ADEdit Tcl Procedure Library Reference

This section describes the commands in the ade_lib Tcl library. The command descriptions are in alphabetical order. The syntax of each command shows optional elements in [square brackets] and variables in italics.

add_user_to_group

Use the add_user_to_group command to add an Active Directory user to an Active Directory group.

Syntax

add_user_to_group user group

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns nothing if it runs successfully.

Examples

add_user_to_group adam.avery@acme.com pubs@acme.com

Related Tcl library commands

The following commands perform actions related to this command:

• create_aduser creates a new Active Directory user account and sets its password.
• create_adgroup creates a new Active Directory group account and specifies its scope.
• create_user creates a new zone user based on an existing Active Directory user, assigns field values to the new user, and saves the new user to Active Directory.
• create_group creates a new zone group based on an existing Active Directory group, assigns it a UNIX name and group ID, and saves the new group to Active Directory.
• remove_user_from_group removes an Active Directory user from an Active Directory group.

convert_msdate

Use the convert_msdate command to specify a Microsoft date value from an Active Directory object field such as pwdLastSet and convert it into a human-readable form.

Syntax

convert_msdate msdate

Options

This command takes no options.

Arguments

This command takes the following argument:

Return value

This command returns the day of the week, the day of the month, the time of day using a 24-hour clock, the time zone, and the year.

Examples

convert_msdate [get_object_field pwdLastSet]

This example returns converted into a format similar to this:

Thu Mar 24 14:40:26 PDT 2010

The unseen value returned by get_object_field pwdLastSet in this example was 12914026824062500, which was converted to a human-readable time and date.

Related Tcl library commands

None.

create_adgroup

Use the create_adgroup command to create a new Active Directory group account with a specified distinguished name (DN), sAMAccountName, and group scope.

Syntax

create_adgroup dn sam gscope`

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns nothing if it runs successfully.

Examples

create_adgroup {CN=pubs,CN=Users,DC=acme,DC=com} pubs global

This example creates the group pubs with a global scope in the Active Directory Users container.

create_adgroup {CN=ApacheAdmins,OU=Unix Groups,OU=ACME,DC=acme,DC=com} pubs global

This example creates the group ApacheAdmins in the organizational unit Unix Groups, which is in the organizational unit ACME.

Related Tcl library commands

The following commands perform actions related to this command:

• create_aduser creates a new Active Directory user account and sets its password.
• create_user creates a new zone user based on an existing Active Directory user, assigns field values to the new user, and saves the new user to Active Directory.
• create_group creates a new zone group based on an existing Active Directory group, assigns it a UNIX name and group ID, and saves the new group to Active Directory.
• add_user_to_group adds an Active Directory user to an Active Directory group.
• remove_user_from_group removes an Active Directory user from an Active Directory group.

create_aduser

Use the create_aduser command to create a new Active Directory user account with a specified distinguished name (DN), user principal name (UPN), sAMAccountName, and password.

Syntax

create_aduser dn upn sam pw ?dname? ?gname? ?spn? ?gecos?

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns nothing if it runs successfully.

Examples

create_aduser {CN=ulysses urkham,CN=Users,DC=acme,DC=com} ulysses.urkham@acme.com ulysses.urkham {5$6fEr2B}

This example creates a new Active Directory user account ulysses.urkham@acme.com.

Related Tcl library commands

• create_adgroup creates a new Active Directory group account and specifies its scope.
• create_user creates a new zone user based on an existing Active Directory user, assigns field values to the new user, and saves the new user to Active Directory.
• create_group creates a new zone group based on an existing Active Directory group, assigns it a UNIX name and group ID, and saves the new group to Active Directory.
• add_user_to_group adds an Active Directory user to an Active Directory group.
• remove_user_from_group removes an Active Directory user from an Active Directory group.

create_assignment

Use the create_assignment command to create a new role assignment for a user or group and save it to Active Directory.

Syntax

create_assignment upn role[/zonename] [from] [to] [description]

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns nothing if it runs successfully.

Examples

create_assignment ulysses.urkham@acme.com admin/support {} {} “Test assignment”

This example creates a role assignment for the rights defined in the role “admin” from the “support” zone to the user Ulysses Urkham. The role assignment is set to start immediately (by specifying ) and never expire (by specifying the second ) and has an optional description.

create_assignment amy@example.demo mgr {2021-03-31 10:51} {2021-03-31 12:51}

This example creates a role assignment for the rights defined in the role “mgr” from the current zone to the user amy@example.com. This role assignment is set to start at a specific time and expire two hours later and has no description.

Related Tcl library commands

None.

create_dz_command

Use the create_dz_command command to create a new UNIX privileged command in the currently selected zone.

Syntax

create_dz_command dzc cmd ?desc? ?form? ?dzdo_runas? ?dzsh_runas? ?flags? ?pri? ?umask? ?path? ?selinux_role? ?selinux_type?

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns nothing if it runs successfully.

Examples

create_dz_command testvi vi {Test UNIX command vi} {} {sfapps:perez,cody} {} {16}

Related Tcl library commands

None.

create_group

Use the create_group command to create a new zone group for the currently selected zone. This command creates the new group based on an existing Active Directory group. It also assigns the new group a new UNIX profile that includes the UNIX group name and the UNIX group numeric identifier (GID).

Syntax

create_group upn name gid ?req?

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns nothing if it runs successfully.

Examples

create_group pubs@acme.com pubs 1094

Related Tcl library commands

The following commands perform actions related to this command:

• create_aduser creates a new Active Directory user account and sets its password.
• create_adgroup creates a new Active Directory group account and specifies its scope.
• create_user creates a new zone user based on an existing Active Directory user, assigns field values to the new user, and saves the new user to Active Directory.
• add_user_to_group adds an Active Directory user to an Active Directory group.
• remove_user_from_group removes an Active Directory user from an Active Directory group.

create_nismap

Use the create_nismap command to create a new NIS map in the currently selected zone.

Syntax

create_nismap map key:value comment

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns nothing if it runs successfully.

Examples

create_nismap animals {{cat:1 {The cat says "Mew\!".}} {cow:1 {The cow says "Moo\!".}}}

Related Tcl library commands

None.

create_pam_app

Use the create_pam_app command to create a new PAM application access right in the currently selected zone.

Syntax

create_pam_app name application description

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns nothing if it runs successfully.

Examples

create_pam_app testvi vi {Test UNIX command vi}

Related Tcl library commands

None.

create_role

Use the create_role command to create a new role definition in the currently selected zone.

Syntax

create_role name description sysrights pamrights cmdrights allowlocal rsenv visible

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns nothing if it runs successfully.

Examples

create_role dba {Database admins - US} 11 {{oracle} {ftp}} {{testvi} {ora-stp}}

Related Tcl library commands

None.

create_rs_command

Use the create_rs_command command to create a new restricted shell command for the currently selected restricted shell environment.

Syntax

create_rs_command rsc_name cmd description form dzsh_runas flags pri umask path

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns nothing if it runs successfully.

Examples

create_rs_command test_id id {Sample restricted command description}

Related Tcl library commands

The following commands perform actions related to this command:

• create_rs_env creates a new restricted shell environment.

create_rs_env

Use the create_rs_env command to create a new restricted shell environment for the currently selected zone.

Syntax

create_rs_env rse_name rse_description

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns nothing if it runs successfully.

Examples

create_rs_env restrictedenv “This is a restricted shell environment”

Related Tcl library commands

The following commands perform actions related to this command:

• create_rs_command creates a new restricted shell command.

create_user

Use the create_user command to create a new zone user for the currently selected zone. This command creates the new user based on an existing Active Directory user. It also assigns the new user a new UNIX profile that includes the user name, user ID, primary group ID, GECOS data, home directory, shell type, and role (or in classic zones whether the user is enabled or disabled).

You can assign the new user a role in a non-classic zone or you can enable or disable the new user in a classic zone. In a non-classic zone, create_user uses whatever role you specify to create a new role assignment object that links the new zone user to the specified role.

Syntax

create_user UPN uname uid gid gecos home shell role

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns nothing if it runs successfully.

Examples

create_user ulysses.urkham@acme.com ulysses 1005 - - %{home}/%{user} %{shell} -

This example creates a zone user “ulysses” based on the Active Directory user ulysses.urkham@acme.com. It sets a UID, does not set a GID or GECOS value by using dashes, sets home and shell values, and does not set a role value (specified by using a dash).

Related Tcl library commands

• create_aduser creates a new Active Directory user account and sets its password.
• create_adgroup creates a new Active Directory group account and specifies its scope.
• create_group creates a new zone group based on an existing Active Directory group, assigns it a UNIX name and group ID, and saves the new group to Active Directory.
• add_user_to_group adds an Active Directory user to an Active Directory group.
• remove_user_from_group removes an Active Directory user from an Active Directory group.

decode_timebox

Use the decode_timebox command to convert an internal timebox value that defines when a role is enabled or disabled into a format that can be evaluated. The command converts the internal hexadecimal value for a role timebox to a hexadecimal timebox value format as described in Timebox Value Format.

The command returns a 168-bit value in hexadecimal format that delineates the hours of the week from midnight Sunday to 11 PM Saturday in order from most-significant bit to least-significant bit. If a bit is set to 1, its corresponding hour is enabled for the role. If set to 0, its corresponding hour is disabled.

This command is useful for deciphering the value returned by the get_role_field for the timebox field.

Syntax

decode_timebox strTimeBox

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns a decoded hexadecimal value that is the timebox value for a role.

Examples

>select_role test1  
>get_role_field timebox  
FFF7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF  
>package require ade_lib  
1.0   
>decode_timebox [grf timebox]

This example returns the decoded 42 hexadecimal that indicates the role is disabled from midnight to one on Sunday:

7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

Related Tcl library commands

The following commands perform actions related to this command:

• encode_timebox converts a readable timebox value to an internal timebox format.
• modify_timebox defines an hour of the week and enables or disables that hour in the timebox value.

encode_timebox

Use the encode_timebox command to convert a human-readable timebox value that defines the when a role is enabled or disabled to an internal timebox value format.

The command converts the hexadecimal timebox value format described in Timebox Value Format to the internal hexadecimal value for a role. The command accepts a 168-bit value in hexadecimal format that delineates the hours of the week from midnight Sunday to 11 PM Saturday from most-significant bit to leastsignificant bit. If a bit is set to 1, its corresponding hour is enabled for the role. If set to 0, its corresponding hour is disabled.

This command is useful for setting the timebox field with the set_role_field command.

Syntax

encode_timebox strTimeBox

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns a decoded hexadecimal value that is the timebox value for a role.

Examples

>package require ade_lib  
>set tb 7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF  
>encode_timebox \$tb

This example returns the encoded 42 hexadecimal that indicates the role is disabled from midnight to one on Sunday:

FFF7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

Related ade_lib Tcl library commands

The following commands perform actions related to this command:

• decode_timebox converts an internal timebox value to a decipherable format.
• modify_timebox defines an hour of the week and enables or disables that hour in the timebox value.

explain_groupType

Use the explain_groupType command to convert a groupType value from an Active Directory object field into human-readable form.

Syntax

explain_groupType gt

Options

This command takes no options.

Arguments

This command takes the following argument:

Return value

This command returns a hexadecimal version of the supplied value followed by the names of any flags that are set in the value.

Examples

explain_groupType [get_object_field groupType]

This example returns:

80000004 DOMAIN_LOCALSECURITY

The unseen value returned by get_object_field groupType in this example was -2147483644, which was converted to the hexadecimal value 80000004 and the name of the set flag DOMAIN_LOCALSECURITY.

Related Tcl library commands

The following commands perform actions related to this command:

• explain_trustAttributes converts a trustAttributes value from an Active Directory object into human-readable form.
• explain_trustDirection converts a trustDirection value from an Active Directory object into human-readable form.
• explain_userAccountControl converts a userAccountControl value from an Active Directory object into human-readable form.

explain_ptype

Use the explain_ptype command to translate the account type for a role assignment into a descriptive text string.

Syntax

explain_ptype pt

Options

This command takes no options.

Arguments

This command takes the following argument:

Return value

This command returns a text string that describes the type of account associated with a role assignment.

Examples

select_role_assignment "lulu@acme.test/UNIX Login"  
get_role_assignment_field ptype  
a  
explain_ptype a

This example returns:

All AD users

The following table summarizes the descriptive names for different account types that can be associated with a role assignment:

explain_trustAttributes

Use the explain_trustAttributes command to convert a trustAttributes value from an Active Directory object field into human-readable form.

Syntax

explain_trustAttributes ta

Options

This command takes no options.

Arguments

This command takes the following argument:

Return value

This command returns a hexadecimal version of the supplied value followed by the names of any flags that are set in the value.

Examples

explain_trustAttributes [get_object_field trustAttributes]

This example returns:

8 FOREST_TRANSITIVE

The unseen value returned by get_object_field trustAttributes in this example was 8, which was converted to the hexadecimal value 8 and the name of the set flag DOMAIN_LOCALSECURITY.

Related Tcl library commands

The following commands perform actions related to this command:

• explain_groupType converts a groupType value from an Active Directory object into human-readable form.
• explain_trustDirection converts a trustDirection value from an Active Directory object into human-readable form.
• explain_userAccountControl converts a userAccountControl value from an Active Directory object into human-readable form.

explain_trustDirection

Use the explain_trustDirection command to convert a trustDirection value from an Active Directory object field into human-readable form.

Syntax

explain_trustDirection td

Options

This command takes no options.

Arguments

This command takes the following argument:

Return value

This command returns the English version of the trust direction specified by the trustDirection value.

Examples

explain_trustDirection [get_object_field trustDirection]

This example returns:

two-way

Related Tcl library commands

The following commands perform actions related to this command:

• explain_groupType converts a groupType value from an Active Directory object into human-readable form.
• explain_trustAttributes converts a trustAttributes value from an Active Directory object into human-readable form.
• explain_userAccountControl converts a userAccountControl value from an Active Directory object into human-readable form.

explain_userAccountControl

Use the explain_userAccountControl command to convert a userAccountControl value from an Active Directory object field into a human-readable form.

Syntax

explain_userAccountControl uac

Options

This command takes no options.

Arguments

This command takes the following argument:

Return value

This command returns a hexadecimal version of the supplied value followed by the names of any flags that are set in the value.

Examples

explain_userAccountControl [get_object_field userAccountControl]

returns:

10200 ADS_UF_NORMAL_ACCOUNT ADS_UF_DONT_EXPIRE_PASSWD

The unseen value returned by get_object_field userAccountControl in this example was 66048, which was converted to the hexadecimal value 10200 and the name of the set flags ADS_UF_NORMAL_ACCOUNT and ADS_UF_DONT_EXPIRE_PASSWD.

Related Tcl library commands

The following commands perform actions related to this command:

• explain_groupType converts a groupType value from an Active Directory object into human-readable form.
• explain_trustAttributes converts a trustAttributes value from an Active Directory object into human-readable form.
• explain_trustDirection converts a trustDirection value from an Active Directory object into human-readable form.

get_all_zone_users

Use the get_all_zone_users command to check Active Directory and return a list of zone users defined within the specified zone and all of its parent zones. If executed in a script, this command does not output its list to stdout, and no output appears in the shell where the script is executed.

Note that this command does not use the currently selected zone to find its list of users. It uses instead the zone specified as an argument for the command. It ignores the currently selected zone. The selected zone remains the selected zone after the command executes.

Syntax

get_all_zone_users [-upn] zone_DN

Abbreviation

None.

Options

This command takes the following option:

Arguments

This command takes the following argument:

Return value

This command returns a Tcl list of zone users defined in the currently selected zone and all of its parent zones. Each entry in the list is in the format sAMAccountName@domain. If a zone user is an orphan user (its corresponding Active Directory user no longer exists), the user is listed by its security identifier (SID) instead of the sAMAccountName.

If the -upn option is present, each entry in the returned Tcl list is a universal principal name (UPN).

Examples

get_all_zone_users engineering

The example returns the list of zone users:

adam.avery@acme.com
brenda.butler@acme.com
chris.carter@acme.com
dave.douglas@acme.com
elliot.evans@acme.com

Related Tcl library commands

The following commands perform actions related to this command:

• create_user creates a new zone user and user profile based on a specified Active Directory user.
• create_group creates a new zone group and group profile based on a specified Active Directory group.
• get_effective_groups returns a Tcl list of groups to which a specified user belongs.

get_effective_groups

Use the get_effective_groups command to return the list of effective groups from current zone up the zone hierarchy. Only groups who have a complete profile—whether defined in the current zone or inherited from a parent zone—are included.

The command supports hierarchical zone and classic zones. For classic zones, the command starts from current zone. For hierarchical zones, you can start the search for effective groups at the computer level by specifying the -hostname option.

You can use the adinfo command to return the computer name.

Syntax

get_effective_groups [-hostname computer_name]

Options

This command takes the following option:

Return value

This command returns a Tcl list of groups with complete profiles in the currently selected zone and all of its parent zones.

Example

get_effective_groups -hostname centos7.ajax.com

The example returns the list of effective groups starting at the computer level for the computer named centos7.ajax.com.

get_effective_users

Use the get_effective_users command to return the list of effective users from current zone up the zone hierarchy. Only users who have a complete profile—whether defined in the current zone or inherited from a parent zone—are included. Similarly, only users who have a role assignment in the current zone or inherited from a parent zone are included.

The command supports hierarchical zone and classic zones. For classic zones, the command starts from current zone. For hierarchical zones, you can start the search for effective users at the computer level by specifying the -hostname option.

Syntax

get_effective_users [-hostname computer_name]

Options

This command takes the following option:

Return value

This command returns a Tcl list of users with complete profiles and at least one role assignment in the currently selected zone and all of its parent zones.

Example

get_effective_users -hostname centos7.ajax.com

The example returns the list of effective users starting at the computer level for the computer named centos7.ajax.com.

get_user_groups

Use the get_user_groups command to check Active Directory for a specified user and return a list of the groups to which the user belongs. If executed in a script, this command does not output its list to stdout, and no output appears in the shell where the script is executed.

Syntax

get_user_groups [-dn] [-z] user_DN|user_UPN

Abbreviation

None.

Options

This command takes the following options:

Arguments

This command takes the following argument:

Return value

This command used without options returns a Tcl list of all groups listed in Active Directory to which the specified user belongs. Each entry in the list is the user principal name (UPN) of a group that you can use to look up that group.

If the -dn option is set, the Tcl list uses distinguished names (DNs) for groups.

If the -z option is set, the Tcl list is restricted to groups that belong to the currently selected zone.

Note that the command will not return groups for domains that aren’t currently bound to ADEdit. If the command finds one or more groups outside of the currently bound domains, it will return a “no binding” message for each unbound domain in which it finds a user’s group.

Examples

get_user_groups fred.forth@acme.com

This example returns a list of groups:

poweradmins@acme.com auditors@acme.com

Related Tcl library commands

The following commands perform actions related to this command:

• create_group creates a new zone group and group profile based on a specified Active Directory group.
• create_user creates a new zone user and user profile based on a specified Active Directory user.
• get_all_zone_users returns a Tcl list of zone users for the specified zone and all of its parent zones.

get_user_role_assignments

Use the get_user_role_assignments command to retrieve all of the role assignments in the current zone for a specified user. This command returns all of the role assignments from the groups to which the user belongs and the role assignments assigned directly to the user account.

The command checks Active Directory for the user you specify, identifies the groups that the user is a member of, then returns all the role assignments for the list of groups the user is a member and that have been specifically assigned to the user account, including any user role assignments made in computer roles for the currently selected zone.

Syntax

get_user_role_assignments [-visible] [-hostname hostname] user_DN

Abbreviation

None.

Options

This command takes the following option:

Arguments

This command takes the following argument:

Return value

This command returns a list of all role assignments for the specified Active Directory user in the currently selected zone.

Note that the command does not return role assignments for all zones where the user might be assigned a role.

Examples

select_zone
“cn=northamerica,cn=zones,ou=acme,dc=pistolas,dc=org”

get_user_role_assignments
“cn=amy.adams,cn=users,dc=pistolas,dc=org”

This example returns a list of groups:

{amy.adams@pistolas.org/UNIX Login/northamerica}
{admsf@pistolas.org/Root/sanfrancisco}
{apps@pistolas.org/demos/seattle}

Related Tcl library commands

The following commands perform actions related to this command:

• get_all_zone_users returns a Tcl list of zone users for the specified zone and all of its parent zones.
• get_effective_groups returns a list of the groups to which the user belongs.

list_zones

Use the list_zones command to list the zones within a specified domain along with information about each zone. If executed in a script, this command outputs its list to stdout so that the output appears in the shell where the script is executed. The command does not return a Tcl list back to the executing script. Use the ADEdit command get_zones to return a Tcl list.

Syntax

list_zones domain

Options

This command takes no options.

Arguments

This command takes the following argument:

Return value

This command returns a list to stdout of the zones within the specified domain. Each entry in the list contains:

• `The zone’s distinguished name (DN)
• `The zone type: tree (supported in Verify Privilege Server Suite 2012 or later), classic3 or classic4
• `The schema used in the zone

Each entry component is separated from the next by a colon (:).

Examples

list_zones

This example returns a list of zones similar to this:

{CN=default,CN=Zones,CN=Acme,DC=acme,DC=com} : classic4 : std  
{CN=cz1,CN=Zones,CN=Acme,DC=acme,DC=com} : tree : std  
{CN=cz2,CN=Zones,CN=Acme,DC=acme,DC=com} : tree : std  
{CN=global,CN=Zones,CN=Acme,DC=acme,DC=com} : tree : rfc

Related Tcl library commands

The following commands perform actions related to this command:

• create_assignment creates a new role assignment and saves it to Active Directory.
• precreate_computer creates a zone profile and, if necessary, a new Active Directory computer account.

lmerge

Use the lmerge command to merge and sort the specified lists. You specify the lists to merge as arguments. You must enclose the list commands you want to merge in square brackets.

Syntax

lmerge [list1] [list2] [list[...]]

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns nothing if it runs successfully.

Examples

lmerge [list_zone_users] [list_zone_computers] [list_roles]

This example returns a merged list of zone users, zone computers, and zone roles similar to this:

fred@pistolas.org:fred:580398:648:%{u:displayName}:%{home}/%{user}:%{shell}:  
lane@pistolas.org:lane:580397:648:%{u:displayName}:%{home}/%{user}:%{shell}:  
maya@pistolas.org:maya:580320:648:%{u:displayName}:%{home}/%{user}:%{shell}:  
ubu1$@pistolas.org: cpus(1) agentVersion(CentrifyDC 5.2.0): ubu1.pistolas.org  
nic3$@pistolas.org: cpus(2) agentVersion(CentrifyDC 5.2.0): nic3.pistolas.org  
Rescue - always permit login  
listed  
UNIX Login  
UnixAdminRights  
Windows Login

You can specify the list arguments using full command names or abbreviations. For example:

lmerge [lszc] [lspa]  
ubu1$@pistolas.org: cpus(1) agentVersion(CentrifyDC 5.2.0): ubu1.pistolas.org  
nic3$@pistolas.org: cpus(2) agentVersion(CentrifyDC 5.2.0): nic3.pistolas.org  
dzssh-all/Headquarters : dzssh-* : All of ssh services  
login-all/Headquarters : * : Predefined global PAM permission. Do not delete.

Related Tcl library commands

None.

modify_timebox

Use the modify_timebox command to modify a timebox value that defines the hours of a week when a role is enabled or disabled. The command defines an hour of the week and then enables or disables that hour in the timebox value. This command is very useful in the set_role_field ADEdit command when setting the timebox field.

Execute this command multiple times on a timebox value to set more than one hour in the value.

For more information about the timebox value format, read the Timebox Value Format.

Syntax

modify_timebox strTimeBox day hour avail

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns a hexadecimal value that is the timebox value after enabling or disabling the specified hour of the week.

Examples

set tb 000000000000000000000000000000000000000000

set tb [modify_timebox $tb 6 23 1]

This example returns the modified timebox value:

800000000000000000000000000000000000000000

Related Tcl library commands

The following commands perform actions related to this command:

• decode_timebox converts an internal timebox value to a decipherable format.
• encode_timebox converts a readable timebox value to an internal timebox format.

precreate_computer

Use the precreate_computer command to create a zone profile for a computer in Active Directory before using the adjoin command to join the domain. The zone profile—a serviceConnectionPoint (scp) object—is usually created by the adjoin command when a computer joins the domain. In some cases, however, creating the zone profile before joining is useful. For example, preparing the computer object before joining enables you to check that you have user profiles and role assignments correctly defined before you join UNIX computers to zones. Verifying this information before the join operation helps to ensure a smooth migration without disrupting users’ access to files or applications.

The zone profile is part of an Active Directory computer object. If an Active Directory computer object doesn’t exist, precreate_computer can create one and then add the zone profile to the new Active Directory computer object. The zone profile is created in ADEdit’s currently selected zone. You can also use the precreate_computer command to specify a container where Active Directory will store the new Active Directory computer object.

You can use the precreate_computer command to create a service connection point for a new or existing Active Directory computer object. You can also use the command to create a computer-specific zone for machine-level zone overrides (in essence a one-computer zone) for the precreated computer. You should note that performing these tasks requires access to the global catalog by default. You can intentionally skip the global catalog search if you know the service connection point you are creating is unique in the forest. However, skipping the global catalog search might prevent you from joining the computer to the domain if there is a conflict.

The precreate_computer command also sets the Active Directory computer object’s password and permissions when creating a zone profile. The password is the computer’s host name in lower case. The permissions the computer object has are:

• Read and Write permissions to the operatingSystemServicePack, operatingSystem, and operatingVersion attributes of the computer object.
• Read permission for the userAccountControl attribute of the computer object.
• Validate write to the servicePrincipalName and dNSHostName attributes.

You can use precreate_computer to specify a DNS name for the precreated computer and one or more trustees for the precreated computer. Each trustee can be either a user or a group, and has the rights needed to join the computer to the precreated computer account using adjoin.

Use the precreate_computer command option, enctype, to specify encryption types.

The precreate_computer command is similar to using adjoin -precreate, but provides more options and flexibility. You can also precreate computer accounts using Access Manager. For more information about precreating computer accounts, See the Administrator’s Guide for Linux and UNIX.

Syntax

precreate_computer *samaccount@domain*[-ad] [-scp] [-czone] [-all] [-container *rdn*]   
[-dnsname *dnsname*] [licensetype *type*] [-trustee *upn*[-trustee *upn*] ...] [nogc]   
[stype *spn* [-stype *spn*] ...] [-enctype type [-enctype type] ...]   
[-notdelegateanyright] [-password <password>]

Options

This command takes the following options:

Arguments

This command takes the following argument:

Return value

This command returns nothing if it runs successfully.

Examples

precreate_computer redhat\$@acme.com -trustee adam.avery@acme.com  
\-trustee martin.moore@acme.com -enctype arcfour-hmac

This example precreates a zone profile in the currently selected zone for the computer “redhat$@acme.com”, and specifies as trustees the Active Directory users Adam Avery and Martin Moore.

Because the example does not include the -stype option, this example also automatically creates the following default service principal names for services on the computer:

• ipp/redhat and ipp/redhat.acme.com
• afpserver/redhat and afpserver/redhat.acme.com
• nfs/redhat and nfs/redhat.acme.com
• cifs/redhat and cifs/redhat.acme.com
• ftp/redhat and ftp/redhat.acme.com
• http/redhat and http/redhat.acme.com
• host/redhat and host/redhat.acme.com

Related Tcl library commands

The following commands perform actions related to this command:

• list_zones returns a list of zones in a specified domain to stdout.
• create_assignment creates a new role assignment and saves it to Active Directory.

remove_user_from_group

Use the remove_user_from_group command to remove an Active Directory user from an Active Directory group.

Syntax

remove_user_from_group user group

Options

This command takes no options.

Arguments

This command takes the following arguments:

Return value

This command returns nothing if it runs successfully.

Examples

remove_user_from_group adam.avery@acme.com pubs@acme.com

Related Tcl library commands

The following commands perform actions related to this command:

• create_aduser creates a new Active Directory user account and sets its password.
• create_adgroup creates a new Active Directory group account and specifies its scope.
• create_user creates a new zone user and user profile based on an existing Active Directory user.
• create_group creates a new zone group and group profile based on an existing Active Directory group.
• add_user_to_group adds an Active Directory user to an Active Directory group.

set_change_pwd_allowed

Use the set_change_pwd_allowed command to modify the ADS_UF_PASSWD_CANT_CHANGE flag in the UserAccountControl attribute. This flag controls whether an Active Directory user can change his or her domain password. You must specify the distinguished name of a valid Active Directory user account that should be allowed to change his or her password.

Syntax

set_change_pwd_allowed userdn

Options

This command takes no options.

Arguments

This command takes the following argument:

Return value

This command returns nothing if it runs successfully.

Examples

set_change_pwd_allowed 
CN=frank.smith,CN=Users,DC=ajax,DC=test

get_object_field sd

(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)
(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)

This example deselects the “User cannot change password” account property for the Active Directory user frank.smith.

Related Tcl library commands

The following commands perform actions related to this command:

• create_aduser creates a new Active Directory user account and sets the password for the account.
• set_change_pwd_denied prevents an Active Directory user from changing the domain password for his or her account.

set_change_pwd_denied

Use the set_change_pwd_denied command to modify the ADS_UF_PASSWD_CANT_CHANGE flag in the UserAccountControl attribute. This flag controls whether an Active Directory user can change his or her domain password. You must specify the distinguished name of a valid Active Directory user account that should not be allowed to change his or her password.

Syntax

set_change_pwd_denied userdn

Options

This command takes no options.

Arguments

This command takes the following argument:

Return value

This command returns nothing if it runs successfully.

Examples

set_change_pwd_denied CN=adam.avery,CN=Users,DC=ajax,DC=test

get_object_field sd

(OD;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)
(OD;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)

This example selects the “User cannot change password” account property for the Active Directory user adam.avery.

Related Tcl library commands

The following commands perform actions related to this command:

• create_aduser creates a new Active Directory user account and sets the password for the account.
• set_change_pwd_allowed allows an Active Directory user to change the domain password for his or her account.