如何使用VBScript從LDAP獲取Active Directory撥入權限設置？

Question

在Active Directory中，有一個名爲「撥入」選項卡，該選項卡下的是一個單選按鈕控件有三種設置：

Allow Access 
Deny Access 
Control access through remote access policy 

我想寫一個VBScript採取用戶名，並返回該用戶的設置。 （我實際上修改了現有的VBScript，這就是爲什麼我被迫使用該工具）。

這樣做的最好方法是什麼？

Answer 1

這是我能夠想出的最佳解決方案。很容易修改它以輸出所有用戶的設置。

Main 

Function Main 
    'Usage: cscript /nologo lookup.vbs mydomain username 
    Wscript.Echo CanDialIn(Wscript.Arguments(0), Wscript.Arguments(1)) 
    Main = 0 
End Function 

Function CanDialIn(domainname, username) 
    'Take a user name and query whether they have permission to Dial in or not 
    'http://www.microsoft.com/technet/scriptcenter/resources/qanda/aug05/hey0825.mspx 
    Const ADS_SCOPE_SUBTREE = 2 
    Dim objConnection 
    Dim objCommand 
    Dim objRecordSet 

    Set objConnection = CreateObject("ADODB.Connection") 
    Set objCommand = CreateObject("ADODB.Command") 
    objConnection.Provider = "ADsDSOObject" 
    objConnection.Open "Active Directory Provider" 
    Set objCommand.ActiveConnection = objConnection 

    objCommand.Properties("Page Size") = 1000 
    objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE 

    'Three possible values for msNPAllowDialin: 
    'TRUE = "Allow Access" 
    'FALSE = "Deny Access" 
    'EMPTY = "Control access through remote access policy" 
    objCommand.CommandText = _ 
    "SELECT msNPAllowDialin FROM 'LDAP://dc=" & domainname & ",dc=com' WHERE objectCategory='user' AND sAMAccountName = '" & username & "'" 
    On Error Resume Next 
    Set objRecordSet = objCommand.Execute 
    if objRecordSet.EOF then 
    CanDialIn = "Could not find user " & username 
    else 
    if objRecordSet.Fields("msNPAllowDialin").Value = True then 
     CanDialIn = "Allow" 
    else 
     if objRecordSet.Fields("msNPAllowDialin").Value = False then 
     CanDialIn = "Deny" 
     else 
     CanDialIn = "Control" 
     end if 
    end if 
    end if 
End Function