selfService portal

Question

Hi!

I've just setup the selfservice portal to our users so that they themselfs can unlock the account if it gets locked. I have a couple of different policys in place and would like to enforce a stricter policy on the users that are local admins in their own computer .... I'm guessing that this information isnt availeble anywhere so I cant 'target' that automatically. Any ideas?

I'm thinking of making a AD group with users that are local admin on their own machine, but can that inturn be auto populated somehow ? Or can the selfservice portal automatically select a specific policy if the user is local admin (even if its a unlock scenario - perhaps some detection during enrollment?).

No SelfService client installed at this point.

Answer 1

Hello Kaj,

Or can the selfservice portal automatically select a specific policy if the user is local admin (even if its a unlock scenario - perhaps some detection during enrollment?).

There is no such possibility.

I'm thinking of making a AD group with users that are local admin on their own machine, but can that inturn be auto populated somehow ?

Yes, this can be done using a Scheduled Task and a PowerShell script. The script will take members of the local administrators group, save there SIDs to a multi value text property of a computer and add the users to the required AD group. For the property that will store administrator SIDs, we recommend using one of Adaxes custom attributes (e.g. CustomAttributeTextMultiValue1). To create the Scheduled Task:

1. Launch Adaxes Administration Console.

2. Right-click your Adaxes service node, navigate to New and click Scheduled Task.
   

3. On step 3 of Create Scheduled Task wizard select Computer Object type and click Next.
   

4. Click Add Action.

5. Select Run a program or Powershell script.

6. Enter a short description and paste the script below into the Script field.
   

    $localGroupName = "Administrators" # TODO: modify me
    $groupDN = "CN=MyGroup,Ou=Groups,DC=Example,DC=com" # TODO: modify me
    $savedSidsAttributeName = "adm-CustomAttributeTextMultiValue1" # TODO: modify me
   
    function GetLocalGroupMember($computerName, $localGroupName, $domainSid, $localAdministratorsSids, $domainName)
    {
        if (!(Test-Connection -ComputerName $computerName -Count 1 -Quiet))
        {
            $Context.LogMessage("Connecting to a computer '$computerName' failed", "Warning")
            return $NULL
        }
   
        # Get group members
        $group = [ADSI]"WinNT://$computerName/$localGroupName"
        $members = @($group.Invoke("Members"))
        foreach ($member in $members)
        {
            $memberClass = $member.GetType().Invokemember("Class","GetProperty",$null,$member,$null)
            $memberSidBytes = $member.GetType().Invokemember("objectSID","GetProperty",$null,$member,$null)
            $memberSid = New-Object "Softerra.Adaxes.Adsi.Sid" @($memberSidBytes, 0)
   
            if ($memberSid.AccountDomainSid.CompareTo($domainSid) -ne 0)
            {
                continue
            }
   
            if ($memberClass -eq "Group")
            {
                $reportRecords = GetDomainGroupMembers $memberSid $localAdministratorsSids $domainName
            }
            else
            {
                [void]$localAdministratorsSids.Add($memberSid)
            }
        }
   
        return ,$reportRecords
    }
   
    function GetDomainGroupMembers($groupSid, $localAdministratorsSids, $domainName)
    {
        # Get group members
        $group = $Context.BindToObject("Adaxes://<SID=$groupSid>")
        try
        {
            $memberGuidsBytes = $group.GetEx("adm-MembersGuid")
        }
        catch
        {
            return
        }
   
        # Build filter
        $filter = New-Object "System.Text.StringBuilder"
        $filter.Append("(&(sAMAccountType=805306368)(|") | Out-Null
        foreach ($guidBytes in $memberGuidsBytes)
        {
            $filter.Append([Softerra.Adaxes.Ldap.FilterBuilder]::Create("objectGuid", $guidBytes)) | Out-Null
        }
        $filter.Append("))") | Out-Null
   
        # Search all users in domain group
        $searcher = $Context.BindToObject("Adaxes://$domainName/rootDSE")
        $searcher.SearchFilter = $filter.ToString()
        $searcher.PageSize = 500
        $searcher.SearchScope = "ADS_SCOPE_SUBTREE"
        $searcher.SetPropertiesToLoad(@("objectSid"))
   
        try
        {
            $searchResultIterator = $searcher.ExecuteSearch()
            $searchResults = $searchResultIterator.FetchAll()
   
            $flatDomainName = $domainName.SubString(0,$domainName.IndexOf("."))
            foreach ($searchResult in $searchResults)
            {
                $sid = New-Object "Softerra.Adaxes.Adsi.Sid" @($searchResult.Properties["objectSid"].Value, 0)
                [void]$localAdministratorsSids.Add($sid)
            }
        }
        finally
        {
            $searchResultIterator.Dispose()
        }
    }
   
    function AddUsersToGroup ($groupDN, $sids)
    {
        foreach ($sid in $sids)
        {
            $group.Add("Adaxes://<SID=$sid>")
        }
    }
   
    # Get domain SID
    $domainName = $Context.GetObjectDomain("%distinguishedName%")
    $domain = $Context.BindToObject("Adaxes://$domainName")
    $domainSid = New-Object "Softerra.Adaxes.Adsi.Sid" @($domain.Get("objectSID"), 0)
   
    # Get group members
    $localAdministratorsSids = New-Object "System.Collections.Generic.HashSet[Softerra.Adaxes.Adsi.Sid]"
    GetLocalGroupMember "%dNSHostName%" $localGroupName $domainSid $localAdministratorsSids $domainName
   
    # Get saved SIDs
    try
    {
        $savedSidsStrings = $Context.TargetObject.GetEx($savedSidsAttributeName)
    }
    catch
    {
        $savedSidsStrings = @()
    }
   
    $sidsToSave = New-Object System.Collections.ArrayList
    $group = $Context.BindToObjectByDN($groupDN)
    foreach ($sidString in $savedSidsStrings)
    {
        $sid = New-Object "Softerra.Adaxes.Adsi.Sid" $sidString
        if ($localAdministratorsSids.Remove($sid))
        {
            [void]$sidsToSave.Add($sid.Value)
            continue
        }
   
        # Remove user from group
        $group.Remove("Adaxes://<SID=$sid>")
    }
   
    # Add users to group
    foreach ($sid in $localAdministratorsSids)
    {
        $group.Add("Adaxes://<SID=$sid>")
        [void]$sidsToSave.Add($sid.Value)
    }
    $Context.TargetObject.Put($savedSidsAttributeName, $sidsToSave.ToArray())
    $Context.TargetObject.SetInfo()

7. Click OK.

8. Click Next and finish creating the Scheduled Task.