Password reset script, why does it not work?

[FN-GM]

Hi

 

This is our script that will allow teachers to reset student passwords. It stopped working some time ago and i can't understand why. The reset is being logged in the text documents, the script says its been rest but it simply doesn't work. Teachers are in the right group etc.

 

Your help will be appreciated.

 

Thanks

 

Dim sUserName, sDomain, oUser, oNet, sComputer, pw, vbClrf, _

sPword2, sPword3, oComputer, serverpath, filename, objshell

 

Dim namecheck, nameexists, userou, ou

 

Set objNetwork = CreateObject ("WScript.Network")

While objNetwork.Username = ""

WScript.Delay (100)

Wend

strComputerName = objNetwork.ComputerName

strUserName = objNetwork.UserName

 

IF NOT ISMEMBER ("CN=PasswordResettingAccess") THEN

wscript.echo "You do not have permission to change student passwords" & VBCR & VBCR & "Please speak to IT Support if your require this permission"

wscript.quit

END IF

 

sUserName = InputBox("Please type Username" & chr(13) & "in the format" & chr(13) & "hc<1stinitial><2ndinitial>", "Heywood Community HS Password Change", "")

IF sUserName = "" THEN wscript.quit

call checkname

 

if nameexists = "yes" then call resetpassword

 

if nameexists = "no" then call noaccount

 

wscript.quit

 

sub resetpassword

 

call checkstudent

 

if NOT userou = "Students" then call notstudentaccount

 

bConfirm = MsgBox ("Password to be reset, are you sure?", 4, sUsername)

If bConfirm = 7 then call nochange

Set oNet = CreateObject("Wscript.Network")

 

serverpath = "\\hc-print\Computer Use Logs\PasswordReset\"

filename = "password_change1.txt"

 

dim filesys, filetxt

Const ForReading = 1, ForWriting = 2, ForAppending = 8

Set filesys = CreateObject("Scripting.FileSystemObject")

Set filetxt = filesys.OpenTextFile(serverpath+filename, ForAppending, True)

filetxt.WriteLine sUsername

filetxt.WriteLine "Reset by " & strUserName & " from " & strComputerName

filetxt.Close

 

'wscript.echo time

 

IF time<"16:00:00" THEN WScript.Echo "The password for user account " & chr(13) & chr(13) & sUserName & chr(13) & chr(13) & " will be reset to ' football ' within the next 2 minutes." & VBCR & VBCR & "Please wait 2 minutes before attempting to log on with this account"

IF time>"16:00:00" THEN WScript.Echo "User accounts cannot be changed by using this script after 4:00pm" & vbcr & "The password for user account " & chr(13) & chr(13) & sUserName & chr(13) & chr(13) & " will be reset to ' football ' tomorrow morning at 9:00am"

 

wscript.quit

 

end sub

 

sub nochange

 

wscript.echo sUsername & " - Password Change aborted"

 

wscript.quit

 

end sub

 

sub noaccount

 

wscript.echo "Username - " & sUsername & " - does not exist in this Domain." & vbcr & "Please check that you have entered it correctly and try again"

 

wscript.quit

 

end sub

 

sub checkname

 

 

'if domainname = "" then

set objRoot = getobject("LDAP://RootDSE")

domainname = objRoot.get("defaultNamingContext")

'end if

 

if sUserName <> "" then

namecheck = finduser(sUserName,domainname)

end if

 

if namecheck = "Not Found" then nameexists = "no" ELSE nameexists = "yes"

 

end sub

 

sub checkstudent

 

ou = mid(namecheck,instr(namecheck,",")+1,len(namecheck)-instr(namecheck,","))

ou = split(ou, ",")

userou = mid(ou(2),4,(len(ou(2))))

 

end sub

 

sub notstudentaccount

 

wscript.echo "This is not a student account" & vbcr & "This script can only be used to change passwords for student accounts" & vbcr & vbcr & vbcr & "Please contact IT Support for assistance if you wish to reset the password on this account"

 

wscript.quit

 

end sub

 

 

Function FindUser(Byval UserName, Byval Domain)

on error resume next

 

set cn = createobject("ADODB.Connection")

set cmd = createobject("ADODB.Command")

set rs = createobject("ADODB.Recordset")

 

cn.open "Provider=ADsDSOObject;"

 

cmd.activeconnection=cn

cmd.commandtext="SELECT ADsPath FROM 'LDAP://" & Domain & _

"' WHERE sAMAccountName = '" & UserName & "'"

 

set rs = cmd.execute

 

if err<>0 then

FindUser="Error connecting to Active Directory Database:" & err.description

else

if not rs.BOF and not rs.EOF then

rs.MoveFirst

FindUser = rs(0)

else

FindUser = "Not Found"

end if

end if

cn.close

end function

 

 

':::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

'::: CHECK WHETHER USER IS A MEMBER OF A CERTAIN GROUP :::

':::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Function IsMember (strGroup)

 

':::::::::::::::::::::::::::::::::::::::::::::::

'::: Use LDAP to find out account details :::

':::::::::::::::::::::::::::::::::::::::::::::::

On Error Resume Next

Set objSystemInfo = CreateObject ("AdSystemInfo")

Err.Clear

Set objUser = GetObject ("LDAP://" & objSystemInfo.UserName)

If Err.Number <> 0 Then

MsgBox Err.Number & vbTab & Err.Description

End If

 

Dim objGroup

IsMember = FALSE

For Each objGroup In objUser.Groups

'Message "TESTING - PLEASE IGNORE", 1, strUserName & " is a member of " & objGroup.Name & " " & objGroup.Class, 1

strThisGroup = Replace (objGroup.Name, "CN=\", "")

If strThisGroup = strGroup Then

 

IsMember = TRUE

Exit For

End If

Next

End Function

 

[Messa]

Why not create a taskpad that only allows password resetting?

Assuming you use XP.

 

Read up about it HERE

[MK-2]

just looking through it, it mentions that password will be reset to football, but cant see the string that actually does the resetting of the password.

 

going by MS script repository, you can use this:

Set objUser = GetObject _

("LDAP://cn=myerken,ou=management,dc=fabrikam,dc=com")

 

objUser.ChangePassword "i5A2sj*!", "jl3R86df"

[FN-GM]

sorry, i am not a script expert. how do you mean please?

 

Z

[FN-GM]

I see what you mean, I have no idea what’s going on with that. It used to work, i didn’t see what it was like before there wasn't any need.

 

I don’t know what happened to the reply but it said this

 

What he means is that there doesn't seem to be anything in the code that actually changes the password. Instead the code just performs several checks to see whether requirements are met. When these requirements are met though there is no code to tell the script what to do.

[Edu-IT]

So has somebody modified the script then?

[FN-GM]

Well I haven’t and the other two guys haven’t. The only thing I can think is that somehow an older version, whilst it was under developed was restored some how.

[FN-GM]

set rs = cmd.execute

what does this mean?

[Lithium]

rs is often used as the identifier for a RecordSet.

 

the rest executes something... usually it's an ADODB & SQL thing.

 

 

Looking at what you posted, under the "FindUser" function, it executes the query (specified as cmd.CommandText) against AD to find the specified/active user (didnt bother looking up which)

Edited March 16, 2008 by Lithium

[FN-GM]

ok thanks

[SYNACK]

Along with not having a bit that applies a password reset it does not appear to have any account impersonation setup which you will need when applying the password change if the user running the script does not have the right to change the password in AD under their current logon.

[FN-GM]

Thats odd, i will have a look round for a more updated version.

[Messa]

Why not create a taskpad that only allows password resetting?

Assuming you use XP.

 

Read up about it HERE

 

Why Not Use This ?

 

This means staff can see something instead of messing with scripts.

[rj_mayer]

We do this through our Staff Intranet. Any member of staff can change a student password through the PHP front end, logged in as themselves. This then calls a VB Script at the server and makes the LDAPS change. I would say it's reduced the password change 'visitor' numbers to the ICT Office by at least 80% and has been highly praised by all staff who've used it for its simplicity. One reason why it's so simple is that it pulls the student's DOB from SIMS and sets the password to DDMMYY, not even requiring the student to leave their seat. The only people it hasn't gone down well with are the students who like the excuse to leave the room!

[tmcd35]

We set up a new group in AD and gave that group permissions to change student passwords only. Made all teachers a member of the group. Then install Wisesofts Bulk Password program on the teachers desktop in the ICT suites. Job done.

[scsitsupport]

Hi Guys,

 

We have a HTA version of this sort of thing that will find the username and reset it to a default. Works well well for our staff. Can download it from here if you are interested.

 

Scripts