break on

$adsid = createobject("ADsSid")

if $adsid
 $user = getobject("WinNT://development/shawn.tassie,user")
 if $user
  $= $adsid.setas(5,$user.adspath)
  $sid = $adsid.getas(1)
  ?"sid=" $sid
 endif
endif

exit 1

code:

break on

;
; Redirect output to file: usage kix32 script $out=filename
;

if $out
 del "$out"
 $=redirectoutput("$out")
endif

; Get the domain object ...

$domain = getobject("WinNT://TASSIE")

; Filter for just groups ...

$domain.filter="group",""

; For ach group, display group name and getrid() ...

for each $object in $domain

 $rid = getrid($object.adspath)

 ?"object: " $object.name " rid: " $rid
next

exit

function GetRID($adspath)
 ;
 ;
 ; Function GetRID($ADsPath)
 ;
 ; Returns the Relative Identifier (RID) of the AD object specified
 ;
 ; Requires: 1) Windows 2000 or WindowsNT/9x /w ADSI installed
 ; 2) ADsSecurity.DLL (from the ADSI SDK)
 ;
 ; Usage:
 ; $rid = GetRID("WinNT://@LDOMAIN/@USERID,USER")
 ; $rid = GetRID("WinNT://@WKSTA/ADMINISTRATORS,GROUP")
 ;
 dim $adssid,$object,$sid,$sac,$rid
 ;
 ; Set initial function return value to zero
 ;
 $getrid = 0
 ;
 ; Create the ADsSID Security Object. This object (dll) is part of the MS ADSI 2.5 SDK
 ; available for download at Microsoft. ADsSecurity must be manually installed from the
 ; reskit with the command: regsvr32 adssecurity.dll
 ;
 $adssid = createobject("adssid")
 ;
 if $adssid = 0
  return
 endif
 ;
 ; Get a handle to the object specified in the function call ...
 ;
 $object = getobject("$adspath")
 ;
 if $object = 0
  $adssid=0
  return
 endif
 ;
 ; Call ADsSID to convert the objects ADsPath to a string version of the object's SID
 ; ADsSID is a black-box COM object. You put something in (SetAs) in a particular format
 ; (5=ADsPath), then you pull something out (GetAs) under a different format (1=SIDstring).
 ; This "SIDstring" is the elusive conversion of a non-variant byte-array that we are looking
 ; to achieve ...
 ;
 $adssid.setas(5,$adspath) ; put ADsPath in
 ;
 $sid = $adssid.getas(1) ; take SIDstring out
 ;
 ; Check to make sure we got a valid SID string ...
 ;
 if not $sid
  $object=0
  $adssid=0
  return
 endif
 ;
 ; EXTRACT RID FROM SID:
 ;
 ; ADsSID returns the Object's SID as a text string in the following format:
 ;
 ; 010500000000000515000000DCF4DC3B1525AF47A837D665F4010000
 ;
 ; This is actually the SID for the Administrator account on my Win2K workstation. The SID
 ; string can than be broken down into the following component parts:
 ;
 ; 01 - Revision
 ; 05 - SubAuthority Count
 ; 000000000005 - Identifier Authority
 ; 15000000 - SubAuthority 1 (DOMAIN INDENTIFIER)
 ; DCF4DC3B - SubAuthority 2 (DOMAIN INDENTIFIER)
 ; 1525AF47 - SubAuthority 3 (DOMAIN INDENTIFIER)
 ; A837D665 - SubAuthority 4 (DOMAIN INDENTIFIER)
 ; F4010000 - SubAuthority 5 (RID)
 ;
 ; Notice that the SubAuthority count is 5 and there are 5 trailing (matching) SubAuthorities. Most
 ; well known SIDs (Everyone,Users,Power Users) have only 2 SubAuthorities - so you must account
 ; for (n) number of these. The object's RID is always the last SubAuthority in the SID. As well,
 ; The number string is ass-backwards in terms of converting it to a real number (using val() and &)
 ; so we have to normalize this using some binary math ...
 ;
 ; Extract the SID SubAuthority Count (SAC) from the SID.
 ;
 $sac = val(substr($sid,3,2))
 ;
 if not $sac
  $object=0
  $adssid=0
  return
 endif
 ;
 ; Extract RID from SID (last sub-authority)
 ;
 $rid = substr($sid,17+($sac*8)-8,8)
 ;
 if not $rid
  $object=0
  $adssid=0
  return
 endif
 ;
 ; Convert RID little-endian , just re-reverse the bytes and convert to decimal ...
 ; Me smoke'm big peace-pipe when done - thanks for reading this far -
 ; For example this: "DCF4DC3B" becomes this: "3BDCF4DC"
 ;
 $getrid = val("&"+substr($rid,7,2)+substr($rid,5,2)+substr($rid,3,2)+substr($rid,1,2))
 ;
 ; Cleanup
 ;
 $object=0
 $adssid=0
 ;
endfunction