ohaya
Thu Apr 24 04:32:46 PDT 2008
ohaya@cox.net wrote:
> On Apr 23, 11:21 pm, oh...@cox.net wrote:
>
>>On Apr 23, 2:45 pm, "Richard Mueller [MVP]" <rlmueller-
>>
>>
>>
>>
>>
>>nos...@ameritech.nospam.net> wrote:
>>
>>>Jim wrote:
>>>
>>>>We have some code that runs intermittently against our ADs in several
>>>>environments (these "environments" are completely separate from each
>>>>other), and it uses maxPwdAge to determine when the passwords for
>>>>users are going to expire.
>>
>>>>In 2 of the environments, they have it set to 90 and 60 days, and
>>>>maxPwdAge shows up as large negative numbers.
>>
>>>>However, in the 3rd one, maxPwdAge is appearing as "15552000", which
>>>>calculates to 180 days in seconds.
>>
>>>>Does anyone know why maxPwdAge would be a positive number in that one
>>>>environment, vs. large negative number in the other ones?
>>
>>>The maxPwdAge attribute of the domain object is datatype Integer8, a 64-bit
>>>value. The value corresponds to the age in 100-nanosecond intervals (not
>>>seconds). I'm used to handling this in VBScript using the IADsLargeInteger
>>>interface, which has a HighPart and LowPart method that breaks the 64-bit
>>>value into two 32-bit values. The value is either 0 or a negative value,
>>>similar to an offset. Due to quirks in the way signed integers are handled,
>>>if the LowPart method returns a negative value, the value returned by the
>>>HighPart method should be increased by 1. I use the following VBScript code
>>>to convert maxPwdAge attribute to days:
>>>========
>>>' Determine domain maximum password age policy in days.
>>>Set objRootDSE = GetObject("LDAP://RootDSE")
>>>strDNSDomain = objRootDSE.Get("DefaultNamingContext")
>>>Set objDomain = GetObject("LDAP://" & strDNSDomain)
>>>Set objMaxPwdAge = objDomain.MaxPwdAge
>>
>>>' Account for bug in IADslargeInteger property methods.
>>>lngHighAge = objMaxPwdAge.HighPart
>>>lngLowAge = objMaxPwdAge.LowPart
>>>If (lngLowAge < 0) Then
>>> lngHighAge = lngHighAge + 1
>>>End If
>>>' Convert to days.
>>>intMaxPwdAge = -((lngHighAge * 2^32) _
>>> + lngLowAge)/(600000000 * 1440)
>>>========
>>>We don't know how your code converts the Integer8 value into seconds. It
>>>probably is flawed.
>>
>>>As an example, in my domain ADSI Edit reveals that maxPwdAge
>>>is -37,108,517,437,440. My script reveals that HighPart returns -8640 and
>>>LowPart returns 0, which works out to the same number of 100-nanosecond
>>>intervals. This converts to 42.94967 days.
>>
>>>--
>>>Richard Mueller
>>>Microsoft MVP Scripting and ADSI
>>>Hilltop Lab -
http://www.rlmueller.net
>>>--
>>
>>Richard,
>>
>>Sorry that I didn't clarify, but the thing is, they're seeing that
>>"15552000" value in MIIS (or ILM now, I guess), i.e., it is the "raw"
>>value that they're getting for maxPwdAge.
>>
>>The thing that we can't figure out is why just that one AD is coming
>>back with that value, whereas the other two environments have the more
>>normal "large negative number".
>>
>>The effect of that "15552000" value for the maxPwdAge is that it is
>>throwing off the calculations that the MIIS rule extensions are doing
>>when calculating what it thinks are the password expiration dates for
>>users.
>>
>>Is it possible that the "format" for maxPwdAge is different between
>>Windows versions, i.e., Win2K Server, Win2K3 server, and Win2K3 R2,
>>etc.?
>>
>>Jim- Hide quoted text -
>>
>>- Show quoted text -
>
>
>
>
> Hi,
>
> I just ran across this thread (hope the link works):
>
>
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.win2000.active_directory&tid=eedcd917-1bd0-457f-8434-f9f6bab0d5d2&cat=&lang=&cr=&sloc=&p=1
>
> where it says the output of an adfind should include:
>
> maxPwdAge: -155520000000000
>
> I wonder if our guy or MIIS is somehow dropping the minus ("-")?
>
> Also, the thread doesn't state it explicitly, but that seems to be on
> Win2K3?
>
> Jim
Hi,
I got more info this morning. Apparently, on the system that they said
was showing the "15552000" for maxPwdAge, they had gotten that value by
using ldp, whereas on the other two environments, the large negative
values came from using MIIS/ILM.
So, maybe ldp itself is re-formatting the raw maxPwdAge value for display?
Jim