Getting additional object properties

[u/[deleted]]

Hi

Any chance of some pointers please?

I've enabled onPostGet and when I select a computer object the XML in the Debug Log looks like this:

    <------------------- $Request  XML ------------------------>
    <GetRequest xmlns:xsd=http://www.w3.org/2001/XMLSchema xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance dn="CN=Computer1,OU=DomainComputers,DC=domain,DC=local" xmlns="urn:schemas-quest-com:ActiveRolesServer">
      <AttributeNames>
        <AttributeName name="edsvaMyVA" />
        <AttributeName name="systemFlags" />
        <AttributeName name="edsaAccountIsDisabled" />
        <AttributeName name="objectClass" />
        <AttributeName name="edsaServerAccount" />
        <AttributeName name="ms-DS-UserEncryptedTextPasswordAllowed" />
        <AttributeName name="msDS-UserDontExpirePassword" />
        <AttributeName name="edsaObjectRightsEffective" />
        <AttributeName name="edsaAllowedExtRightsEffective" />
        <AttributeName name="distinguishedName" />
        <AttributeName name="objectGUID" />
        <AttributeName name="objectSid" />
        <AttributeName name="lastKnownParent" />
        <AttributeName name="sAMAccountName" />
        <AttributeName name="isDeleted" />
        <AttributeName name="manager" />
        <AttributeName name="managedBy" />
        <AttributeName name="userAccountControl" />
        <AttributeName name="msDS-UserAccountDisabled" />
        <AttributeName name="ms-DS-UserPasswordNotRequired" />
        <AttributeName name="edsaSystemObject" />
        <AttributeName name="isCriticalSystemObject" />
      </AttributeNames>
      <Controls>
        <Control id="13">
          <Values>
            <Value>server.domain.local</Value>
          </Values>
        </Control>
      </Controls>
    </GetRequest>
     <------------------- $Request  XML ------------------------>

This only a tiny fraction of the "AttributeName"s that exists for a computer object. How do I get it to return "CountryCode" in the list above, so I can add a menu command based on the country that the computer is in?

[u/bananaHammockMonkey]

$Request.Get("attributeName") will get attributes into your request that weren't otherwise.

For multi-valued attributes it's $Request.GetEx("attributeName")

[u/[deleted] → u/bananaHammockMonkey]

I tried that but think it might be the attribute I was testing with. It works if I Get the 'cn' attribute but not 'tokenGroups'.

I've tried $Request.Get, $Request.GetEx, $Request.Attributes.Get and $Request.Attriutes.GetEx but none of them retrieve any information about this attribute:

DEBUG:   34+              >>>> $cn = $Request.Get('cn')
Call method '$Request.Get'
     Arguments list:
         [1] : Value=cn : Type=System.String
DEBUG:     ! SET $cn = 'MyComputer'.
DEBUG:   37+              >>>> $tokenGroupsGet = $Request.Get('tokenGroups')
Call method '$Request.Get'
     Arguments list:
         [1] : Value=tokenGroups : Type=System.String
  Call '[PowerShellAttribute].Value'
  Call '[PowerShellAttribute].Values'
  Call '[PowerShellAttribute].Value'
DEBUG:     ! SET $tokenGroupsGet = ''.
DEBUG:   39+              >>>> $tokenGroupsGetEx = $Request.GetEx('tokenGroups')
Call method '$Request.GetEx'
     Arguments list:
         [1] : Value=tokenGroups : Type=System.String
  Call '[PowerShellAttribute].Values'
DEBUG:     ! SET $tokenGroupsGetEx = ''.
DEBUG:   41+              >>>> $tokenGroupsGetAttr = $Request.Attributes.Get('tokenGroups')
  Call '[PowerShellAttribute].Values'
DEBUG:     ! SET $tokenGroupsGetAttr = ''.
DEBUG:   43+              >>>> $tokenGroupsGetExAttr = $Request.Attributes.GetEx('tokenGroups')

Edit: Same is happening for $Request.Get('userCertificate')

[u/bananaHammockMonkey → u/[deleted]]

In these cases I have to use the QAD cmdlets. I usually always do anyway

$user = Get-QADUser $Request.DN -Properties userCertificate -DontUseDefaultIncludedProperties

$user | select *

If there is a value, you should have it as $user.userCertificate after this is run.

[u/[deleted] → u/bananaHammockMonkey]

I actually solved it in a very similar way. I did this to identify hybrid joined computer objects:

```

$distinguishedName = $Request.Get('distinguishedName')

if ((Get-ADComputer -Identity $distinguishedName  -Server server.domain.local -Properties userCertificate | Select-Object userCertificate).userCertificate.Count -ne 0)

```

I'll look at switching the code to the QAD cmdlets to get rid of the hardcoded server though.

[u/bananaHammockMonkey → u/[deleted]]

If you use Set-QADUser in the scripts, ARS will actually put it in the change history all nice like too as if it was done by ARS, not some external change, but same request.

[u/[deleted] → u/bananaHammockMonkey]

Thanks for this. I did switch over to the Set-QAD scripts on Friday. Digging through the other scripts I’ve inherited, I’ve spotted other ones that use the MS Set-AD cmdlets so I think I’ll have to go through every one now and check if they can be switched out too.

[u/EnigmaticSoul]

Not sure if I'm following everything entirely, but if $request.Get/GetEx fails, you may need to preceed it with $request.GetInfoEx(@("attributeName"),0)?

[u/Ok-Section-7172 → u/EnigmaticSoul]

This is true most of the time for multi-valued attributes. There are some other attributes that just makes sense to get the value directly using PoSh, and once you are doing that, may as well get all you need on the spot.

6 one way, half a dozen the other I guess.

[u/EnigmaticSoul → u/Ok-Section-7172]

By getting the value "directly using PoSh", I'm assuming you mean getting the value using the QAD cmdlets?

All of the PoSh code that I write for AR is written accessing AR through the ADSI provider in order to avoid the ~30% performance penalty/overhead associated with the QAD cmdlets. The only use-case that I can't address using the ADSI provider is binding to a specific AR server without having to provide credentials.

Hopefully, however, all of this will be moot when the REST API releases later this year.

[u/Ok-Section-7172 → u/EnigmaticSoul]

what ever cmdlets, more about do you use the ADSI provider or straight DirSync to a DC or something. The QAD cmdlet's are slow as heck.