accountLastLogon*(-1) & ", Account Should be deleted!!")
. M8 s6 _. w! A k 'MsgBox Objuser.sAMAccountName & ", [Disabled NEW Account], Account Should be deleted!!"
. k* h* F3 p- [- T) F4 ?, P/ i
End If
1 e, t1 {0 Y2 }7 Y. S: U4 K a2 H: V; M
'******************
8 B1 E; Y4 I+ f& S
'* Newly Created users that should be disabled, >30 days not logon*
( l+ Z" C0 _* _9 g! X, P' ^9 |5 L
'******************
8 ?3 H: |) K( R9 N( j1 o If (newAccountCreate <= MgmtDis And (CStr(lastLogDate) = "1601-1-1" Or CStr(lastLogDate) = "1/1/1601") And (accDisabled <> 514 And accDisabled <> 66050)) Then
6 l: m/ D" b* f. D! c
mFile.Writeline(Objuser.sAMAccountName & ", [NEW Account]," & newAccountCreate*(-1) & "," & accountLastMod*(-1) & "," & accountLastLogon*(-1) & ", Account Should be disabled!!")
# B$ D* P7 C/ H0 P6 f$ D2 T( z
'MsgBox Objuser.sAMAccountName & ", [NEW Account], Account Should be disabled!!"
1 X$ M% X3 v8 c! T# W* [
End If
# e! q+ n% r" o& v6 H: e q: e( c # U- c" S0 b4 j2 D9 H. G2 t2 A/ M
If accountLastLogon <> -36500 And accountLastLogon <> -148042 Then
2 o3 U( E+ l( V3 m1 k5 c) h7 P# H '******************
5 l( ]/ e. `* D) A
'*users not used that should be disabled, >90 days not logon*
- g8 o& z5 R, @- @$ g" c6 l '******************
* Z7 M5 L* Y: p% {3 C# Z- f If (accountLastLogon <= MgmtDel And (accDisabled = 512 Or accDisabled = 66048)) Then 'when pwd never expire, 66048
5 ^' A' e0 g% g# w, `- `/ i mFile.Writeline(objUser.sAMAccountName & ", [Old Account]," & newAccountCreate*(-1) & "," & accountLastMod*(-1) & "," & accountLastLogon*(-1) & ", Account Should be disabled!!")
9 A& l& m; _5 s5 x- K; d$ P( w
objUser.AccountDisabled = True
1 q3 G9 g1 z6 @" M5 j" `6 k 'MsgBox objUser.sAMAccountName & ", [Old Account], Account Should be disabled!!"
4 Z6 c. q( j9 G& V. U9 ~: }5 `2 d- _! F End If
0 v! ^9 t: v2 c0 e2 k3 c 9 F# j- O- H3 o& u, x/ O( L! Q
'******************
8 g4 @1 I1 X. e K0 Z: a
'* users disabled that should be deleted, >90 days not enabled again*
7 Z5 l& |) {4 M: H. l '******************
# s" z! v+ m7 T' b* w' s' b# [8 N2 z If (accountLastMod <= MgmtDel And (accDisabled = 514 Or accDisabled = 66050)) Then 'when pwd never expire, 66050
$ u% G% M L* x) R7 Z. \4 I
mFile.Writeline(objUser.sAMAccountName & ", [Disabled Account]," & newAccountCreate*(-1) & "," & accountLastMod*(-1) & "," & accountLastLogon*(-1) & ", Account Should be Deleted!!")
# O2 ?0 I$ e0 g9 j+ ?5 T objUser.AccountDisabled = True
. G- w# o# L7 v8 q* p 'MsgBox objUser.sAMAccountName & ", [Disabled Account], Account Should be Deleted!!"
4 z; n) f! J- t. M1 o% a
End If
4 C9 `. J1 W3 H
- F% }6 c- x [0 i& ~
( \+ q! Q" a& b1 O1 ^+ y7 H, R4 { End If
* d' p* e+ m* F) U1 | End If
6 \: L3 m9 a6 ~9 i( G4 t1 I$ Z" p* F( G 0 F5 t+ D4 g) V6 j5 a9 H. i: i
' If accountLastMod = -945 Then
+ o7 x8 I# V8 N: \( ?: c7 d' i ' objUser.AccountDisabled = True
, x/ w8 }* t1 N5 x1 ]0 K ' objUser.SetInfo
0 F! i; J4 ~. Y& Z8 d7 r0 l1 c y ' End If
& `1 I6 H$ l8 z3 c% D4 O$ @
) @0 _$ f* S7 K4 F objRecordSet.Movenext
% r5 G+ u/ }( O( }! K: h N, K Loop
, p0 u) b4 h1 }& B i'Next
( |3 V/ r5 ~" r5 S4 ^6 Y
+ a1 C" g% q& j4 T9 c'******************************************
& j9 K! a+ U5 {
'* Clean up open files and send log files *
j& _& \9 }8 h; X) M2 L
'******************************************
+ ?2 a' O: r; N6 D8 \2 G- ~' u
'*******************
( I& N5 b; h( |! ]& o'* Close all Files *
% q( }- L7 [1 s
'*******************
- d5 V/ C t7 ?" F9 m; q8 D
mFile.close
3 t8 u; n9 R# T/ m
" f, {$ c) d4 b4 ?* y'****************
, }2 X& j) H% }
'* Delete Files *
2 t" A1 Z- ?0 e
'****************
: P5 e! ]+ T2 w: x5 \, ^& W
'fso.DeleteFile(mFile)
# B: V! j5 s$ h2 U% R
'fso.DeleteFile(uFile)
- J) H2 q' u) r6 s/ e6 g8 K'fso.DeleteFile(wFile)
; f( l1 g% x& S+ ~/ S
'*******************
h$ L$ f+ ?8 a* ^) B6 S. E; R
'* Quit the Script *
k) z0 p9 @9 ^7 U'*******************
6 Q; |( F( C x- a: D9 c# GMsgBox "Searching for invalid users done!!"
+ G' V& v% V0 IWScript.Quit(1)
# E& z2 X M) p0 n: }& p9 S8 u: W& \) J
0 l7 @8 J, y" M2 y
'*******************
- d; E6 p$ h' a
'Functions
5 x6 Y; U4 n( a1 Z& S3 A; o
'*******************
6 a8 L. ]6 { w% m% d! e
Function Integer8Date(objDate, lngBias)
1 A' o) U/ a. ^4 I; [' Function to convert Integer8 (64-bit) value to a date, adjusted for
- D' c0 g$ x5 C4 b
' local time zone bias.
) x) L1 h) Q% k$ `' i; G Dim lngAdjust, lngDate, lngHigh, lngLow
1 B* R; \# v+ v lngAdjust = lngBias
9 ~: `5 R( X) I, p) A4 v lngHigh = objDate.HighPart
, ?1 c) X! j/ o0 y/ Z5 X
lngLow = objdate.LowPart
" Y& k/ `" C5 }5 j# p( p
' Account for bug in IADslargeInteger property methods.
/ y! H) C S* Y5 S3 { If lngLow < 0 Then
$ @! o) m/ ] y) U
lngHigh = lngHigh + 1
) [) R- a* z7 S/ F1 Z
End If
- Y# F5 |( S7 J1 L' M$ j. i& S If (lngHigh = 0) And (lngLow = 0) Then
$ y/ L4 V' I A
lngAdjust = 0
4 Z* @5 u+ P& Q! M, a E
End If
5 ~) l0 a4 b4 a" X' m7 r+ e! Z lngDate = #1/1/1601# + (((lngHigh * (2 ^ 32)) _
5 @- _9 b- j0 x5 V& T( F
+ lngLow) / 600000000 - lngAdjust) / 1440
/ v* H2 M1 m% P5 ?) t W Integer8Date = CDate(lngDate)
* b* e( f1 d* M4 e& S
End Function
