DSRAZOR for eDirectory

[FIX]
Corrected an issue when running certain applets with multiple container tokens.

[FIX]
Corrected the service called "NW:SEARCH:List All Directories Only on selected Volume (or beginning in selected directory) to specified Depth" so it will now search the specified number of directory levels beneath the starting directory, instead of beneath the root of the volume.

[UPDATED APPLET]
The applet called "Document Trustees by Directory" in the Query and Search eDirectory section of the DSRAZOR Console has been updated so it can search the specified number of directory levels (in this case the default is 4 levels) beneath the selected starting directory, rather than searching 4 levels beneath the root of the volume.

DSRAZOR for eDirectory

[NEW]
This new display service "NDS:RULE:Exclude Named Object Class from NDS:SEARCH:03:Admin User Scan (rule operator NOT is implied regardless of actual value)" can be used to exclude a certain object class from the high level effective eDirectory privileges scan. For example, perhaps you want to know who has high level effective eDirectory privileges to other objects in your Tree, but you already know that many people in your Tree have privileges to printers. In that case, you could use this new service to exclude the printer object class by adding it as a rule to the "NDS:SEARCH:03:List All Users that have any [Super;Add;Delete;Rename] Entry perms or [Super;Write;AddSelf] Attr perms to any NDS object in selected Tree" service.

[NEW]
This new display service "NDS:SEARCH:03:STOP PROCESSING at specified DayOfWeek:HHMM (where 0=Sun, 1=Mon .. 5=Fri, and HH is 24 hour time and MM is minutes) (5:1900 = Friday at 7pm)" can be used to indicate a day of the week and time when the eDirectory Privilege scan service will be stopped. Scheduling a planned stop of the scan can be useful in large environments where the applet may take a long time to run, to be sure that the scan stops deliberately and cleanly prior to events that would terminate the scan unexpectedly or suddenly.

[NEW]
This new display service "NDS:SEARCH:03:SKIP AHEAD TO USER # (starts at first user if file C:\_USER.IDX is not present)" is necessary if you want to stop the eDirectory Privileges scan at a designated day and time and then restart it again later. This service keeps track of the number of the last user that was processed in the C:\TREE[TreeName]_USER.IDX file. After a scheduled stop of the applet, as long as you leave C:\TREE[TreeName]_USER.IDX file and the C:\ObjectList.TreeName file intact, you can run the applet again later and the scan will pick up where it left off.

[NEW]
This new listing service "NDS:SEARCH:05:List All Users w/any permissions to any path SYS:* except SYS:LOGIN & SYS:PUBLIC on any NCP Server object in selected Tree (specify dir depth)" will find all users who have effective File System Rights to directories on the SYS: volume of any server. It will check directories up to the specified directory depth level. It checks most directories on the SYS: volume to the designated depth, but it excludes the SYS:Login directory structure, the SYS:Public directory structure, the SYS:Network Trash Folder directory, and the SYS:ndps/XFER directory.

[NEW APPLET]
The new applet called "Find Elevated Users (Sample 2)" in the Assess eDirectory Security section of the DSRAZOR Console is an example of how the new service called "NDS:SEARCH:05:List All Users w/any permissions to any path SYS:* except SYS:LOGIN & SYS:PUBLIC on any NCP Server object in selected Tree (specify dir depth)" can be used in an Elevated Users applet.

[UPDATED APPLET]
The applet called "Who has high level effective eDirectory Privileges to other Objects" in the Assess eDirectory Security section of the DSRAZOR Console has been updated to say that if desired, the applet can now be set to exclude specific object classes and/or specific attributes from the eDirectory Privileges scan.

[UPDATED APPLET]
The applet called "Document Trustees by Directory" in the Query and Search eDirectory section of the DSRAZOR Console has been updated to have separate options for NetWare Servers and SUSE Linux Enterprise Servers. For NetWare, the applet searches up to 4 levels beneath the starting directory you select. For Linux, the applet searches up to 4 levels beneath the root of the volume (even if the starting directory for the search is not at the root level). The applet can be modified to search to a different directory depth level, if you would like it to search more than 4 levels deep or less than 4 levels deep.

DSRAZOR for Windows

[NEW SERVICES]
AD:AUTO:SAMNAME:Auto-populate using Rules 1-5(use with Button Service: "AD:Create User + Require EDIT Services...")
AD:AUTO:SAMNAME:Rule 1:(use with Display Service "AD:AUTO:SAMNAME")
AD:AUTO:SAMNAME:Rule 2:(use with Display Service "AD:AUTO:SAMNAME")
AD:AUTO:SAMNAME:Rule 3:(use with Display Service "AD:AUTO:SAMNAME")
AD:AUTO:SAMNAME:Rule 4:(use with Display Service "AD:AUTO:SAMNAME")
AD:AUTO:SAMNAME:Rule 5:(use with Display Service "AD:AUTO:SAMNAME")
AD:AUTO:ALL Attribute Rules 1-5:Make custom built rule result all UPPERCASE (use with Button Service: "AD:Create Users + Require EDIT Services")
AD:AUTO:ALL Attribute Rules 1-5:Make custom built rule result all lowercase (use with Button Service: "AD:Create Users + Require EDIT Services")

[FIX]
Suppressed a popup error on AD trustee reports when an orphaned SID is encountered as a trustee for an AD object.

DSRAZOR for eDirectory

[NEW]
This new display service "NDS:RULE:Exclude Named Attribute from NDS:SEARCH:03:Admin User Scan (rule operator NOT is implied regardless of actual value)" can be used to exclude a certain attribute from the high level effective eDirectory privileges scan. For example, perhaps you want to know who has high level effective eDirectory privileges to other objects in your Tree, but you already know that everyone in your Tree has write privilege to the specific attribute zenzfdVersion. In that case, you could use this new service to exclude the zenzfdVersion attribute by adding it as a rule to the "NDS:SEARCH:03:List All Users that have any [Super;Add;Delete;Rename] Entry perms or [Super;Write;AddSelf] Attr perms to any NDS object in selected Tree" service.

DSRAZOR for Windows

[FIX]
Corrected a problem encountered with not setting home directory permissions + ownership when using the Copy User button service in conjunction with using the Zero Privilege service.

DSRAZOR for Windows

[FIX]
Corrected a problem encountered when using the Copy User button service in conjunction with the "AD:RULE:Force all AD change operations..." service.

DSRAZOR for eDirectory

[NEW]
This new display service "NDS:FOR 01:02:03 OBJECT SEARCH, RESTRICT SEARCH TO SELECTED CONTAINER PATH" can limit the scope of the "NDS:SEARCH:NN:List All Users..." searches to a specified container (instead of searching the whole Tree). This can be useful if you only need to look at part of a Tree, starting from a certain container and including the sub-containers beneath. Note that if this optional service is used, the search results will be limited to showing only users within the specified container branch who have rights/privileges/etc. to objects that are also within the specified container branch.

[FIX]
Corrected a problem with the path indicators for the service "NW:Modify Existing File System Trustee Assignments for immediate subdirectories of selected directory". Now the applet called "Set File System Rights of All Subdirectories" in the Assess eDirectory Security section of the DSRAZOR Console will work.

[MODIFIED]
The display service previously called "NDS:SEARCH:NN:RECORD Specific Reason user added to '01,02,03,nn' list to file C:\DSRSECURE.TXT", is now called "NDS:SEARCH:NN:RECORD Specific Reason user added to '01,02,03,nn' list to file C:\Tree[(starting container)]DSRSECURE.TXT". The file name will now include the name of the Tree the applet is reporting about, so that customers who have multiple Trees can easily know which file is for which Tree.

[UPDATED APPLET]
The applet called "eDirectory Partition Status Report" in the Query and Search eDirectory section of the DSRAZOR Console now includes a column to show the Partition State.

[UPDATED APPLET]
The applet called "Change selected Multi-Valued Attributes" in the eDirectory User Maintenance section of the DSRAZOR Console now includes the ability to add/remove descriptions.

[UPDATED APPLET]
The three "Enterprise File Server Status" applets in the Examine Servers/Disks section of the DSRAZOR Console now have options for either displaying the results on screen or sending the results directly out to a CSV file. Sending the results directly to a CSV file can be faster, especially in large Trees. Displaying the results on screen can be good if you want to watch the activity changes for a while (for example, the CPU % In Use data refreshes every second).

DSRAZOR for Windows

[NEW]
"AD:RULE:Force all AD change operations to named Domain Controller (to specify: user "ComputerName")" Use this text service on the first page of an applet to force it to read and commit changes to the Domain Controller specified in the "Manual Entry Text:" field.

[FIX]
"AD:Display logonHours grid for selected User - Allow changes for one or multiple accounts". Fixed a problem that would cause the applet to close unexpectedly when clicking on a button that uses this service. Problem only occurred for users in specific time zones.

DSRAZOR for eDirectory

[NEW]
This new listing service will find all users who are explicitly/directly assigned as Console Operators of NCP Servers, plus all users who are security equivalent to the Console Operator users, plus if there are Groups that are assigned as Console Operators it will include the members of those Groups. It works with both NetWare and Linux eDirectory servers:
"NDS:SEARCH:04:List All Users (+Sec.Eq to Me Users & Group Members) that are Console Operators of any NCP Server object from Root of selected Tree"

[NEW]
This new display service creates an optional text file C:\DSRSECURE.TXT of the users found by one or more of the NDS:SEARCH:NN:List All Users. services which provides some details about why each user is listed. For example, when searching for Console Operators, the C:\DSRSECURE.TXT file will indicate which server the user is Console Operator for:
"NDS:SEARCH:NN:RECORD Specific Reason user added to '01,02,03,nn' list to file C:\DSRSECURE.TXT"

[FIX]
This new version of CVMONE.NLM (version 1.75.11 or 1.75k) fixes a problem in some environments where if a user is set to "Password Unique Required", when changing their password via CVMONE you would get a "Password Entered is a DUPLICATE of a previous password. Please enter a different password" error message, even if you were using a password that hadn't been already used previously

[UPDATED APPLET]
The applet called "Find Users who are Console Operators of the Servers" in the Assess eDirectory Security section of the DSRAZOR Console has been updated. In addition to the two previous options in the applet (Console Operators organized by Server, and Explicit Console Operators organized by User), there is now a new third option (Effective Console Operators organized by User). The new third option finds the users who are directly Console Operator, plus Users who are Security Equivalent to them, plus members of any Groups that are Console Operators.

DSRAZOR for eDirectory

[NEW]
This new listing service will show directories and works with both NetWare and Linux eDirectory servers:
"NW:SEARCH:List All Directories Only on selected Volume (or beginning in selected directory)"

[NEW]
This new listing service will show directories, but only to a specified directory depth (such as showing only 2 directory levels deep) and works with both NetWare and Linux eDirectory servers:
"NW:SEARCH:List All Directories Only on selected Volume (or beginning in selected directory) to specified Depth"

[NEW]
This new listing service will show directories and files, but only to a specified directory depth (such as showing only 2 directory levels deep) and works with both NetWare and Linux eDirectory servers:
"NW:SEARCH:List All Directories and Files on selected Volume (or beginning in selected directory) to specified Depth"

[NEW]
This new listing service will find all users who are explicitly Console Operators of any eDirectory servers:
"NDS:SEARCH:01:List All Users that are Console Operators of any NCP Server object from Root of selected Tree"

[NEW]
This new listing service will find all users who have high level effective File System Rights to a specified directory or a specified file on any server. It scans for users who have any combination of Supervisor, Write, Create, Erase, Modify, and AccessControl effective file system rights to the directory or the file on any server. (It excludes users who only have Read and/or Browse file system rights). An applet can use this service once to search only one specified directory/file on all the servers, or an applet can use multiple instances of this service so you can scan the rights to multiple directories/files in the same applet.
"NDS:SEARCH:02:List All Users that have any [S WCEM A] permissions to specified path on any NCP Server object in selected Tree"

[NEW]
This new listing service will find all users who have high level effective eDirectory Privileges to other objects in the Tree. It scans for users who have any combination of Supervisor, Add(Create), Delete, Rename, Write, or AddSelf privileges to other objects. Users who only have those privileges to their own user object (themselves) are excluded from the list.
"NDS:SEARCH:03:List All Users that have any [Super;Add;Delete;Rename] Entry perms or [Super;Write;AddSelf] Attr perms to any NDS object in selected Tree"

[NEW]
This new listing service is used in a TreeView or ListView to show the results found by the new "NDS:Search01...", "NDS:Search02...", and "NDS:Search03..." services documented above. Although the service title only mentions TreeViews, the service could actually be used in a ListView instead.
"NDS:SEARCH:END:List All Users found based on the '01,02,03' services combined - must be last service in Treeview"

[NEW]
This new display service is used to indicate where to save the Object List file that DSRAZOR creates when doing the scans in the new "NDS:Search01...", "NDS:Search02...", and "NDS:Search03..." services documented above. The extension of the Object List file will be the name of the Tree. Re-using the same Object List file for future runs of the applet will save time. However, re-using the file for future runs of the applet means that any objects that were newly added to the Tree after the Object List file was initially created will NOT be included in subsequent reports. If when you run the applet again in the future you want it to scan ALL objects including any newly added objects (such as new users created recently), be sure to delete any old Object List files before you re-run the applet. If you want DSRAZOR to save the Object List file for future use, be sure to indicate a valid path for the Object List file. If you prefer to NOT save Object List files for future use (so a new up-to-date Object List is created each time you run the applet), simply indicate an invalid path for the Object List file. By specifying a path that does not exist, DSRAZOR will not be able to save the Object List file for future use.
"NDS:FOR 01:02:03 OBJECT SEARCH, AUTO RECALL NDS OBJECT FROM PREDEFINED FILE (WILL AUTO APPEND TREE NAME)"

[NEW]
This new display service can display all of the values of a multi-valued attribute in the same cell/box in a ListView. The data will show a pipe character (|) as a separator between the different values of the attribute.
"NDS:Display all values of selected multi-valued attribute, use pipe (|) symbol as value separator"

[NEW]
This new display service can check servers to find which servers have a specified string in a certain file. The file name/location and then the string to look for are entered into the Manual Entry Text field of the Rule with a pipe character (|) between them.
"NW:RULE:Scan defined file on Selected Server for specified string, use pipe to separate file and search string, returns TRUE if found"

[NEW]
This new display service can check NetWare servers to find which servers have a specific NLM loaded. The name of the NLM to look for is entered into the Manual Entry Text field of the Rule.
"NW:RULE:Display IF selected NLM Name is currently loaded on the Selected server"

[NEW]
This new display service can check servers to find which servers have a Last Modified date for a specified file that is more than a certain number of days ago. The file name/location and then the number of days ago are entered into the Manual Entry Text field of the Rule with a pipe character (|) between them.
"NW:RULE:Display IF defined file on the Selected Server was modified more than X days ago"

[UPDATE]
This listing service has been updated to accept items dragged from a ListView or a TreeView. Because you can now drag them from a ListView, you can select multiple users/groups or all/users groups (instead of previously where users/groups could only be dragged one at a time from a TreeView).
"FILE:List Derivation of Trustee Assignments for Drag and Dropped Users + Directories/Files"

[NEW APPLET]
"Find Elevated Users (sample)" is a new applet in the Assess eDirectory Security section. The applet scans the Tree to find Elevated Users, based on sample criteria. The applet currently finds users who have any combination of the following:
- High Level effective eDirectory Privileges (Supervisor, Create, Rename, Delete, Write, AddSelf) to other objects in the Tree (not themselves)
- High Level effective File System Rights (Supervisor, Write, Create, Erase, Modify, AccessControl) to the SYS:SYSTEM directory or the SYS:APACHE directory, or the SYS:APACHE2 directory
- Explicit assignment of Console Operator of any server If your criteria for determining Elevated Users is different than what is listed above, it may be possible to change the applet accordingly. One example is that if you are not concerned about Console Operators, that part can be removed from the applet completely. Another example is that the applet could check for who has high level effective file system rights to other directories or additional directories (such as SYS:ETC or DATA:FINANCE). Although some of the directories mentioned here are typically found on NetWare Servers, the applet could also be used to look at directories on NSS volumes of SUSE Linux Enterprise Servers.

[NEW APPLET]
"Find Servers that have a Specific NLM Loaded" is a new applet in the Examine Servers/Disks section. The applet checks each NetWare server to see if a specific NLM is currently loaded or not. DSRAZOR's optional CVMONE.NLM is used as an example, but the applet can be modified to look for a different NLM instead.

[NEW APPLET]
"Find Servers where a Specific File was Last Modified more than X Days Ago" is a new applet in the Examine Servers/Disks section. The applet checks each server to see if the SYS:ETC\HOSTS file was modified more than 30 days ago. This is just an example of this type of applet - the applet can be easily changed to check the Last Modified date of a different file and/or to look for a different number of days ago. Although the example file mentioned here is typically found on NetWare Servers, the applet could also be used to look at files on NSS volumes of SUSE Linux Enterprise Servers.

[NEW APPLET]
"Find Users who are Console Operators of the Servers" is a new applet in the Assess eDirectory Security section. The applet has two options for showing explicit Console Operator assignments - one method organizes the report by User, and the other method organizes the report by Server.

[NEW APPLET]
"Objects (all) with NDS S, C or W Rights" is a new applet in the Assess eDirectory Security section. The applet finds all eDirectory objects that have explicit Trustees with Supervisor or Create or Write privileges to other objects in the Tree. It shows the eDirectory privileges assigned and also shows who is security equivalent to the objects that have the Supervisor or Create or Write privileges.

[NEW APPLET]
"Search for a Specific String in a Certain File on All Servers" is a new applet in the Examine Servers/Disks section. The applet checks each server to see if the SYS:SYSTEM\AUTOEXEC.NCF file contains the string "LOAD RCONAG6". This is just an example of this type of applet - the applet can be easily changed to search for a different specific string within a different designated file. Although the example file mentioned here is typically found on NetWare Servers, the applet could also be used to look at files on NSS volumes of SUSE Linux Enterprise Servers.

[NEW APPLET]
"Who has high level effective eDirectory Privileges to other Objects" is a new applet in the Assess eDirectory Security section. The applet scans the Tree to find users who have any combination of the following:
- High Level effective eDirectory Privileges (Supervisor, Create, Rename, Delete, Write, AddSelf) to other objects in the Tree
The applet does not include users who only have privileges to themselves nor users who only have low level (Read, Compare, Browse) privileges to other objects.

[NEW APPLET]
"Who has high level effective File System Rights to a specific Directory" is a new applet in the Assess eDirectory Security section. The applet scans the Tree to find users who have any combination of the following:
- High Level effective File System Rights (Supervisor, Write, Create, Erase, Modify, AccessControl) to the SYS:SYSTEM directory
The SYS:SYSTEM directory is an example, the applet could be changed to look for a different directory. Although the directory mentioned here is typically found on NetWare Servers, the applet could also be used to look at directories on NSS volumes of SUSE Linux Enterprise Servers.

[NEW APPLET]
"User Information Report" is a new applet in the Query and Search eDirectory section. The applet shows users and information about them - full name, department, title, location, email address, last login, eDirectory status, phone numbers, fax numbers, group memberships, security equivalences, and descriptions. If there is more than one value for the attribute, the values are separated by a pipe character (|). This applet gives useful information about users and also illustrates how DSRAZOR can now show multiple values of the same attribute in the same box of a ListView - this particular format is a new option. The applet can be modified to show other eDirectory attributes of the users if you want to see different or additional attributes in the report.

[UPDATED APPLET]
The applet called "Document Effective File System Rights" in the Assess eDirectory Security section has been updated. One change to the applet is that you can drag and drop multiple users/groups or all users/groups in Step 3 (previously you could only drag and drop one user or group at a time). Another change to the applet is that it is now set to search only two directory levels deep for both NetWare servers and SUSE Linux Enterprise Servers. The directory depth can be set to a higher amount if needed, but scanning more directory levels will take the applet longer to run.

[UPDATED APPLET]
The applet called "Who has access to a specific File" in the Assess eDirectory Security section has been updated. It now has two options for looking at effective file system rights for a specific File. the first method will show only the list of users who have HIGH LEVEL effective file system rights (S WCEM A) to the file on any server. The second method will show users who have ANY effective rights (SRWCEMFA) to the file, plus it will also show what rights they have. SYS:SYSTEM\AUTOEXEC.NCF is an example, the applet can be changed to look at rights to a different file instead. Although the example file mentioned here is typically found on NetWare Servers, the applet could also be used to look at files on NSS volumes of SUSE Linux Enterprise Servers.

[UPDATED APPLET]
The applet called "Find Directories with an Inheritance Filter" in the Examine Servers/Disks section has been updated. One change is that there is now just a single applet for both NetWare servers and SUSE Linux Enterprise Servers (previously there were separate applets for different server platforms). Another change to the applet is that it is now set to search only three directory levels deep for both NetWare servers and SUSE Linux Enterprise Servers. The directory depth can be set to a higher amount if needed, but scanning more directory levels will take the applet longer to run.

[UPDATED APPLET]
The applet called "Document Trustees by Directory" in the Query and Search eDirectory section has been updated. The applet is now set to search only four directory levels deep for both NetWare servers and SUSE Linux Enterprise Servers. The directory depth can be set to a higher amount if needed, but scanning more directory levels will take the applet longer to run.

DSRAZOR for eDirectory - CVMONE.NLM

[NEW]
CVMONE.NLM version 1.75.10 (or higher) can be used to allow helpdesk staff to create new groups without giving the helpdesk staff elevated privileges.

[FIX]
CVMONE.NLM version 1.75.10 now correctly sets values for the following attributes during user creation - Login Grace Limit, Login Maximum Simultaneous, Password Expiration Interval, and Password Minimum Length.

DSRAZOR for Windows

DSRAZOR for eDirectory

DSRAZOR for Windows

[UPDATE]
Edit fields with pre-defined values now accept values larger than 64 characters.

Increased performance for Active Directory searches.

[NEW]
Added two new button services to search for computers:

"AD:Search for any COMPUTER object by Name beginning at selected Container or DNS Domain Root (auto append '*')"

"AD:Search for any COMPUTER object by Name beginning at selected Container or DNS Domain Root (auto append '*') [Clear Previous Results]"

DSRAZOR for eDirectory

DSRAZOR for eDirectory

DSRAZOR

DSRAZOR for Windows Zero Privilege Help Desk

[FIX]
Corrected a problem in name resolution when running the agent on a 2008, 32-bit server. Zero Privilege enabled applets should no longer give error message "0x8007203B".

DSRAZOR for eDirectory

[UPDATED APPLET]
The "Disk Space in use, Files Owned/Unowned" applet has been updated to replace the "bytes" labels with "KB".

[UPDATED APPLETS]
The following applets have been updated to give you the choice of whether to run them from a specific Container or the whole Tree:
"Enterprise File Server Status (All servers)"
"Enterprise File Server Status (Linux only)"
"Enterprise File Server Status (NetWare only)"

DSRAZOR for Windows

[FIX]
DSRAZOR for Windows now allows population of Boolean and Integer attributes using pre-defined values field.

[FIX]
Corrected a problem with the Output To File display on the Effective File System Permissions report. The problem only seemed to occur if the file system objects had several orphaned permissions assigned to it.

DSRAZOR for eDirectory

[FIX]
Corrected a problem with the entry stamps for NDPS print jobs were off by one hour with the service:
"NWNDPS:Display Print Job's entry into Queue".

[FIX]
Eliminated token errors from the last part of the "Enterprise Volume Space Report" applet (the view that shows the selected volume's disk space by user).

[FIX]
Corrected a problem where sending to multiple NetWare servers gave a W34 error when using the "Send Commands to Servers without RCONSOLE" applet.

[UPDATED APPLET]
The "Send Commands to Servers without RCONSOLE" applet has been updated to make it easier to select multiple NetWare servers or all of your NetWare servers.

DSRAZOR for eDirectory

[FIX]
Corrected a directory name issue with the applet "Document Trustees by directory" (TRBYDIR4.DSR) on a Windows 7, 64bit OS.

DSRAZOR for Windows Zero Privilege Help Desk

[FIX]
Corrected an issue encountered when using the copy user button service through zero privilege without the "Preferred DC" defined. The copy user button service now works fine without a Preferred DC defined.

DSRAZOR for eDirectory

DSRAZOR for Windows Zero Privilege Help Desk

[FIX]
Corrected an issue with the "Who can use DSRWZP" configuration where allowed groups would stop being allowed to use ZP after a period of time in certain situations.

DSRAZOR for Windows

[NEW]
Applet "List Local Group membership (OTF)"
[LocalGroupMembership_OTF.dsr]
This applet will document the members of all local groups on selected workstations or servers.

DSRAZOR for Windows

[NEW]
Button service "AD:Copy selected Object's 'memberOf' (specified by Display Service - RULE:Canonical Name for copy 'memberOf') to selected Objects".
Display service "AD:RULE:Display Object's Distinguished Name (Canonical Name)(Specifies Source Object to copy its 'memberOf' attribute)"
These new services allow you to copy the group membership from one selected Active Directory object to another selected Active Directory object.

[NEW]
Applet "Copy Group Memberships"
[CopyGroupMembership1.dsr]
This new applet demonstrates how to copy group membership from one object to another object. The drilldown method can be simplified and modified to meet individual needs.

[UPDATE]
Applet "User Account Password Reset and Unlock - Helpdesk"
[hd_pwdr2b.dsr]
Renamed button face from "Reset Intruder Lockout" to "Unlock Account".

[UPDATE]
Applet "User Account Password Reset and Unlock - Helpdesk - Specify Containers"
[hd_pwdr3b.dsr]
Renamed button face from "Reset Intruder Lockout" to "Unlock Account".

DSRAZOR for Windows

[NEW]
"[OTF]RECEIVE Merged items in connected Treeview into single list item - connect to service "Merge items...""
"[OTF]SEND Expanded & Merged items in same Treeview as this service - place this service as last root level item-select number of levels to process:range:1 to 3" These two new services allow you to format the output of a TreeView to look more like a ListView when exporting the data out to file.

[NEW]
Four new import keywords to move home directory contents (folders and files) to new location when updating the home directory path attribute on import from CSV. This will facilitate doing bulk home directory moves.,
These two keywords will move the the home directory data to the new location and delete the files in the old location:
"_Move Home Directory"
"_Move Home Directory SAMNAME"
These two keywords will copy the home directory data to the new location:
"_Move Home Directory NO DELETE"
"_Move Home Directory SAMNAME NO DELETE"

[NEW]
"AD:Edit User's UPN @Domain (will change to be an auto-populated dropdown)"
"AD:Edit User's UPN Logon Name (if @Domain not used will use default)"
These two new edit services for updating existing user objects work similarly to the existing UPN (userPrincipalName) edit services for use when creating new user objects. Previously when you wanted to modify the value for userPrincipalName on an existing user object, you needed to enter the entire value for the attribute in the edit field (such as BSmith@MyCompany.local). These new edit fields break the attribute down into separate prefix and suffix edit fields so that you can modify only a portion of the UPN if you would like.

[NEW]
Local User Reporting and Management We have added several new services to augment our existing local user services to allow additional reporting and management of local user accounts.
-Button Services-
"NT:Change Local User's Password across selected Servers/Workstations (local user manually specified at runtime)"
"NT:Change Local User's Password for selected local user (user selected from list of local users)"
"NT:Delete selected Local User Account(s)"
"NT:Disable selected Local User Account(s)"
"NT:Enable selected Local User Account(s)"
"NT:Unlock selected Local User's Account"
"NT:Remove Member(s) from list of Local Group Membership"
-Display Services-
"NT:Display IF selected Local User's Account is Locked"
"NT:Display User Account's Last Logon"

[NEW]
Applet "Local Account Password Reset - bulk - to all selected computers"
[LocalPasswordResetBulk.dsr]
Change the password for specified local account that exists across several computers. This can be useful for updating the passwords for service accounts that exist locally on several computers.

[NEW]
Applet "List Local User Accounts (alternate formatting) OTF"
[ListLocalUserAccounts_OTF1.dsr]
This applet uses the two new OTF Send and Receive services. It demonstrates formatting TreeView data for multi-valued data into a ListView or tabular format."

[NEW]
Applet "Local User Management"
[LocalUserManagement.dsr]
Manage local computer accounts (change password, unlock, enable, disable, delete, remove members from local groups).

[NEW]
"AD:Remove 'User cannot change password' on selected Active Directory user(s) (users will be able to change password)"
"AD:Set 'User cannot change password' on selected Active Directory user(s) (users will not be able to change password)"
These new services allow you to manage the "User cannot change password" setting on selected Active Directory accounts.

[NEW]
"AD:Set "Password never Expires" for selected Active Directory User Account(s)"
This new button service will set the flag in the userAccountControl attribute so that the "Password never Expires" on selected Active Directory accounts.

[NEW]
Applet "Password Security Settings for User Accounts"
[PasswordSettingsAD.dsr]
Manage password security settings for Active Directory user accounts.

[NEW]
Added 24 new "AD:AUTO..." services for autopopulating attributes on user creation. Previously you could use the set of 6 auto-populate services to populate the value of an attribute based on values that were entered for other attributes. For example, you could set the displayName attribute to [last, first] if the applet user entered the first name and last name on the user creation form. We have added 4 more sets of these services so now you can auto-populate up to 5 attributes when creating a new user.
Below are listed 6 (one set) of the 24 added services.
"AD:AUTO:1:Attribute Name - Auto-populate using Rules 1-5(use with Button Service:
"AD:Create User + Require EDIT Services...")"
"AD:AUTO:1:Rule 1:Attribute Name - (user with Display Service "AD:AUTO:Attribute Name...")
"AD:AUTO:1:Rule 2:Attribute Name - (user with Display Service "AD:AUTO:Attribute Name...")
"AD:AUTO:1:Rule 3:Attribute Name - (user with Display Service "AD:AUTO:Attribute Name...")
"AD:AUTO:1:Rule 4:Attribute Name - (user with Display Service "AD:AUTO:Attribute Name...")
"AD:AUTO:1:Rule 5:Attribute Name - (user with Display Service "AD:AUTO:Attribute Name...")

[NEW]
"AD:Search for any USER object by Name beginning at selected Container or DNS Domain Root (auto append '*')"
"AD:Search for any USER object by Name beginning at selected Container or DNS Domain Root (auto append '*')[Clear Previous Results]"
These two new button services behave similarly to the existing search button services. The difference is that these automatically append an '*' to the end of the search string. With the existing services, if you were searching for "Darin Smith" you might enter "Darin*" into the search field. With the new search button services you could just type "Darin" into the search field.

[NEW]
Import computer objects from CSV file.
Button service "AD:IMPORT:Mass Active Directory OBJECT Create, SPECIFY [Object Class in Manual Entry] - use with "Receive CSV file service" can now accept a value of "computer" for the import object class.
Display service "AD:IMPORT:AUTO_CREATE:Mass Active Directory OBJECT Create, SPECIFY [Object Class in Manual Entry] - use wth a "AUTO_CREATE receive CSV file service" can now accept a value of "computer" in the Manual Entry text field for automatically importing computer objects.

[NEW]
Applet "Import Computers + Attributes from CSV File"
[import_computer.dsr].
Applet "Import Computers + Attributes from CSV File (Automated)"
[import_computer_auto.dsr].
Sample import CSV file [import_computer.csv].
These two new applets allow you to import computer accounts from a CSV file.

[NEW]
"AD:Edit selected Object's Home Directory Path appending CN - use predefined values"
"AD:Edit selected Object's Home Directory Path appending SAMNAME - use predefined values"
These two new edit text services allow you to pre-specify some potential home directory locations in a dropdown list. You can then select the desired value in the dropdown list to edit the home directory location for the selected user. First it will update the homeDirectory attribute for the user in Active Directory. Second, it will create a folder for the user in the new location and set the permissions on the folder for the user. It will leave the files and contents of the old home directory in place, it does not move or copy files. We have found that it is better to use Windows Explorer to move or copy the files because it will allow you to make decisions about what to do with problem files during the move/copy process. You will need to use these new edit text services with an "Apply Changes" button.

[NEW]
"ADr:Create Home Directory Path using CN:for use during Create User + Req'd attr.(specify full UNC path such as "\\FS1\share\path")"
"ADr:Create Home Directory Path using SAMNAME:for use during Create User + Req'd attr.(specify full UNC path such as "\\FS1\share\path")"
These two new edit text services allow you to pre-specify some home directory locations in a dropdown list. You can then select the home directory location when creating a new user. You will need to use these new services with a "Create User" button.

[UPDATE]
"AD:List Group's Membership (by full AD/LDAP name)". This service will now successfully resolve group members that show up as Foreign Security Principals in the current domain because they are users from a trusted domain in another forest. Instead of showing the SID of the member from another forest, it will perform lookups to successfully display the full Distinguished Name of the user.

[UPDATE]
Corrected Output To File so that it would fully expand a multi-level TreeView in a file system permissions report. In a few specific cases it would only expand the TreeView output a few levels deep.

[UPDATE]
Modified how DSRAZOR determines whether an Active Directory account is locked out or not. It will now properly consider accounts that were "effectively" unlocked by a Group Policy Object (GPO), but still had a timestamp value present in the lockoutTime attribute. It will perform a calculation based on the value in the lockoutTime attribute, the current date and time, and the "Account lockout duration" specified in the Group Policy Objects applied to that user to determine if the user has been "effectively" unlocked by the GPO.

[UPDATE]
Removed a benign popup message that occurred when using a button service to view files in a directory. The popup only occurred if you used specific services linked in a very specific way. It was discovered by a customer who created a custom applet that connected services in an unusual way. Since the applet gave the correct results, this update does not change the results, it only removes the popup message.

[UPDATE]
"AD:Move selected Object(s) (Container to move to must be specified with Display Service - Canonical Name for Move Operation)"
We discovered that in certain circumstances, not all selected objects were being moved to the new OU/Container. Only half of the selected objects were being moved (every other one). This update fixes that problem.

[UPDATE]
"NT:Change Local Administrator User Account's Password for selected Servers/Workstations (RID=500)"
This button service will now accept passwords up to 30 characters in length. This has been increased from the previous limit of 14 characters. The increased 30 character limit has also been used in the new local password reset button services that are being released with this new update.

[UPDATE]
When Exchange enabling a contact object or a group object that has already been Exchange enabled; DSRAZOR will now display a popup indicating that the object is already Exchange enabled. (This update applies to Exchange 2000/2003 services)

[UPDATE]
"AD:Expire selected Active Directory user's password (requires users to change password at next logon)"
"AD:Assign Single-User Password for selected Active Directory User Account(s) {Must change password at next logon}"
"AD:Assign Single-User Password for selected Active Directory User Account(s) {Must change password at next logon} + Remove PwdNotRqd/Disable"
Added some "checks" to these button services. DSRAZOR will prevent you from successfully using these button services against a user account if the user is flagged with "User cannot change password". If you try to use one of those button services, DSRAZOR will now display a popup explaining the operation cannot be completed because the account is flagged with "User cannot change password".

[UPDATE]
Updated "User Account Password Reset and Unlock - Helpdesk" applet [hd_pwdr2b.dsr] to use new button search service that automatically appends '*' to the end of the search string.

[UPDATE]
Renamed "User Password and Intruder Lockout Reset Helpdesk" applet to "User Account Password Reset and Unlock - Helpdesk" in the Console.
Renamed "User Password and Intruder Lockout Reset Helpdesk - Specify Containers" applet to "User Account Password Reset and Unlock - Helpdesk - Specify Containers" in the Console.
Renamed "Local Admin Password Reset" applet to "Local Admin Password Reset - bulk - to all selected computers" in the Console.

[UPDATE]
Updated "Accounts with Password problems" applet [adpwdp3.dsr] to include new button service to "Remove 'User cannot change password' setting from selected objects".

[UPDATE]
Updated "AD:Display if selected User's Password is Expired" service to show the password is expired if the setting is present in the userAccountControl attribute or if the pwdLastSet attribute has been cleared. Previously the service relied on the flag in userAccountControl attribute being set.

[UPDATE]
"ADr:Edit New Account's selected Attribute and only allow predefined values to be entered - must be used with Button: "AD:Create User|Contact + Require..."
You can now use this edit text service with pre-defined values to assign a value to the userAccountControl attribute during user creation. This is a bitfield attribute in Active Directory that controls many important settings on user objects. Now you can automatically assign those settings by using a predefined value and setting it as the default value. This was added to fulfill a customer request to automatically set "password never expires" on all new user accounts.

[UPDATE]
Made enhancements to some security options in the Zero Privilege Server Agent configuration. When you specify a group to be "protected" from any changes initiated by Zero Privilege enabled applets, it will now consider nested groups and members of the specified group to be "protected". Also, when you specify a group of authorized users that can use Zero Privilege enabled applets, it will now consider nested groups and members of the specified group.

[FIX]
Modified the OTF alignment when populating group members of a documented group that has permissions

DSRAZOR for eDirectory

[NEW]
New button service allows you to delete whole directory structures, including subdirectories and files:
"NW:Delete Selected Path (all folders and files)"

[NEW]
New button service allows helpdesk staff to delete eDirectory objects via CVMONE.NLM:
"NDS:Delete Object with Prompt via NLM"

[NEW]
Two new button services for changing Directory Space Restrictions in MB (instead of KB):
"NW:Modify Selected Directory's Space Restriction in MB (use with NW:List ALL Selected Volume's Directories from current...)"
"NW:Modify Selected Directory's Space Restriction in MB via NLM (use with NW:List ALL Selected Volume's Directories from current...)"

[NEW]
New display service to show Directory Space Restrictions in MB (instead of KB):
"NW:Display Directory's Space Restriction in MB (use with NW:List ALL Selected Volume's Directories from current...)"

[NEW]
New button service for removing group membership via CVMONE.NLM:
"NDS:Remove User from selected Group via NLM (use when viewing Groups a User belongs to)"
Note: the "NDS:Server to interact with to change selected NDS attribute via NLM" text service must be used on the same screen.

[NEW]
New button service for moving eDirectory objects to a different container:
"NDS:MOVE:Move selected eDir/NDS Account(s) to Container designated by 'MOVE' display service"
Note: the new "NDS:MOVE:Display selected Container - will be used as the destination eDir/NDS account moves" text service must be used on the same screen.

[NEW]
You can now add users into Auxiliary Object Classes and also populate the attributes associated with the Auxiliary Classes when doing a CSV import. The new service for adding the Auxiliary Class is:
"NDS:Receive value from runtime-selected CSV file for the selected NDS Auxiliary Object Class for Mass Create - use manual entry to select"

[NEW]
Now when you delegate management of group membership to others, you could limit their view to see only the groups which they personally own. The new service is:
"NDS:Search for Groups owned by the current user beginning at a predefined container"

[NEW]
Two new services for setting the owner of Home Directories to be the end user:
"NW:HOME DIRECTORY: Set selected NDS Object's Home Directory Owner to be itself - including all subdirectories"
"NW:HOME DIRECTORY: Set selected NDS Object's Home Directory Owner to be itself - including all subdirectories and files"

[NEW]
New button service allows you to pass multiple parameters to an executable file:
"RUN: Specific File (EXE or other 'executable' file) - Pass as parameter(s) each display item in the connected listview (not the first column)"

[NEW]
CVMONE.NLM version 1.75.06 allows four new functions via NLM:
- Delete objects with prompt
- Remove members from groups (when viewing groups user is a member of)
- Modify directory space restrictions in MB
- Edit login time restrictions

[NEW APPLET]
There is a new applet named "Change Directory Space Restrictions via NLM" in the HelpDesk Examples section of the DSRAZOR Console. It allows helpdesk staff to change directory space restrictions on NetWare servers that have CVMONE.NLM loaded.

[NEW APPLET]
There is a new applet named "Move User(s) to a Different Container" in the eDirectory User Maintenance section of the DSRAZOR Console. It allows you to move a user or multiple users to a different container. The applet can be modified if you would like to move other types of objects - groups, containers, templates, workstations, etc.

[UPDATE]
The button service "NW:Delete Selected File" has been updated to "NW:Delete Selected File(s)" so you can delete multiple files at the same time, even if they are in different directories.

[UPDATE]
The button service "NDS:Add ZEN Application to selected User, Group or Container; Add Apps from selected container" has been updated to "NDS:Add ZEN Application to selected User, Group or Container; Add Apps from selected container>append '+' sign at end of path to include subcontainers in search" so that you no longer have to specify each container with a separate button. Now you can search through subcontainers and/or start your search from the Root of the Tree.

[UPDATE]
The service "NDS:List Last User Created" has been updated so it can now be used with the "NW:Copy list of all directories created, connect to NW:Receive list of directories..." service when assigning file system rights to newly created users.

[UPDATE]
The button services "NDS:Edit Login Time Restrictions" and "NDS:Edit Login Time Restrictions [NWADMINSTYLE]" have been updated so they can now be used with CVMONE.NLM. Note: to have the request go through the NLM, the "NDS:Server to interact with to change selected NDS attribute via NLM" text service must be added on the same screen.

[UPDATED APPLET]
The "Find Home Directories with No Trustees" applet in the Query and Search eDirectory section of the DSRAZOR Console has been updated to include an option for deleting the directories.

[UPDATED APPLET]
The "Add/Delete ZEN (NAL) Apps from Users" applet in the ZENworks Maintenance section of the DSRAZOR Console has been updated to search the whole Tree to find ZEN/NAL Applications to associate (so you do not have to edit the applet in the Designer anymore). If you do not want to search the whole Tree for Applications, the applet can be modified to only look in or beneath a specific container for ZEN/NAL Applications.

[UPDATED APPLET]
The "Find Files Ending with MP3 (or other extension)" applet in the Examine Servers/Disks section of the DSRAZOR Console has been updated to include an option for deleting the MP3 files. Also the "bytes" label was changed to "KB".

[UPDATED APPLET]
The "Find Files Greater than 1 MB in Size (or other size)" applet in the Examine Servers/Disks section of the DSRAZOR Console has been updated to include an option for deleting the large files. Also the "bytes" label was changed to "KB".

[UPDATED APPLET]
The "Find Unused for Past 365 Days (or other interval)" applet in the Examine Servers/Disks section of the DSRAZOR Console has been updated to include an option for deleting the unused files. Also the "bytes" label was changed to "KB".

[UPDATED APPLET]
The "View File Details per Directory" applet in the Examine Servers/Disks section of the DSRAZOR Console has been updated to include an option for deleting the files. Also the "bytes" label was changed to "KB".

[UPDATED APPLET]
The "Compressed vs. Uncompressed Directory Sizes" applet in the Examine Servers/Disks section of the DSRAZOR Console has been updated to be able to display and set the Directory Space Restrictions in both KB and MB.

[UPDATED APPLET]
The "Directory Space Restrictions (Linux only)" applet in the Examine Servers/Disks section of the DSRAZOR Console has been updated to be able to display the Directory Space Restrictions in both KB and MB.

[UPDATED APPLET]
The "Directory Space Restrictions (NetWare only)" applet in the Examine Servers/Disks section of the DSRAZOR Console has been updated to be able to display and set the Directory Space Restrictions in both KB and MB.

[UPDATED APPLET]
The "Set User as Owner of their Home Directory" applet in the NDS User Maintenance section of the DSRAZOR Console has been updated to include changing the ownership of the subdirectories and files within the Home Directory.

[UPDATED APPLET]
The "Document Access to Sensitive File System Directory (Linux only)" applet in the Assess eDirectory Security section of the DSRAZOR Console has been updated to accommodate the fix for the Modify and Access Control services

[UPDATED APPLET]
The "Document Access to Sensitive File System Directory (NetWare only)" applet in the Assess eDirectory Security section of the DSRAZOR Console has been updated to accommodate the fix for the Modify and Access Control services.

[FIX]
When running the "Enterprise Volume Space Report" applet in the Examine Servers/Disks section of the DSRAZOR Console, if a particular volume cannot be accessed you will now only see the error after the report completes. The previous error messages for each volume that would pop up while running the applet have been removed.

[FIX]
Setting rules using the "NW:Display File's Size in MB" service now works correctly.

[FIX]
The "NW:Display File's Size in KB" service now lists values in KB (instead of bytes)

[FIX]
Fix for CSV imports that were previously getting DSRRUN errors.

[FIX]
Corrected an issue when Inherited Rights Filters are displayed on the screen.

[FIX]
Corrected an issue with the following two display services:
"NDS:Display if Modify Right Exists (use with NDS:List ALL User/Grp/OU Objects with ANY Rights...)"
"NDS:Display if Access Control Right Exists (use with NDS:List ALL User/Grp/OU Objects with ANY Rights...)"

DSRAZOR for Windows Zero Privilege Help Desk

[NEW]
New import keyword (_Move to new OU) to allow moving user ojects to another OU through CSV import.

[UPDATE]
Reduced permissions required when configuring the Zero Privilege Account:
Zero Privilege Account does not need to be a local administrator when the server agent is installed on a member server. Zero Privilege Account does not need to be a member of the Domain "Administrators" group when the server agent is installed on a Domain Controller (unless User Account Control is enabled on the DC).

[UPDATE]
Added the ability to set a preferred DC - useful for member server installation.

Added "ZP Logon Account not enabled for Local Logon on Host Computer" message if Local Logon right has not been granted to ZP account (for use with non-admin account using delegation to the ZP account)

DSRAZOR for eDirectory

[NEW]
CVMONE.NLM version 1.75b can now report the following information about NetWare servers: CPU Speed, LAN Board Line Speed, DNS Hostname, Manufacturer, Model, and Serial Number.

[NEW]
The following six new display services can show server information for NetWare 5.x and NetWare 6.x servers that have CVMONE.NLM version 1.75b or higher loaded:
"NW:Display Server's CPU Speed [requires NLM]"
"NW:Display LAN Board X's Line Speed [requires NLM](X = which logical board, first is = 1)(fill in X below in Manual Entry)"
"NW:Display Server's DNS Hostname [requires NLM]"
"NW:Display Server's DMI Manufacturer Name [requires NLM]"
"NW:Display Server's DMI Model Name [requires NLM]"
"NW:Display Server's Serial Number [requires NLM]"

[NEW]
The following two new listing services can show the LAN Boards and the LAN Board Custom Counters for NetWare or Linux servers:
"NW:List Active LAN Boards at Server"
"NW:List Custom Counters for selected Active LAN Board at Server"

[UPDATED APPLET]
The Enterprise File Server Status applet has been expanded to include the eight new server information services mentioned above. There are now slightly different copies of the applet so you can run whichever applet is appropriate for your needs:
"Enterprise File Server Status (All servers)"
"Enterprise File Server Status (Linux only)"
"Enterprise File Server Status (NetWare only)"

[UPDATED APPLET]
A screen has been added to the Directory Space Restrictions + Manage applet to show all users who have space on the volume, even if they do not have a space restriction set.

[UPDATED APPLET]
The Disk Space in use, Files Owned/Unowned applet now has some data sent directly out to a file, instead of on screen. Also the "KB" label was changed to "bytes".

[UPDATED APPLET]
The Find files ending with MP3 (or other extension) applet has been changed to be able to start the search at a selected directory, so you do not necessarily have to search the whole volume. Also the "KB" label was changed to "bytes".

[UPDATED APPLET]
The Find files greater than 1 MB in size applet has been changed to be able to start the search at a selected directory, so you do not necessarily have to search the whole volume. Also the "KB" label was changed to "bytes".

[UPDATED APPLET]
The Find files unused for past 365 days applet has been changed to be able to start the search at a selected directory, so you do not necessarily have to search the whole volume. Also the "KB" label was changed to "bytes".

[UPDATED APPLET]
The View File details per Directory applet has been changed to be able to start the search at a selected directory, so you do not necessarily have to search the whole volume. Also the "KB" label was changed to "bytes".

DSRAZOR for Windows

[UPDATE BUTTON SERVICE]
Button Service:"AD:Rename Account (CN= component only) for selected Active Directory User Account(s)"
This Button Service has been enhanced to accommodate for commas in the CN name.

DSRAZOR for Windows

[NEW BUTTON SERVICE]
New Button Service:"AD:Rename Account (CN= component only) for selected Active Directory User Account(s)"
Will rename selected Active Directory Account (CN or Common Name).

[FIX]
Updated some of the applets in the Console that are labeled Exchange 2007/2010 to work properly with Exchange 2010.

DSRAZOR for eDirectory

[UPDATED APPLET]
New scount9.dsr replaces scount8.dsr. Added column for version of server to show more detail, and changed the way the top "NOT for licensing" button works.

DSRAZOR for eDirectory

[NEW BUTTON SERVICE]
This new button service will import from a CSV file to update attributes of existing users, without creating any new users:
"Mass Update Existing User Accounts - use with Receive CSV file service (DOES NOT CREATE USERS)"

[NEW BUTTON SERVICE]
This new button service will import from a CSV file via CVMONE.NLM to update attributes of existing users, without creating any new users:
"Mass Update Existing User Accounts via NLM - use with Receive CSV file service (DOES NOT CREATE USERS)"
Note: you must use the text service "NDS:Server to interact with to change selected NDS attribute via NLM" to specify which server CVMONE.NLM is loaded on.

DSRAZOR for Windows

[NEW BUTTON SERVICE]
"AD:Expire selected Active Directory user's password"
Will force selected users to change their password on next logon.

DSRAZOR for Windows

[MODIFY]
Button services that copy user objects will now copy the Logon Hours of the source user to the target user. With this update it will also copy the UPN suffix of the source user and create the UPN logon name of the target user [sAMAccountName + UPN Suffix].

DSRAZOR for eDirectory

[NEW SERVICE]
The following edit service allows changing the password expiration date but does not allow removing the password expiration date: "NDS:Edit Account's Password Expiration Date (No checkbox to remove date)"

DSRAZOR for Windows

[NEW HELPDESK APPLET]
Helpdesk Dashboard Example applet [HelpdeskDashboard1.dsr]. This sample applet combines many of the daily user administration tasks into an efficient dashboard-style interface. The initial drilldown can be modified for your environment to reduce the number of windows in the applet. This will further increase the efficiency of the applet.

DSRAZOR for Windows

[NEW SERVICES]
"FS:List All Controlled File System Objects of selected Trustee + Description + Inherited Flag + Apply To (use with "FS:SEARCH File System ..." service)"

"AD:RULE:Display selected Active Directory Container (can be domain root) to enable Document Effective Rights for User"

"AD:RULE:Display selected Active Directory Container (can be domain root) to enable Document Effective Rights for Group"

"AD:RULE:Document Effective Rights for selected object(s) in the connected list"

FS:List Groups by "SAM Account name" & EFFECTIVE RIGHTS to the selected File System Object (use "AD:RULE:Display Starting AD Container for Doc.Eff.")"

FS:List Groups by LDAP name & EFFECTIVE RIGHTS to the selected File System Object (use "AD:RULE:Display Starting AD Container for Doc.Eff.")"

"FS:List users by "display name" & EFFECTIVE RIGHTS to the selected File System Object (use "AD:RULE:Display Starting AD Container for Doc.Eff.")"

"FS:List users by "SAM Account name" & EFFECTIVE RIGHTS to the selected File System Object (use "AD:RULE:Display Starting AD Container for Doc.Eff.")"

"FS:List users by LDAP name & EFFECTIVE RIGHTS to the selected File System Object (use "AD:RULE:Display Starting AD Container for Doc.Eff.")"

[NEW APPLET]
Effective NTFS Permissions - [EffectivePermissions_Directories.dsr]

This applet will calculate effective NTFS permissions for users and groups on directories in the file system.

[UPDATED APPLETS]
Updated the following applets to use the new service, "FS:List All Controlled File System Objects of selected Trustee + Description + Inherited Flag + Apply To (use with "FS:SEARCH File System ..." service)".

The difference between the old service and the new service is the addition of the "Applies To" information in the Access Control Entries (ACE). This means that the applets will now output the "Applies To" data for the Access Control Entries (ACE) in the reports.
[findFStrustee1.dsr]
[findFSdirTrustee1.dsr]
[findFSdirTrustee_OTF1.dsr]
[findFStrustee_OTF1.dsr]
[fsadmn_OTF4.dsr]
[fsadmnu_OTF4.dsr]
[fsadmnSID_OTF4.dsr]
[findFSdirTrustee_OTF1.dsr]
[fsadmnd_OTF4.dsr]
[fsadmndu_OTF4.dsr]
[fsadmndSID_OTF4.dsr]

DSRAZOR for Windows

[NEW BUTTON SERVICE]
AD:Remove Group Membership for all groups the selected Object belongs to (except primaryGroupID)

Removes selected user (or other object) from all Active Directory groups( except Primary Group)

[NEW BUTTON SERVICE]
EXCH:MODIFY:HIDE selected AD Account(s) From Exchange Address Lists

Hides selected user from Exchange address lists

[NEW BUTTON SERVICE]
EXCH:MODIFY:SHOW selected AD Account(s) so it can be seen by Exchange Address Lists

[NEW EDIT SERVICE]
ADr:Edit User's(Contact) name to Create|"last, first" format-must be used with Button Service: "AD:Create User(or Contact) + Require EDIT Services..."

This service is very similar to the existing "Edit User's name to Create" service. When assigned to a control on a user creation applet, this edit text service will enter the Account Name (a required attribute) when creating a new user. This new service will auto-populate the Account Name using "Last, First" format based on the information entered for First and Last name. You can optionally override the auto-populated text and either modify it or replace it.

DSRAZOR for eDirectory

[UPDATE]
Updated the service "NW:Display Server's current time". This service would sometimes report the time one hour ahead.

[UPDATE]
Modification made to the service "NDS:RULE:When NDS Attribute has no value, display nothing at all instead of the default <None>" so that it will now also omit <Never>.

DSRAZOR for Windows

[UPDATE]
Added functionality to the Local Admin Password Reset applet that indicates if any computers failed to have their admin password reset.

[UPDATE]
Modification made to the "auto close" service to work with the auto import service. This is to close an applet automatically after 60 seconds upon completion.

DSRAZOR for eDirectory

[FIX]
Corrected the button service "NDS:Reset Selected Attribute" so it works with the attribute "Password Expiration Interval"

DSRAZOR for Windows Zero Privilege Help Desk

[FIX]
Corrected an issue with the Zero Privilege Alert Agent where under certain circumstances it did not display the data for the "On Object" column. This update does not affect the logs because the "On Object" data was always correctly displayed in the logs

DSRAZOR for Windows

[NEW]
The following two services have been updated:
"AD:Display logonHours grid for selected User"
"AD:Display logonHours grid for selected User - Allow changes for one or multiple accounts"

They now allow you to set the days of the week and hours of the day that a user account is authorized to authentication to Active Directory. This information is stored in the logonHours attribute.

DSRAZOR for eDirectory

[FIX]
Corrected an issue where Last Login time stamp was ahead one hour for DST in Central European Time

DSRAZOR for eDirectory - CVMONE.NLM

[FIX]
Corrected an issue with the service "NDS:Assign Grace Logins Remaining via NLM".

DSRAZOR

[FIX]
Corrected a timezone issue in some reports.

DSRAZOR for Windows

[FIX]
Removed a popup error with the "AD:Move Home Directory for selected User Account(s) (append SAMname)" button service.

DSRAZOR - Out to File

[FIX]
With reports that send information directly out to a file, you can now run the same report multiple times in the same session of running the applet.

DSRAZOR for Windows

[NEW]
The following Service was added to allow rule based query on multi-valued attributes:
"AD:RULE:Search selected Active Directory Multi-Valued Attribute for any values matching Manual Entry value"

DSRAZOR for Windows

[NEW]
Added a button service similar to existing "copy user" button service. In addition to copying the user this new button service will also create a home directory for the new user in the same parent directory as the source user.

DSRAZOR for Windows

[NEW]
There are two new services for listing local computer account's Lastpwdset:
"NT:List User Account's Password Last Set"
"NT:Display User Account's Password Last Set"

DSRAZOR for eDirectory

[FIX]
Some search services would display full results on screen, but incomplete results if the data was sent directly out to a file. This has been corrected.

[NEW]
There is a new service for listing items in a container (no sub-containers) with their fully distinguished name:
"NDS:SEARCH:List Objects in Specific Container ONLY (you can specify specific Object Classes to include)_Show Full Name"

DSRAZOR for eDirectory - CVMONE.NLM

[NEW]
By default CVMONE.NLM does not allow helpdesk staff to modify objects that have "admin" in their name. There is now an optional switch that can be used if you want to allow your helpdesk to change attributes of objects with "admin" in their name (such as changing their group membership), but it still will not allow password changes of objects with "admin" in their name. The syntax is:
LOAD CVMONE /ALLOWA1

DSRAZOR for Windows Zero Privilege Help Desk

[FIX]
The Single Use Password service now works correctly when using Zero Privilege Help Desk.

DSRAZOR for eDirectory

[MODIFICATION]
You can now set values in minutes or days when changing the specific attributes Intruder Lockout Reset Interval and/or Intruder Attempt Reset Interval using this service:

"NDS:Change Selected Attributes for "selected" NDS objects only"

(Previously you could only set values in days.)

DSRAZOR for eDirectory

[FIX]
Corrected the column indentation of the CSV file output of the "Document Effective File System Rights" applet.

DSRAZOR for Windows

[NEW SERVICES]
New Display Service to show if an account is hidden from Exchange Address Lists:
"EXCH:Display if selected AD Account is hidden from Exchange Address Lists"

New Listing Service to show if a Control Panel Service logon account has the ability to interact with the desktop session:
"NT:List IF selected Service can interact with the desktop"

New Button Service and import keywords to allow creating/updating groups from a CSV input file:
"AD:IMPORT:Mass Active Directory GROUP Create, SPECIFY [Group Type in Manual Entry] - use with a "Receive CSV file service""

[NEW APPLET]
New Applet for importing groups from CSV file:
"Import Groups from CSV File" [import_groups.dsr]

[NEW CSV EXAMPLE FILES]
importDistGroup.csv and importSecGroup.csv are sample files for the new import_groups.dsr applet.

[ZERO PRIVILEGE HELP DESK]
Added informational popup when removing the server agent.

DSRAZOR for eDirectory

[NEW SERVICES]
New Button Service added to clear results from a TreeView/ListView:
"TreeView/ListView: Clear List"

[CVMONE.NLM FIX]
Corrected a problem with editing the attribute "Account Balance" with CVMONE.NLM.

DSRAZOR for GroupWise

[FIX]
Corrected a problem with displaying GroupWise mailbox sizes.

DSRAZOR for Windows

[NEW SERVICES]
EXCH:Display if selected AD Account is hidden from Exchange Address Lists

AD:IMPORT:Mass Active Directory GROUP Create, SPECIFY [Group Type in Manual Entry] - use with a "Receive CSV file service"

DSRAZOR for GroupWise

[NEW]
New applet: "I.Move GroupWise User(s) to a different Post Office"
(gwmove.dsr) allows you to move one or more GroupWise Users to a different Post Office.

[NEW]
New display service shows how many Resources a GroupWise Account owns:
"NWGWC:Display Count of the number of Resources owned by the selected GroupWise Account"

[NEW]
New display service shows which post office the GroupWise Account will be moved to:
"NWGWC:MOVE:Display selected GroupWise Post Office - will be used as the destination PO for GW account moves"

[NEW]
New button service moves GroupWise Account(s) to a different Post Office:
"NWGWC:MOVE:Move selected GroupWise Account(s) to PO designated by "MOVE" display service"

DSRAZOR for eDirectory

[FIX]
Corrected a problem where this service showed incomplete results in some environments:
"NW: List All Users (plus File Server) Disk Space on the Selected Volume [NSS]"

DSRAZOR for eDirectory

[FIX]
Corrected a problem with the service "Find and Delete Inactive Accounts" when selecting the "Delete selected GroupWise accounts only".

DSRAZOR for eDirectory

[NEW]
New button service gives a confirmation after changing eDir/NDS password with a prompt for existing password:
"NDS:Change Account's Password, Prompt for Existing Password (When change is complete, show pop-up message)"

DSRAZOR for Windows

[FIX]
"AD:RULE:Move current AD Account to designated Container..."
Now accepts Distinguished Names of up to 128 characters.

DSRAZOR for eDirectory

[NEW]
New button service gives a confirmation after changing eDir/NDS password:
"NDS:Change Account's Password (When change is complete, show pop-up message)"

[NEW]
New button service gives a confirmation after unlocking eDir/NDS accounts:
"NDS:Reset Intruder Lockout (When reset is complete, show pop-up message)"

DSRAZOR for GroupWise

[FIX]
Increased support for larger GWCHECK log files.

DSRAZOR for Windows

[NEW SERVICE]
"FS:List Servers/Workstations on selected server/workstation Active Directory object"

Allows disk space report to connect to computer object listing in Active Directory rather than relying on a NetBIOS listing of computers in the domain.

[NEW SERVICE]
"FS:List Servers/Workstations in selected Active Directory Container including Shared Disks on selected server/workstation"

Previously you could only select and search a NetBIOS domain name when reporting on disk space usage for computer objects. This new service allows you to select a container with computer objects in it for reporting disk space usage. This allows for quicker results when reporting on a subset of computer objects is desired in larger environments.

[UPDATE]
Updated "Disk Space Report" applet [fssize2.dsr] to use the new services.

DSRAZOR for Windows Zero Privilege Help Desk

[FIX]
Corrected an error message that incorrectly gave a warning message about a licensing problem when using Zero Privilege applets in a specific way.

DSRAZOR for eDirectory

[NEW RULE]
"Username Home Directory Owner"
and
"Attribute Home Directory Owner"

When using a CSV import to create eDir/NDS accounts, if a Home Directory is assigned during account creation the owner of the home directory can be set to be the newly created user. This is done by using either "Username Home Directory Owner" or "Attribute Home Directory Owner" in the import applet.

[NEW DISPLAY SERVICE]
This new Display Service closes the applet after doing a CSV import so that the applet can be fully automated (for example, to run unattended imports with a task scheduler):
"NDS_AUTOCREATE:Automatically exit applet after AUTO Receive CSV file service completes"

[NEW BUTTON SERVICE]
This new Button Service allows you to set the owner of a home directory to be the user that the home directory belongs to:
"NW:HOME DIRECTORY: Set selected NDS Object's Home Directory Owner to be itself"

[NEW APPLET]
Set User as Owner of their Home Directory (homedirowner.dsr):
This applet displays Home Directories and their owners. It also allows you to set the ownership to be the user that the Home Directory belongs to (in case any were set to other owners, such as to the creator of the account).

[UPDATE]
When using the various button services that create eDir/NDS accounts, if a Home Directory is assigned during account creation the owner of the home directory will be the newly created user.

[UPDATE TO CVMONE.NLM]
When using the new version of CVMONE.NLM, if a Home Directory is assigned during account creation the owner of the home directory will be the newly created user.

DSRAZOR for eDirectory

[NEW]
New Applet:
Document GroupWise Distribution List Membership by User Name

DSRAZOR for GroupWise

[NEW]
New Listing Service:
"NWGWC:List Distribution Lists selected eDirectory User is a member of"

[NEW]
New GroupWise Applet:
H.List eDir/NDS Users and their Distribution List Memberships 

DSRAZOR for GroupWise

[NEW]
New Display Service:
"NWGWCHK: Display Amount of Disk Space In-Use[MB]for selected GroupWise Account's email"
When displaying the mailbox size of user, you now can display it in MB (instead of Bytes).

DSRAZOR for Windows

[FIX]
"AD:Include Container of Current User Logon in List"
This service was corrected to work with users whose Common Names contain a comma.

[MODIFY]
Made change to "AD:Create User + Require EDIT Services (AD Attributes) on same page [SHOW SUCCESS POP-UP](use EXCH:CREATE Display Mailbox Store on same screen)" service. The notification popup that indicates a new user has been created will no longer popup when attempting to create a user that previously existed.

DSRAZOR for eDirectory

[NEW]
New Display Services - When displaying directory sizes, you now can display in KB (instead of MB):

"NW:Display Size of Directory Compressed (KB) - Include All Subdirectories(i.e. actual amount of disk space in use)"

"NW:Display Size of Directory Compressed (KB) (i.e. actual amount of disk space in use)"

"NW:Display Size of Directory Uncompressed (KB) - Include All Subdirectories (i.e. amount of disk space in use if all files were uncompressed)"

"NW:Display Size of Directory Uncompressed (KB) (i.e. amount of disk space in use if all files were uncompressed)"


[NEW]
New Display Service - When listing file system trustees, the file system rights can now be displayed on one line:

"FILE:Display trustee assignments on a single line (versus a row for each assignment granted) - works with all trustee services using multiple lines"

DSRAZOR for Windows

[FIX]
Corrected a problem that occurred when reporting lastLogon under special conditions. This problem typically occurred when running applets on a workstation with the local date incorrectly set.

DSRAZOR for Windows

[NEW]
New display service:
"FS:Display File System Object's Extension (such as DOC, XLS, DLL)"

New display service was added to display file size in MB:
"FS:Display File System Object's Size (MB)"

DSRAZOR for eDirectory

[NEW]
New display service was added to display file size in MB:
"NW:Display File's Size in MB"

[UPDATE]
The following applets now have better functionality with SUSE Linux Enterprise Servers:

    Connection Stats (Bindery or NDS logins) - srvcon3.dsr
    Document Access to Sensitive Directory - privher6.dsr
    Document Effective File System Rights - doceff7.dsr
    Document Trustees by Directory - trbydir3.dsr
    Directory Space Restrictions - dirpspc4.dsr
    Find Directories with an Inheritance Filter - if4.dsr
    Find Home Directories with No Trustees - hdnotrst1.dsr
    View Home Directory Sizes - homed3.dsr

[FIX]
The following applets now work with DSRAZOR Container Tokens:

    Count Servers - scount8.dsr
    ZEN Remote Control / Remote View (Tab) - zenrcrvt1.dsr
    ZEN Remote Control / Remote View by User - zenrcrvu3.dsr

[UPDATE]
The following applets now display file sizes in both KB and MB:

    Disk Space in use, Files Owned/Unowned - volspc6.dsr
    File Extensions in Use - Count each - file-ex2.dsr
    Find files unused for past 365 days - files365a.dsr
    View File Details per Directory - fileuse1.dsr

DSRAZOR for Windows

[UPDATE]
This update is more tolerant when creating users on slower DCs. It includes a new display service that allows you to specify a delay period (in seconds) for the applet to keep retrying to create the user.

Visual Click Software proudly announces the release of DSRAZOR for Windows Zero Privilege Help Desk

Completely eliminate providing change permissions to your helpdesk operator accounts!

• Does not use or rely on Active Directory Delegation
• Uses a separate server-based service with full security options
• Create Active Directory Accounts
• Change Passwords
• Change Active Directory Details
• Create Exchange 2007/2010 Accounts
• Create Home Directories
• and much more!
  
  
• Extends your existing DSRAZOR for Windows installation - convert your applets to use Zero Privilege Help Desk by adding a single service!

DSRAZOR for Windows now has support for Exchange 2007/2010

• Add Exchange Mailbox to Existing User Accounts
• Add Exchange Mailbox to User Accounts during Import
• Enable Exchange Mailbox for Contact objects
• Delete Exchange Mailbox from selected User Accounts
• Smart Delete of User Account, Home Directory Structure and Exchange Mailbox
• Quick Search to find User Accounts with or without Exchange Mailbox
• Document Mailbox Statistics:
  • Account Name
  • Alias
  • Primary Email Address
  • Number of Emails in all folders
  • Size of all Emails in all folders
  • Number of Deleted Emails
  • Size of Deleted Emails
  • Storage Limit Status
  • Last Account Logged on (could be service account)
  • Last Logon Time
  • Rule that indicates if last logon was by the account holder

DSRAZOR for eDirectory

[FIX]
Corrected a problem with the applet that finds hung Login Scripts.

DSRAZOR for Windows

[FIX]
Corrected a problem where the date/timestamp for lastLogon was being incorrectly reported.

Changed the way the "AD:Display if selected User cannot change their own password" service works. It no longer looks at the value in the userAccountControl attriibute - it looks at the permissions on the user object.

DSRAZOR for Windows

[FIX]
Corrected a token/license check error when specific services were combined.

DSRAZOR for GroupWise

[NEW]
"NWGWC:Delete GroupWise Account for NDS User/GroupWise External Entity"
New button service that deletes GroupWise accounts only, leaving the eDirectory accounts intact. Can be used to delete multiple GroupWise accounts at the same time.

DSRAZOR for eDirectory

[UPDATE]
"NDS:SEARCH:List and Authenticate to all NetWare Servers starting from selected container or [Root] if no container is selected"
This service now includes Linux servers in the search results.

DSRAZOR for Windows

[UPDATE]
"EXCH:ENABLE:Exchange 2000 (or later) Mailbox for selected Active Directory Account(s) | EXCH:Display Administrative Group must be on same screen"

This button service can now be used to Exchange enable existing Contact objects.

[NEW]
"ADr:Edit Account's Target Email Address to Create - must be used with Button Service: "AD:Create Contact + Require Edit Services...""

New Edit service allows specifying email address when Exchange enabling existing Contact objects. If the "mail" attribute has a value before Exchange enabling the contact, this edit field will use that value. This can save time if someone has already populated email addresses for non-Exchange enabled Contact objects

DSRAZOR for Windows

[MODIFY]
When displaying group membership - allow resolving Fully Qualified Domain Name of group members when those group members belong to a different forest.

DSRAZOR for Windows

[UPDATE]
Updated the "FS:Display IF any Access Control Entry (ACE) grants GENERIC_ALL to selected File System Object" service to facilitate filtering on Full Control permissions.

DSRAZOR for Windows Console

AD User Maintenance

[NEW]
Added "Create Contact from a Template" applet to allow Exchange Enabled contact creation from a form. - [ContactTemplate1.dsr]

DSRAZOR for Windows

[NEW]
The following new services will allow form-based creation of Exchange enabled contacts:

New button service to create contact objects:
"AD:Create Contact + Require EDIT Services (AD Attributes) on same page (will create Exchange Acct if EXCH:Display Administrative Group is on same screen)"

New edit service to be used when creating Exchange enabled contact objects with button service:
"ADr:Edit Account's Target Email Address to Create - must be used with Button Service: "AD:Create Contact + Require EDIT Services..."

DSRAZOR

[FIX]
TreeViews that use tab labels now have the data indented correctly when sent directly out to a CSV file.

DSRAZOR for GroupWise

[NEW]
Support for GroupWise 8 GWCHECK.

[FIX]
The applets that use GWCHECK can now handle larger log files.

DSRAZOR for eDirectory

[NEW]
"NW:Display Count of Files in selected path only (no subdirectories)" - This new service can be used to show the number of files within a directory (it does not include the files in subdirectories beneath).

[FIX]
"NDS_AUTOCREATE:Receive CSV file, EXCEL STYLE [NO Quotes, Commas ONLY, no trailing comma] for Mass User [or Other Object] Create" - This service now expects the correct Excel CSV format.

[FIX]
The following services about directory details now display data correctly when sent directly out to a CSV file:
   "NW:List Count of Directories in selected path (includes all
    subdirectories)"
   "NW:List Count of Files in selected path (includes all subdirectories)"
   "NW:List Count of Files in selected path - no subdirectories
   included"
   "NW:List File's Owner (Name)"
   "NW:List File's Creation Date/Time"
   "NW:List File's Last Update (Modified) Date/Time"

DSRAZOR for Windows

[NEW]
The following AD import keywords have been added:
   _Cannot change password
   _Delete Account

DSRAZOR for Windows Services

[NEW]
"AD:List Trustees (List ACEs) by "displayName" name (where possible) for selected Active Directory Object"

[NEW]
"FS:List Trustees (List ACEs) by "displayName" name (where possible) for selected File System Object"

DSRAZOR Viewer

[UPDATE]
The DSRAZOR Viewer now recognizes applets that have Tab Controls.