ADSI and Managing the NT Security Database

1
ADSI and Managing the NT Security Database

• By Wayne Berry

2
What is ADSI?

• ADSI Active Directory Service Interface.
• ADSI currently can manipulate
• Internet Information Server, Exchange, NT
  security database
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ADs\Provider
  s
• In Windows 2000 it will be able to do a lot more
  with the Windows Mangement Interface (WMI).

3
Warning!

• The code shown here changes the NT Security
  Database. Please be very careful when using the
  examples

4
Security

• NT security database manipulation needs
  Administrative permissions.
• ASP Pages must be running under the
  administrative permissions.
• Demo
• Risks

5
Changing your Password

• Set-up IIS for Basic/NT security database
  authentication
• Demo
• Write the Script to allow an individual
  manipulate only their password.
• Example Code (example9.asp)

6
Creating a User

• Creating a User Account
• Example (example1.asp)
• Creating a User and Assigning a Password
• Example (example2.asp)
• Creating a User With Error Handling
• Example (example3.asp)

7
Creating a Group

• Creating a Group in the Domain
• Example (example4.asp)
• Deleting a Group in the Domain
• Example (example5.asp)
• Adding a User to a Group
• Example (example6.asp)

8
Setting a Users Properties

• Example (example7.asp)

9
Iterating Through Users

• Example (example8.asp)

10
Summary

• ADSI is a very powerful tool that will only
  become more useful with additional Windows 2000
  name space providers.
• ADSI provides a namespace that allows you to
  manipulate the NT security database as long as
  you have permission.
• Questions?