WinBatch Tech Support Home

Database Search

If you can't find the information using the categories below, post a question over in our WinBatch Tech Support Forum.

TechHome

WinBatch
Networks - Servers
Microsoft Client
wNT
plus
Services

Can't find the information you are looking for here? Then leave a message over on our WinBatch Tech Support Forum.

wntMemberList Behavior 

Keywords:   wntMemberLst2 wntMemberList

Question:

I want to create an overview of NT domain accounts. When I'm using the wntMemberLst2 and/or wntMemberList functions to give me the members of a group it's giving me besides normal members also groups and users(only ID numbers) from trusted domains. How can I determine, from this list, if a returned value is a user or group and how to translate the trusted domain info into readable info.

The program is running on a BDC in domain "A" and it's the first time I'm creating such a script. I do get normal results from domain "A" only I cannot see if it's a user or a group. The members from domain "B" are only id numbers. So I also do not know who or what this is.

Answer:

I've been researching and working on fixing a wntMemberList() problem this week that appears to have the same symptoms as the problem that you are experiencing. What is happening in the problem that I'm looking at is that when a workstation has local groups that has members which are global domain groups for both its primary domain and for one or more trusted domains, and, all of the domain controllers for a trusted domain are unreachable, then wntMemberList() returns garbage numeric strings and SID strings when attempting to list all members of this local group. It appears that the Win32 API function used to get the group membership information is broken and does not handle this situation properly. I'm re-working it to use a slightly different method of obtaining domain & account name information for each member of a local group.

Question (cont'd):

The results I do get right now is:
(example)

Command was: 

Members = wntMemberLst2(Servername, Groupname, @LOCALGROUP)
results are: 
domainname_A\Jimmy
domainname_A\Production
domainname_B\000002FB
domainname_A\Carla
Jimmy and Carla are normal users on domain A Production is a global group on domain A 000002FB is a normal user on domain B Hope this info will help and if you need more info let me know.

Answer:

I have 2 points to make up front:
  1. I may have misinterpreted your original question. I've been sifting through a really quirkly problem with wntMemberList() [very similar internal code to wntMemberLst2()] and I thought that perhaps the problems were related. This looks to not be the case after all.

  2. You are running an old version of WinBatch and also have an old version of the NT extender. Any resolution to your problem that requires the use of the newer or even the latest version(s) of the NT extender will also require you to upgrade to WinBatch 2001 as the current NT extender versions only work with WinBatch 2001 [and newer]. Also, the wntMemberLst2() function is a deprecated feature in the NT extender versions that work wtih WinBatch 2001. The wntMemberLst2() function no longer appears in the help file and is no longer supported. This happened because the wntMemberList() function picked up an optional flag parameter in WinBatch 2001 that allows it to return domain name information in the same way that wntMemberLst2() was doing. This made wntMemberLst2() unnecessary.
Now, back to the issue here.

Based on the script output that you included, I have some questions to ask.

  1. Is the account name from the trusted domain is supposed to be "000002FB"?

  2. Are the account names in that domain all coded as hex strings, or is the account name being returned incorrectly by wntMemberLst2()?

  3. If the account name is being returned correctly, then my interpretation of your question is that you are asking how to tell if the members of the local group are user accounts [either local or domain users] or group accounts [global domain groups].

  4. Is this a correct interpretation of your question?

    If it is, then you can determine what type of an account you are dealing with using the follwing procedure.

Please note that a global domain group can only have domain users as its members. Local groups, either on a workstation, a member server or a domain controller, can have local users, domain users or domain groups as their members. This means that we may have to contact another computer on the network in order to determine what type of account we are dealing with.

Assuming that you have a list of fully qualified account names returned from wntMemberLst2(), do the following:

  1. If the "domain" prefix on the account name is actually a domain name then you need to get the name of a domain controller computer in that domain. If the "domain" prefix is the name of a computer then simply use that computer name.

  2. Take the computer name that was obtained in step #1 and use it as the "server-name" parameter value in the following function calls.

  3. Call wntGroupInfo() one time, specifying a local group type and request # -1. If the return value is @TRUE then the account is a local group.

  4. If the account was not a local group then call wntGroupInfo() a second time, specifying a global group type and request # -1. If the return value is @TRUE then the account is a global domain group.

  5. If the account was not a group then it must be some sort of user account that can be used to logon to a server or to a domain [e.g. a normal user account, a computer account, a trust account, etc...]. Use the wntUserGetDat() function to get the account "flags" to determine exactly what type of account you are dealing with.
Note: To get the names of domain controllers in a domain, use the wntServerList() function. You will have to use this in combination with wntServerInfo() to determine if the "domain" prefix is a computer name. Basically, use wntServerInfo() [or wntServerType()] on the "domain" prefix [be sure to put a leading "\\" on it] to see if it is a computer name. If wntServerInfo() [or wntServerType()] fails [be sure to trap the error] then you have a domain name and you need to use wntServerList() to find the PDC & BDCs in the domain. Once you have obtained a computer name for the PDC or a BDC in the domain, you can then ask that computer to determine what type of account you are dealing with. 
Article ID:   W15206

File Created: 2002:09:05:13:50:34
Last Updated: 2002:09:05:13:50:34