GetObject error for a newbie

[David]

I am just starting to work with windows scripting and ADSI, and trying some
of the examples found in the TechNet doucumentation.

Here is my script:
Set objUser = GetObject("LDAP://cn=david,dc=ectax,dc=escambia")
ectax.escambia the domain and david being a user account in the AD.

and error:
getdomainuser.vbs(1, 1) (null): There is no such object on the server.

The sample code in the doc also includes an OU parameter. in our case there
are no OU's under the domain so that was left out of my getobject statement.

I can remove the cn parameter and the object for the domain is created with
no errors.

thanks for any help
David

[Richard Mueller [MVP]]

"David" <Da...@discussions.microsoft.com> wrote in message
news:20BA1BE9-60DB-4B59...@microsoft.com...

Active Directory has a hierarcical structure. Your binding string assumes
that the user object is in the root of the domain, which is very unlikely.
The error message indicates the object was not found. You need to specify
the full Distinguished Name of the object, which indicates where in AD the
object resides. For example, if the user is in the "cn=Users" container, you
would use:

Set objUser = GetObject("LDAP://cn=david,cn=Users,dc=ectax,dc=escambia")

If instead the object is in the "ou=West" organizational unit, which is in
the root of the domain, you would use:

Set objUser = GetObject("LDAP://cn=david,ou=West,dc=ectax,dc=escambia")

And, if the user is in the "ou=West" ou, but this ou is itself in another OU
called "ou=Sales", the you would use:

Set objUser =
GetObject("LDAP://cn=david,ou=West,ou=Sales,dc=ectax,dc=escambia")

I admit it can be difficult to determine the Distinguished Names of objects,
but you should be able to figure it out from your hierarchy in ADUC. You can
check the "fully qualified domain name" of the use on the "Object" tab of
ADUC, which shows the components of the Distinguished Name in reverse order.
Better yet, use a tool like ADSI Edit or ldp.exe to view the attributes of
the object (in this case, the distinguishedName attribute).

Finally, if you know the "pre-Windows 2000 logon name" of the user you can
use the NameTranslate object to convert this into the Distinguished Name.
See this link for more:

http://www.rlmueller.net/NameTranslateFAQ.htm

For more on the "binding string" used to bind to objects with the LDAP
provider, see this link:

http://www.rlmueller.net/LDAP_Binding.htm

--
Richard Mueller
MVP Directory Services
Hilltop Lab - http://www.rlmueller.net
--