Active Directory Cookbook

4.12. Modifying a Bit-Flag Attribute

Problem

You want to modify an attribute that contains a bit flag.

Solution

Using VBScript

' This code safely modifies a bit-flag attribute
' ------ SCRIPT CONFIGURATION ------
strObject = "<ObjectDN>"       ' e.g. cn=jsmith,cn=users,dc=rallencorp,dc=com
strAttr = "<AttrName>"         ' e.g. rallencorp-UserProperties
boolEnableBit = <TRUEorFALSE>  ' e.g. FALSE 
intBit = <BitValue>            ' e.g. 16
' ------ END CONFIGURATION ---------

set objObject = GetObject("LDAP://" & strObject)
intBitsOrig = objObject.Get(strAttr)
intBitsCalc = CalcBit(intBitsOrig, intBit, boolEnableBit)

if intBitsOrig <> intBitsCalc then
   objObject.Put strAttr, intBitsCalc
   objObject.SetInfo
   WScript.Echo "Changed " & strAttr & " from " & intBitsOrig & " to " & intBitsCalc
else
   WScript.Echo "Did not need to change " & strAttr & " (" & intBitsOrig & ")"
end if


Function CalcBit(intValue, intBit, boolEnable)

   CalcBit = intValue

   if boolEnable = TRUE then
      CalcBit = intValue Or intBit
   else
      if intValue And intBit then
         CalcBit = intValue Xor intBit
      end if
   end if

End Function

Discussion

In Recipe 4.9, I described how to search against attributes that contain a bit flag, which are used to encode various settings about an object in a single attribute. As a quick recap, you need to use a logical OR operation to match any bits being searched against, and logical AND to match a specific set of bits. If you want to set an attribute that is a bit flag, you need to take special precautions to ensure you don’t overwrite ...