![\"Hey,](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/q-for-powertip.jpg\" "\\"Hey,")
<\/p>\n<\/p>\n
Hey, Scripting Guy! How can I use alternate credentials when searching Active Directory?<\/p>\n
— PT<\/p>\n
Hey, PT. So what’s the big idea here? Devoted readers of this column (both of them) know that we usually love<\/i> tackling questions where the answer involves searching Active Directory. Why? That’s easy: because we don’t really answer<\/i> those questions. Instead we simply hammer out a script and then, instead of explaining how the script works, tell people to read the two-part series Dude, Where’s My Printer?<\/b><\/a> for more information. As you can tell, that makes for a nice, easy day at the office.<\/p>\n But your question is different: unfortunately for us, specifying alternate credentials isn’t mentioned anywhere in our series on searching Active Directory. That means we’re actually going to have to answer<\/i> this question. Talk about unfair: not only do we have to come in to work, but now we’re expected to actually do something while we’re here! <\/p>\n Trust us: that is not<\/i> the American way.<\/p>\n So we’ll make a deal with you: we’ll answer your question, but only by focusing on the part of the script where you specify alternate credentials. If you need more information about the rest of the code, or if you need more information about searching Active Directory, please see the two-part series Dude, Where’s My Printer?<\/b><\/a><\/p>\n Boy, if only we had a dollar for every time we’ve said that<\/i>.<\/p>\n Here’s a script that uses alternate credentials in order to search Active Directory:<\/p>\n Like we said, for today we’re going to focus on these four lines of code, the four lines where we specify the alternate credentials:<\/p>\n Note that these four lines of code are required only<\/i> if you want to conduct the search under alternate credentials; that is, only if you want to bind to Active Directory using a user account other than the one you used when logging on to Windows. If you want to do a search using your current logon credentials all you have to do is remove these four lines of code and the script is good to go. <\/p>\n As you can probably tell (the object reference objConnection is a dead giveaway), these four lines of code involve four properties of the ADO (ActiveX Data Objects) Connection<\/b> object. The properties User ID<\/b> and Password<\/b> should be self-explanatory: these are simply the user name and the password for the account you want to use when binding to Active Directory. In this example, we’ve specified the User ID using the domain\\user name<\/i> syntax. However, we could also specify the user name as the logon name itself (e.g., kenmyer<\/b>) or as the user’s UPN (Universal Principal Name): kenmyer@fabrikam.com<\/b>. That’s entirely up to you. <\/p>\n As for the password, we’ve hard-coded the password into the script for educational purposes. Needless to say, however, that’s not the way we recommend that you do things. Instead, you should probably have the script prompt you for a password each time the script is run. If you’re not sure how to do that, well, don’t worry about it: as we are wont to do, we’ll simply refer you somewhere else<\/b><\/a>. (In this case, a previous Hey, Scripting Guy!<\/i> column on prompting for – and masking – passwords.)<\/p>\n That leaves us with just two properties to dispose of. Setting Encrypt Password<\/b> to True simply tells the script to encrypt the password when sending it across the network; by default, this value is set to False. The ADSI Flag<\/b> property, meanwhile, is a bitmask property used to specify authentication options. The value 3 is actually a bitmask value composed of two separate properties:<\/p>\n Constant<\/b><\/p>\n<\/td>\n Value<\/b><\/p>\n<\/td>\n Description<\/b><\/p>\n<\/td>\n<\/tr>\n ADS_SECURE_AUTHENTICATION<\/p>\n<\/td>\n 1<\/p>\n<\/td>\n Requests secure authentication. When this flag is set, Active Directory will use Kerberos, and possibly NTLM, to authenticate the client.<\/p>\n<\/td>\n<\/tr>\n ADS_USE_ENCRYPTION<\/p>\n<\/td>\n 2<\/p>\n<\/td>\n Requires ADSI to use encryption for data exchange over the network.<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n![\"Spacer\"](\"https:\/\/devblogs.microsoft.com\/scripting\/wp-content\/uploads\/sites\/29\/2019\/05\/spacer.gif\")
![\"Hey,](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/a-for-powertip.jpg\" "\\"Hey,")
![\"Script](\"http:\/\/img.microsoft.com\/library\/media\/1033\/technet\/images\/scriptcenter\/ad.jpg\" "\\"Script")
<\/a><\/p>\nConst ADS_SCOPE_SUBTREE = 2
<\/pre>\nSet objConnection = CreateObject(\"ADODB.Connection\")
Set objCommand = CreateObject(\"ADODB.Command\")
objConnection.Provider = \"ADsDSOObject\"<\/pre>\n
objConnection.Properties(\"User ID\") = \"fabrikam\\kenmyer\"
objConnection.Properties(\"Password\") = \"A2sXrco1Fq1#om!\"
objConnection.Properties(\"Encrypt Password\") = TRUE
objConnection.Properties(\"ADSI Flag\") = 3
<\/pre>\nobjConnection.Open \"Active Directory Provider\"
Set objCommand.ActiveConnection = objConnection
<\/pre>\nobjCommand.Properties(\"Page Size\") = 1000
objCommand.Properties(\"Searchscope\") = ADS_SCOPE_SUBTREE<\/pre>\n
objCommand.CommandText = _
\"SELECT Name FROM 'LDAP:\/\/DC=fabrikam,DC=com' WHERE \" _
& \"objectCategory='user'\"
Set objRecordSet = objCommand.Execute<\/pre>\n <\/pre>\n
objRecordSet.MoveFirst
Do Until objRecordSet.EOF
Wscript.Echo objRecordSet.Fields(\"Name\").Value
objRecordSet.MoveNext
Loop<\/pre>\nobjConnection.Properties(\"User ID\") = \"fabrikam\\kenmyer\"
objConnection.Properties(\"Password\") = \"A2sXrco1Fq1#om!\"
objConnection.Properties(\"Encrypt Password\") = TRUE
objConnection.Properties(\"ADSI Flag\") = 3<\/pre>\n\n<\/thead>\n\n
\n \n \n \n \n \n \n \n \n \n \n \n