When using specific macros/functions in Win9x such as:

@FULLNAME
@RSERVER
InGroup()
...I haven't tested beyond this.

KiXtart bombs out completely if the user doesn't have Read permissions on the entire Active Directory. (Read on AD = go to the root of the domain in AD users & computers and check to see if everyone or said group has "Read" security access "on this object and children objects".)

We removed the default setting of Pre-Windows 2000 Compatible Access group's read privileges. We don't want just anyone to be able to read a user's attributes. So certain users can read any object in the AD domain and others can't. Those that can read -- KiXtart works great. Those that can't read -- KiXtart completely stops processing the script and just abuptly aborts as soon as I try to access one those macros/functions.

The RPC server will log an error in the application log:

Event ID: 4099
Runtime info : (Error : Access is denied. (0x5/5)
GetInfo() : NetUserGetInfo on : \\MyDC failed for MyDomain\MyUser.)

Suguestions:

1) Make KiXtart more robust so it won't bomb out. Also set @ERROR to acess denied.

2) Don't use WinNT4 system calls--use ADO to find the user and use ADSI get the displayname, etc. This way you only need List on the directory and Read on self.

{edit by moderator}
This was discussed in the thread Topic: RPC and Active Directory Perms

[ 25. October 2002, 18:03: Message edited by: LLigetfa ]