New to Windows Server 2003 is the Trustmon WMI provider. The Trustmon provider allows you to query the list of trusts supported on a domain controller and determine if they are working correctly. The Trustmon provider consists of three classes, but the primary one is the Microsoft_DomainTrustStatus class, which represents each trust the domain controller knows about. The Trustmon provider is contained under the root\MicrosoftActiveDirectory namespace. Note that this namespace is different than for the Active Directory provider, which is contained under root\directory\ldap.
Table 26-6 provides a list of the property methods available to this class.
Property |
Description |
---|---|
Flatname |
NetBIOS name for the domain. |
SID |
SID for the domain. |
TrustAttributes |
Flag indicating special properties of the trust. Can be any combination of the following:
|
TrustDCName |
Name of the domain controller the trust is set up with. |
TrustDirection |
Integer representing direction of the trust. Valid values include:
|
TrustedDomain |
Naming of trusted domain. |
TrustIsOK |
Boolean indicating whether the trust is functioning properly. |
TrustStatus |
Integer representing the status for the trust. 0 indicates no failure. |
TrustStatusString |
Textual description of status for the trust. |
TrustType |
Integer representing the type of trust. Valid values include:
|
As you can see from Table 26-6, the Microsoft_DomainTrustStatus class provides just about all the information you'd want to know concerning a trust. The following example shows how easy it is to enumerate all the trusts using this class:
strComputer = "." Set objWMI = GetObject("winmgmts:\\" & strComputer & _ "\root\MicrosoftActiveDirectory") Set objTrusts = objWMI.ExecQuery("Select * from Microsoft_DomainTrustStatus") for each objTrust in objTrusts Wscript.Echo objTrust.TrustedDomain Wscript.Echo " TrustedAttributes: " & objTrust.TrustAttributes Wscript.Echo " TrustedDCName: " & objTrust.TrustedDCName Wscript.Echo " TrustedDirection: " & objTrust.TrustDirection Wscript.Echo " TrustIsOk: " & objTrust.TrustIsOK Wscript.Echo " TrustStatus: " & objTrust.TrustStatus Wscript.Echo " TrustStatusString: " & objTrust.TrustStatusString Wscript.Echo " TrustType: " & objTrust.TrustType Wscript.Echo "" next
Next, let's illustrate a script that finds any trust that has some kind of failure. All we need to do is modify the WQL query in the previous example to include a where TrustIsOk = False clause. We then print out the TrustStatusString property, which will return a description of the failure.
strComputer = "." Set objWMI = GetObject("winmgmts:\\" & strComputer & _ "\root\MicrosoftActiveDirectory") Set objTrusts = objWMI.ExecQuery("Select * from Microsoft_DomainTrustStatus " & _ "where TrustIsOk = False ") if objTrusts.Count = 0 then Wscript.Echo "There are no trust failures" else for each objTrust in objTrusts Wscript.Echo objTrust.TrustedDomain & " - " & objTrust.TrustStatusString Wscript.Echo "" Next end if
One of the neat features of the Trustmon provider is that it is configurable. Through WMI you can modify what type of checks it does to determine trust failures and also how long to cache information it retrieves. All of this is done with the Microsoft_TrustProvider class. Table 26-7 contains a list of all property methods for this class.
Property |
Description |
---|---|
TrustListLifetime |
Number of minutes to cache the last trust enumeration (20 is the default). |
TrustStatusLifetime |
Number of minutes to cache the last trust status request (3 is the default). |
TrustCheckLevel |
Number representing the type of check to perform against each trust during enumeration (2 is the default). Valid values include:
|
ReturnAll |
Boolean indicating whether both trusting and trusted domains are enumerated. True is the default, which indicates to check both trusting and trusted domains. |
Now we will show a simple script that changes the default settings for the Trustmon provider. In the following example, we set the TrustListLifetime to 15 minutes, the TrustStatusLifetime to 5 minutes, and the TrustCheckLevel to 1.
strComputer = "." Set objTrustProv = GetObject("winmgmts:\\" & strComputer & _ "\root\MicrosoftActiveDirectory:Microsoft_TrustProvider=@") objTrustProv.TrustListLifetime = 15 ` 15 minutes objTrustProv.TrustStatusLifetime = 5 ` 5 minutes objTrustProv.TrustCheckLevel = 1 ` Enumerate with SC_QUERY objTrustProv.Put_
The Trustmon provider is a great example of how to utilize WMI in the Active Directory space. What previously could only have been done with command-line utilities or MMC snap-ins can now be done programmatically very easily.