Active Directory - Get object dataset

Declaration

<AMACTIVEDIRECTORY ACTIVITY="get_object_dataset" AUTHTYPE="text (options)" 
USERNAME="text" 
PASSWORD="text (encrypted)" 
LDAPPATH="text" 
RESULTDATASET="text" />

Creates a dataset that contains all the properties of the specified Active Directory object (e.g., user, group, computer, etc.). Each property of the object becomes a column of the dataset, with the first row containing the property value.

IMPORTANT: Active Directory activities require a basic understanding of Active Directory and related components (e.g., Domain Controllers, Trust Relationships, Forests, LDAPs, etc.). Also, to ensure that these activities function appropriately, the target system must be part of a domain.

Practical Usage

Used to retrieve the properties of a specific Active Directory object. A Loop Dataset activity can be used in subsequent steps to loop through the properties.

Object Parameters

Property

Type

Required

Default

Markup

Description

LDAP path

Text

Yes

(Empty)

LDAPPATH=

LDAP://

The Lightweight Directory Access Protocol (LDAP) path of the Active Directory object to retrieve. The LDAP is an application protocol for querying and modifying data of directory services implemented in IP networks.

Click the Select Object button to launch a standard Windows Active Directory dialog box that allows for the selection an Active Directory object.

Click the Select Container button to select the parent container from the domain in which to select an Active Directory object from.

Create and populate dataset

Text

Yes

(Empty)

RESULTDATASET="theDataset"

The name of the dataset to be created which will be populated with the Active Directory object's Property Name and Property Value. More on the field names that this dataset creates can be found below under Datasets.

Credentials Parameters

           

Property

Type

Required

Default

Markup

Description

Authentication type

Text (options)

No

Default

AUTHTYPE="Encryption"

Specifies the types of authentication used. The available options are:

  • Default - Use default authentication type.

  • None - Equates to zero, which means to use basic authentication (simple bind) in the LDAP provider.

  • Secure - Requests secure authentication. When this flag is set, the WinNT provider uses NTLM to authenticate the client.

  • Encryption - Attaches a cryptographic signature to the message that both identifies the sender and ensures that the message has not been modified in transit.

  • SecureSocketLayer - Attaches a cryptographic signature to the message that both identifies the sender and ensures that the message has not been modified in transit.

  • ReadonlyServer - For a WinNT provider, ADSI tries to connect to a domain controller. For Active Directory Domain Services, this flag indicates that a writable server is not required for a serverless binding.

  • Anonymous - No authentication is performed.

  • FastBind - Specifies that ADSI will not attempt to query the Active Directory Domain Services objectClass property. Therefore, only the base interfaces that are supported by all ADSI objects will be exposed. Other interfaces that the object supports will not be available.

  • Signing - Verifies data integrity to ensure that the data received is the same as the data sent. The Secure flag must also be set to use signing.

  • Sealing - Encrypts data using Kerberos. The Secure flag must also be set to use sealing.

  • Delegation - Enables Active Directory Services Interface (ADSI) to delegate the user's security context, which is necessary for moving objects across domains.

  • ServerBind - If your ADsPath includes a server name, specify this flag when using the LDAP provider. Do not use this flag for paths that include a domain name or for serverless paths. Specifying a server name without also specifying this flag results in unnecessary network traffic.

Username

Text

No

(Empty)

USERNAME="username"

The username context that this activity will execute under. Leave the Username and Password parameters blank in order to use the logon user's credentials.

NOTE:  A Domain User has permission to access Active Directory information. However, only a Domain Administrator has permission to perform Active Directory modifications.

Password

Text

No

(Empty)

PASSWORD="password"

The password associated to the Username context that this activity will execute under. Leave the Username and Password parameters blank to use the logon user's credentials.

Description tab - A custom description can be provided on the Description tab to convey additional information or share special notes about a task step.

Error Causes tab - Specify how this step should behave upon the occurrence of an error. (Refer to Task Builder > Error Causes Tab for details.)

On Error tab - Specify what AWE should do if this step encounters an error as defined on the Error Causes tab. (Refer to Task Builder > On Error Tab for details.)

Datasets

A dataset is a multiple column, multiple row container object. This action creates and populates a dataset with the following fields (rows):

     

Name

Type

Return Value

theDataset.PropertyName

Text

Returns the Active Directory Object's Property Name.

theDataset.PropertyValue

Text

Returns the Active Directory Object's Property Value.

Example

The sample AML code below can be copied and pasted directly into the Steps panel of the Task Builder.

Description: Get properties of Active Directory object at ""LDAP://OU=MyCompany,DC=mycompany,DC=com"" and create and populate dataset "theDataset" with the properties.

<AMCREATEADPROPERTYDATASET LDAPPATH="&quot;LDAP://OU=MyCompany,DC=mycompany,DC=com&quot;" 
		 USERNAME="theUserName" PASSWORD="AM2PBmOg3vfcdsoGZuDe99x2z8ZjoN532bbKBnogx3fFdk=aME" 
		 RESULTDATASET="theDataset" />