Disk Quota Reporting

[NeoS]

Dear All,

 

Here is our dilemma:

 

We have just written a new active desktop web page to replace our old student desktop. (So when the user logs on they have a nice custom interface on the screen) The new one is completely custom, runs on Apache2.2 & PHP on a Ubuntu server. It runs on a Linux machine as it reports the users print quota directly from Pykota (This is the print accounting software which runs on Linux)

 

It also serves to draw a nice little pie chart about their disk quota. The pie chart was a fairly simple library file, however i am struggling with getting the Disk Quota information to report properly.

 

Originally, the desktop was linked to an Active Server Page (ASP) on IIS 6.0 on our main server. This used WMI to collect the information (Quota.Limit, Quota.DiskSpaceUsed etc etc using a moniker type WMI call) and then redirect to the Linux machine while passing all the needed information as POST variables. PHP then handles all the information, formatting and HTML and actually returns the desktop web page. The result is a pretty Active Desktop Web Page on the users desktop! IIS was set up so anonymous access to this site was denied and the WMI script ran with the accessing users' credentials. This worked flawlessly as all the necessary name's and details needed to run the WMI query were automatically passed.

 

However, this only worked in testing. I thought that i could assign DCOM and WMI permissions to the students, but after much frustration and research, it seems impossible for any one aside a network admin to query WMI remotely

 

(I gave a single student account full permissions on the root namespace, and to all of DCOM's components as well as DCOM at a top level setting, but alas.. it did not work)

 

Now I'm kinda stuck. WMI does not allow you to run a query locally while specifying user credentials, so running the script using the Locator Query (Different type of WMI query that allows you to specify an Administrator User name and Password) is impossible on the main server. I therefore moved it to another server and managed to get the script to run and query the main server remotely.. 5 minutes later, the script manages to return the information i want!! This is far to long for a user to wait for a desktop to load.. and to be honest, going from "Desktop ---> Server 2 ----> Server 1 ---> Server 2 ---> Unix Machine" ... is hardly efficient

 

So thats 2 options down. My final approach to getting the WMI method to work was to specify credentials for directory security in IIS (Running the script locally on the main server) I gave IIS an account which could execute WMI but i also left on NTLM authentication in the hope the LOGON_USER variable would still be passed to the ASP Page.... Not a chance. With Anonymous access on, no information is passed to the web server to authenticate, which results in the Win_32.DiskQuota call returning no information. (Although Succeeding)

 

And as such, i'm a little stuck. I have spoken with Ric_ and it seems this WMI Permission issue hasn't been solved since it was first raised over 2 years ago. Without actually writing a C++ exec to query WMI instead of a web page i don't believe i can query the disk quota.

 

My last initiative, which is more effort than ever expected, is to have the Unix machine poll the server each ... 2 hours maybe, collect all user quota information and then database it using MySQL. The end user would see their disk quota information but it would not be real time.

 

How does everyone else report NTFS disk quota usage to their users/students? I know Windows Server 2003 R2 has a new "File System Manager" to mange quota's, and I have been told that it has new API which is far easier to query.

 

I guess I'm making my life difficult by hosting the main part of this desktop on the Linux system under apache, which cannot pass NTLM details, variables or authenticate.

 

I hope i haven't confused people by my post, i have tried to make myself clear and concise but its Friday morning, and I'm quite confused by the situation myself.

 

Any response is greatly appreciated.

Regards

David Poltorak

[saundersmatt]

I know that is is possible to retrieve quota information for a different user than is executing the script using code such as below.

Set colDiskQuotas = CreateObject("Microsoft.DiskQuota.1")
colDiskQuotas.Initialize "Z:\", True ' where z is the drive users are stored of, can be mapped if necessary
set objUser = colDiskQuotas.FindUser("" & User.Name & "") 'where User.Name is the name of the iis auth'd user

then pass objUser.QuotaLimit, objUser.QuotaThreshold and objUser.QuotaUsed to your apache server.

 

I'm not sure if this code will execute under IIS, but i can't really see any reason why not.

Hope you have some progress.

[NeoS]

Thanks for the quick reply. I didn't know that that object even existed so i will have a play around with that bit of code. I know you can query a user even if its not the one actually visiting the page, it is more a problem of permissions.

 

I still believe I will have issues as the students executing the script probably won't have permissions to create that object. As it is not using WMI tho, i can probably assign them the correct positions. If any one knows how off hand ? :-)

[saundersmatt]

I had no idea it was possible to get quota info via WMI, so it's apples for apples.

 

Can't help you any more on the permissions side either i'm afraid, hopefully somebody else will be along shortly.

 

Matt

[NeoS]

Im having no luck with permissions. I've loaded up ProcMon and checked on the server to see whats happening.

 

With a normal user account the dskquota.dll that the Microsoft.DiskQuota object is based on is called and no access deny messages surface, but the ASP still returns Permission Denied on the line that initilises the object.

 

I have assigned NTFS permissions to the DLL to allow the account full control, as have i assigned permissions to the VirtualDirectory of ISS and modified the account that it runs under. The Application Pool is custom running under a Local System account rather than as a network service...

 

Without an Admin account, it appears the Quota DLL just forbids to return any data.

[mrcrazy04]

I'm still running Win2k server here, so I just fetch the amount of free space left on drive F (the one with the user shares on) from an ASP page, as that reports the user's quota pretty accurately (and shows the same as N:\ would).

If you want the code I can hunt it out.

Alternatively - if you have a drive mapped to the user share, some VBScript output with the page should do it, just getting the amount of free space left on drive H: or whatever one you have. You could then possibly use XMLHTTP to post back to the linux box and have it draw the nice graphs.

[webman]

Create an AutoIt program that runs on the file server, use TCP functions native to AutoIt and PHP to communicate the username or home directory path to the program, program looks this up on the server and then sends the information back to the PHP script via the TCP socket.

 

I also think mrcrazy04 is onto something there. Get the quota on the mapped drive via VBScript at logon - send this via XMLHTTP to a PHP script on the server - then this PHP script updates a DB table with the user's quota (which is then read to create the graph).

[NeoS]

Interesting. I wasnt aware there was a way to pass information from a script to a webserver, that method will definately come in handy.

 

I have actually tried to query just the free space on the drive, it was my original attempt at file quota, for some reason it always replied the wrong value, or just the value for the entire drive. Maybe i had an error in the coding. Ill probably try the XMLHTTP method and the Remaining File space method out on monday morning and let you know how it all goes.

 

The whole AutoIt thing is possible but im trying to make it so this can be migrated to new domain controllers next year when im not around without any hassle!

 

Thanks for the responses guys, it is greatly appreciated

[NeoS]

Ok All.

 

I am playing with the idea of just running a DiskFree Space script within IIS. I Would rather leave the entire system Server side if possible. If this is not possible then i will look into XMLHTTP and make a client script or similar.

 

I am using the following:

 

drive = "D"

strComputer = "."
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colDisks = objWMIService.ExecQuery("Select * from Win32_LogicalDisk Where DeviceID = '" & drive & ":'")

For Each objDisk in colDisks
Quota_Limit = objDisk.Size
DiskSpaceFree = objDisk.FreeSpace
Next

 

This code is what i am using to check the free disk space. The user's credentials are passed to the page and IIS happily returns the size of the disk as their independent quota, however "objDisk.FreeSpace" returns the entire drive's free space rather than the specific amount remaining for the user. Any Ideas?

[apeo]

Ok you may have tried this already but could you not use a script to calculate the space used and then have a fixed variable as the quota.

[NeoS]

Yeah, That is easy to do but i would not like to go down the alley of setting variables for every differnent group of pupils we have... Years, Classes, Groups etc all have differenct quotas, and maintaining a list of them is not something that i want to happen. Im after seamless integration really!

 

I think im just going to get a script to update a database on the server, i just wanted to keep one centralised point of information (On our main Windows PDC) but it seems that is not going to happen without making more work for other people!

[apeo]

Ah right... its never that easy when it comes to windows...

 

Would that be a database of users and their respective quota info? This is getting kinda long winded now but what you could do is to have the max quota info sent (maybe scheduled daily) to a csv, which the user scripts could then pull out for comparison. This way you dont have to set the quota in the script yourself and the stats would be live.

[NeoS]

Have gone for and already implemented a database at the MySQL Unix end and a desktop script to update info on login. Thanks for the help guys. I know understand why people spend money on software that does this for them..

 

Ill post a screen shot of the finished desktop ;-)

 

Have to mention tho, i have learned an invaluable amount about WMI, IIS and Disk Quotas while attempting this task.. the bottom line is.. They don't work properly ;-)

[ChrisH]

So you not gonna share this then ?

[NeoS]

Why of course ;-)

 

What are you guys interested in?

To date i have written the following for Active Directory :

 

User Management (Password Changing, Home Directory etc)

Ability to manage print quota

Login Audit Database (Currently in progress)

 

And i've just finished the disk quota reporting script and database and Desktop page to show it all off!

 

Its all PHP and MySQL (Asides from the one VB script for windows). If anyone has a Pykota build set up or just any Unix machine and they can set up APACHE + LDAP then they can use any of the above.

[Ric_]

I would very much like to see this (particularly the PyKota print quata remaining stuff).

[NeoS]

Sure man. I'll post you some screenies tomorow. I need to check through the code and make sure its all secure etc. There are a few things i've been meaning to check. Its only been deployed to a test audiance but im happy to share the source with people!

 

I've tried to make it so you can configure it by editing one file so im sure its usuable to other people. I'll make a new topic about it tomorow sometime.