Технический блог (заметки) - Artur K. Shakirov system administrator | a script which creates users in AD from a spreadsheet.

Разделы

Полезности

Самые

Блогролл

Опции:

a script which creates users in AD from a spreadsheet.

I am currently using a script which creates users in AD from a spreadsheet. I got the script from www.rlmueller.net. This works fine, it creates the users and makes their home drive folders, but it fails to set permissions every time. There is no message in the error log. I thought this could be because the new users hadn't been replicated yet but I used repadmin in the script once the users were created before it tries to set permissions and although this forced the replication without any problems, setting the permissions still failed. Does anyone have any other clues as to why this may be? many thanks in advance :D

(Im using a single DC with Windows 2003 standard edition)

' CreateUsers.vbs ' VBScript program to create users according to the information in a ' Microsoft Excel spreadsheet. ' ' - ' Copyright (c) 2003 Richard L. Mueller ' Hilltop Lab web site - http://www.rlmueller.net ' Version 1.0 - September 8, 2003 ' Version 1.1 - January 25, 2004 - Modify error trapping. ' Version 1.2 - March 18, 2004 - Modify NameTranslate constants. ' ' You have a royalty-free right to use, modify, reproduce, and ' distribute this script file in any way you find useful, provided that ' you agree that the copyright owner above has no warranty, obligations, ' or liability for such use. Option Explicit Dim objExcel, strExcelPath, objSheet Dim strLast, strFirst, strMiddle, strPW, intRow, intCol Dim strGroupDN, objUser, objGroup, objContainer Dim strCN, strNTName, strContainerDN Dim strHomeFolder, strHomeDrive, objFSO, objShell Dim intRunError, strNetBIOSDomain, strDNSDomain Dim objRootDSE, objTrans, strLogonScript, strUPN ' Constants for the NameTranslate object. Const ADS_NAME_INITTYPE_GC = 3 Const ADS_NAME_TYPE_NT4 = 3 Const ADS_NAME_TYPE_1779 = 1 ' Specify spreadsheet. strExcelPath = "c:\MyFolder\NewUsers.xls" ' Specify DN of container where users created. strContainerDN = "ou=Sales,dc=MyDomain,dc=com" Set objFSO = CreateObject("Scripting.FileSystemObject") Set objShell = CreateObject("Wscript.Shell") ' Determine DNS domain name from RootDSE object. Set objRootDSE = GetObject("LDAP://RootDSE") strDNSDomain = objRootDSE.Get("DefaultNamingContext") ' Use the NameTranslate object to find the NetBIOS domain name ' from the DNS domain name. Set objTrans = CreateObject("NameTranslate") objTrans.Init ADS_NAME_INITTYPE_GC, "" objTrans.Set ADS_NAME_TYPE_1779, strDNSDomain strNetBIOSDomain = objTrans.Get(ADS_NAME_TYPE_NT4) ' Remove trailing backslash. strNetBIOSdomain = Left(strNetBIOSDomain, Len(strNetBIOSDomain) - 1) ' Open spreadsheet. Set objExcel = CreateObject("Excel.Application") On Error Resume Next objExcel.Workbooks.Open strExcelPath If Err.Number <> 0 Then On Error GoTo 0 Wscript.Echo "Unable to open spreadsheet " & strExcelPath Wscript.Quit End If On Error GoTo 0 Set objSheet = objExcel.ActiveWorkbook.Worksheets(1) ' Bind to container where users to be created. On Error Resume Next Set objContainer = GetObject("LDAP://" & strContainerDN) If Err.Number <> 0 Then On Error GoTo 0 Wscript.Echo "Unable to bind to container: " & strContainerDN Wscript.Quit End If On Error GoTo 0 ' Start with row 2 of spreadsheet. ' Assume first row has column headings. intRow = 2 ' Read each row of spreadsheet until a blank value ' encountered in column 5 (the column for cn). ' For each row, create user and set attribute values. Do While objSheet.Cells(intRow, 5).Value <> "" ' Read values from spreadsheet for this user. strFirst = Trim(objSheet.Cells(intRow, 1).Value) strMiddle = Trim(objSheet.Cells(intRow, 2).Value) strLast = Trim(objSheet.Cells(intRow, 3).Value) strPW = Trim(objSheet.Cells(intRow, 4).Value) strCN = Trim(objSheet.Cells(intRow, 5).Value) strNTName = Trim(objSheet.Cells(intRow, 6).Value) strUPN = Trim(objSheet.Cells(intRow, 7).Value) strHomeFolder = Trim(objSheet.Cells(intRow, 8).Value) strHomeDrive = Trim(objSheet.Cells(intRow, 9).Value) strLogonScript = Trim(objSheet.Cells(intRow, 10).Value) ' Create user object. On Error Resume Next Set objUser = objContainer.Create("user", "cn=" & strCN) If Err.Number <> 0 Then On Error GoTo 0 Wscript.Echo "Unable to create user with cn: " & strCN Else On Error GoTo 0 ' Assign mandatory attributes and save user object. If strNTName = "" Then strNTName = strCN End If objUser.sAMAccountName = strNTName On Error Resume Next objUser.SetInfo If Err.Number <> 0 Then On Error GoTo 0 Wscript.Echo "Unable to create user with NT name: " & strNTName Else ' Set password for user. objUser.SetPassword strPW If Err.Number <> 0 Then On Error GoTo 0 Wscript.Echo "Unable to set password for user " & strNTName End If On Error GoTo 0 ' Enable the user account. objUser.AccountDisabled = False If strFirst <> "" Then objUser.givenName = strFirst End If ' Assign values to remaining attributes. If strMiddle <> "" Then objUser.initials = strMiddle End If If strLast <> "" Then objUser.sn = strLast End If If strUPN <> "" Then objUser.userPrincipalName = strUPN End If If strHomeDrive <> "" Then objUser.homeDrive = strHomeDrive End If If strHomeFolder <> "" Then objUser.homeDirectory = strHomeFolder End If If strLogonScript <> "" Then objUser.scriptPath = strLogonScript End If ' Set password expired. Must be changed on next logon. objUser.pwdLastSet = 0 ' Save changes. On Error Resume Next objUser.SetInfo If Err.Number <> 0 Then On Error GoTo 0 Wscript.Echo "Unable to set attributes for user with NT name: " _ & strNTName End If On Error GoTo 0 ' Create home folder. If strHomeFolder <> "" Then If Not objFSO.FolderExists(strHomeFolder) Then On Error Resume Next objFSO.CreateFolder strHomeFolder If Err.Number <> 0 Then On Error GoTo 0 Wscript.Echo "Unable to create home folder: " & strHomeFolder End If On Error GoTo 0 End If If objFSO.FolderExists(strHomeFolder) Then ' Assign user permission to home folder. intRunError = objShell.Run("%COMSPEC% /c Echo Y| cacls " _ & strHomeFolder & " /T /E /C /G " & strNetBIOSDomain _ & "\" & strNTName & ":F", 2, True) If intRunError <> 0 Then Wscript.Echo "Error assigning permissions for user " _ & strNTName & " to home folder " & strHomeFolder End If End If End If ' Group DN's start in column 11. intCol = 11 Do While objSheet.Cells(intRow, intCol).Value <> "" strGroupDN = Trim(objSheet.Cells(intRow, intCol).Value) On Error Resume Next Set objGroup = GetObject("LDAP://" & strGroupDN) If Err.Number <> 0 Then On Error GoTo 0 Wscript.Echo "Unable to bind to group " & strGroupDN Else objGroup.Add objUser.AdsPath If Err.Number <> 0 Then On Error GoTo 0 Wscript.Echo "Unable to add user " & strNTName _ & " to group " & strGroupDN End If End If On Error GoTo 0 ' Increment to next group DN. intCol = intCol + 1 Loop End If End If ' Increment to next user. intRow = intRow + 1 Loop Wscript.Echo "Done" ' Clean up. objExcel.ActiveWorkbook.Close objExcel.Application.Quit Set objUser = Nothing Set objGroup = Nothing Set objContainer = Nothing Set objSheet = Nothing Set objExcel = Nothing Set objFSO = Nothing Set objShell = Nothing Set objTrans = Nothing Set objRootDSE = Nothing Manage Your Profile |Rules of Conduct Manage Your Profile |Rules of Conduct Go To Replies MSN Groups Sponsored Links Software Downloads at Shopping.com Find, compare and buy products in categories ranging from graphics and publishing software to software utilities. Compare prices... www.shopping.com Media Software Download and Purchase Directdvd is a Software DVD Player for your PC, using SRS Circle Surround II and Dolby Digital. Users can experience full DVD... www.orionstudios.com Integratech Software Find the software you're looking for at Integsoft.com, developers of Superzip Zip/Unzip utility, Supernotes and Bill Central... www.integsoft.com First Previous 2-4 of 4 Next Last Reply Recommend Message 2 of 4 in Discussion From: icscript Sent: 1/28/2005 1:46 PM Just a guess. But what OS are you runninghtis script from. I haven;t verified this, but I think that %COMSPEC% is only an XP/2k3 enviroment variable. if you were runninghtis on a 2000 box, i do not think it is going to work. This could explain why the permissions are not being set. Anyway, you may read up on comspec to clarify. Reply Recommend Message 3 of 4 in Discussion From: Leon83511 Sent: 1/28/2005 5:21 PM I am using a win2k3 standard server and 2k workstations. I will have a look at comspec but I think this script was intended for 2k3 like you said. Any other suggestions? Reply Recommend Message 4 of 4 in Discussion From: JWSteenberge Sent: 2/3/2005 12:44 PM i don't know if this will help or not. i took that script that you found with the excel sheet and what not and did some major mods to it. i work for a school district so i seperate it into two if statements. one for students and one for faculty. we have two servers which are same as previous statement. the servers are both 2k3 and have the same drive structure. the script is a mess but it works very nicely for me. once in a very great while permissions get messed up for like 1 in 1000 users. we give all our 7-12 students accounts so we go through a lot every year. please don't mind the mess of the script. if anyone wants to help me port this to an asp page it would be great. work it from a database and i'll shake yer hand . btw - the xcel sheet has the following columns. firstname | lastname | description | password | groupname groupname is very important. this does the verification in the script to diferentiate between faculty & students. they must match. and to get the username it is first letter of first name followed by the full last name. jamie ' Created by: Jamie W. Steenberge ' Created on: April 26, 2004 ' This script will create domain accounts by either ' Faculty Group or Student Group based upon an excel spreadsheet ' Script must be run on a Win2k/XP/2003 Box connected to a domain ' Modify the lines between the modify brackets based upon your network ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ' DO NOT MODIFY BELOW HERE ' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' Option Explicit Const ADS_UF_DONT_EXPIRE_PASSWD = &h10000 Const CHANGE_PASSWORD_GUID = "{AB721A53-1E2F-11D0-9819-00AA0040529B}" Const ADS_RIGHT_DS_CONTROL_ACCESS = &H100 Const ADS_ACETYPE_ACCESS_ALLOWED = &H0 Const ADS_ACETYPE_ACCESS_DENIED = &H1 Const ADS_ACETYPE_ACCESS_ALLOWED_OBJECT = &H5 Const ADS_ACETYPE_ACCESS_DENIED_OBJECT = &H6 Const ADS_ACEFLAG_INHERITED_ACE = &H10 Const ADS_ACEFLAG_OBJECT_TYPE_PRESENT = &H1 Const FILE_SHARE = 0 Const MAXIMUM_CONNECTIONS = 25 Dim strExcelPath, strContainerStaffDN, strContainerStudentDN, strGroupDNT, strStudentDirName Dim strStudentBatch, strStudentDir, strStudentServer, strStudentShare, strStudentGroup Dim strStaffBatch, strStaffDir, strStaffServer, strStaffShare, strStaffGroup Dim objFSO, objShell, objRootDSE, strDNSDomain, objExcel Dim strNetbiosDomain, objTrans, objSheet, intRow, objContainer Dim strFirst, strLast, strDescription, strPW, strCN Dim strHomeFolder, objFolder, objWMIService, objNewShare, errReturn Dim intRunError, strGroupDN, intCol, objUser, objGroup Dim objACESelf, objACEEveryone, objSecDescriptor, objDACL, objPasswordExpirationFlag Dim strDN, objACE, blnSelf, blnEveryone, blnModified, strStaffDirName ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ' DO NOT MODIFY ABOVE HERE ' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ' MODIFY HERE ' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ' Specify spreadsheet path - this can be a network path if necesarry for multiple creation points strExcelPath = "c:\scripts\newusers.xls" ' Specify both DN's of container where Staff and Students will be places ' Change them to what you need them to be strContainerStaffDN = "ou=Staff,dc=enter,dc=dc,dc=here" strContainerStudentDN = "ou=Students,dc=enter,dc=dc,dc=here" ' Specify which container your groups are located in strGroupDNT = "ou=Domain Groups,dc=enter,dc=dc,dc=here" ' Specify Student share & Student directory which is where share is located. strStudentBatch = "students.bat" ' Directory on server where the shares are located strStudentDir = "z:\storage\" ' Student group name strStudentGroup = "Students" ' Server in which student shares are located strStudentServer = "servernamehere" ' Administrative share to which admins can access all student folders strStudentShare = "\\servernamehere\students$\" ' Specify Faculty share & Faculty directory which is where share is located. strStaffBatch = "staff.bat" ' Directory on server where the shares are located strStaffDir = "z:\storage\" ' Faculty group name strStaffGroup = "Faculty" ' Server in which faculty shares are located strStaffServer = "servernamehere" ' Administrative share to which admins can access all staff folders strStaffShare = "\\servernamehere\staff$\" ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ' END MODIFY ' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ' DO NOT MODIFY BELOW HERE ' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' Set objFSO = CreateObject("Scripting.FileSystemObject") Set objShell = CreateObject("Wscript.Shell") ' Determine DNS domain name from RootDSE object. Set objRootDSE = GetObject("LDAP://RootDSE") strDNSDomain = objRootDSE.Get("DefaultNamingContext") ' Use the NameTranslate object to find the NetBIOS domain name ' from the DNS domain name. Set objTrans = CreateObject("NameTranslate") objTrans.Init 3, strDNSDomain objTrans.Set 1, strDNSDomain strNetBIOSDomain = objTrans.Get(3) ' Remove trailing backslash. strNetBIOSdomain = Left(strNetBIOSDomain, Len(strNetBIOSDomain) - 1) ' Open spreadsheet. Set objExcel = CreateObject("Excel.Application") On Error Resume Next Err.Clear objExcel.Workbooks.Open strExcelPath If Err.Number <> 0 Then Err.Clear On Error GoTo 0 Wscript.Echo "Unable to open spreadsheet " & strExcelPath Wscript.Quit End If On Error GoTo 0 Set objSheet = objExcel.ActiveWorkbook.Worksheets(1) ' Start with row 2 of spreadsheet. ' Assume first row has column headings. intRow = 2 intCol = 5 ' Read each row of spreadsheet until a blank value ' encountered in column 5 (the column for user group). ' For each row, create user and set attribute values. Do While objSheet.Cells(intRow, 5).Value <> "" ' Read values from spreadsheet for this user. strFirst = Trim(objSheet.Cells(intRow, 1).Value) strLast = Trim(objSheet.Cells(intRow, 2).Value) strDescription = Trim(objSheet.Cells(intRow, 3).Value) strPW = Trim(objSheet.Cells(intRow, 4).Value) strGroupDN = Trim(objSheet.Cells(intRow, 5).Value) ' If any of the fields are blank then don't continue If Len(Trim(strFirst)) = 0 OR Len(Trim(strLast)) = 0 OR Len(Trim(strDescription)) = 0 OR Len(Trim(strPW)) = 0 OR Len(Trim(strGroupDN)) = 0 Then Wscript.Echo "You must provide all fields fully filled out before continuing." objExcel.ActiveWorkbook.Close objExcel.ActiveApplication.Quit Wscript.Quit End If ' Check to see if they are in Staff or Students and assign the proper variables for that group ' Start of student section If strGroupDN = strStudentGroup Then ' Set the username variable by combining the first letter of the first name followed by the whole last name strCN = Left(Trim(strFirst), 1) & Trim(strLast) ' Set home folder with all the variables - will be placed on profile page strHomeFolder = "\\" & strStudentServer & "\" & strCN & "$" Set objContainer = GetObject("LDAP://ou=" & strDescription & "," & strContainerStudentDN) If Err.Number <> 0 Then Err.Clear On Error GoTo 0 Wscript.Echo "Unable to bind to container: " & objContainer objExcel.ActiveWorkbook.Close objExcel.Application.Quit Wscript.Quit End If On Error GoTo 0 ' Create user object On Error Resume Next Err.Clear Set objUser = objContainer.Create("user", "cn=" & strCN) If Err.Number <> 0 Then Err.Clear On Error GoTo 0 Wscript.Echo "Unable to create user: " & strCN On Error Resume Next Else On Error GoTo 0 ' Assign mandatory attributes and then save the account objUser.SAMAccountName = strCN On Error Resume Next Err.Clear objUser.SetInfo If Err.Number <> 0 Then Err.Clear On Error GoTo 0 Wscript.Echo "Unable to create user with NT name: " & strCN On Error Resume Next Else ' set user's password objUser.SetPassword strPW If Err.Number <> 0 Then Err.Clear On Error GoTo 0 Wcript.Echo "Unable to set password for user: " & strCN End If On Error GoTo 0 ' Assign remaining Attributes objUser.AccountDisabled = False objUser.givenName = strFirst objUser.sn = strLast objUser.description = strDescription objUser.userPrincipalName = strCN objUser.homeDirectory = strHomeFolder objUser.scriptPath = strStudentBatch On Error Resume Next Err.Clear objUser.SetInfo If Err.Number <> 0 Then Err.Clear On Error GoTo 0 Wcript.Echo "Unable to set attributes for user with NT name: " & strCN End If On Error GoTo 0 Set objFSO = CreateObject("Scripting.FileSystemObject") Set objFolder = objFSO.CreateFolder( strStudentShare & strDescription & "\" & strCN) ' Assign user permission to home folder. intRunError = objShell.Run("%COMSPEC% /c Echo Y| cacls " & strStudentShare & strDescription & "\" & strCN & " /T /E /C /G " & strNetBIOSDomain & "\" & strCN & ":F", 2, True) intRunError = objShell.Run("%COMSPEC% /c Echo Y| cacls " & strStudentShare & strDescription & "\" & strCN & " /T /E /C /G Administrators:F", 2, True) intRunError = objShell.Run("%COMSPEC% /c Echo Y| cacls " & strStudentShare & strDescription & "\" & strCN & " /T /E /R " & strStudentGroup, 2, True) strStudentDirName = strStudentDir & strDescription & "\" & strCN Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strStudentServer & "\root\cimv2") Set objNewShare = objWMIService.Get("Win32_Share") errReturn = objNewShare.Create ( strStudentDirName , strCN & "$" , FILE_SHARE, MAXIMUM_CONNECTIONS, "Created by remote command.") If intRunError <> 0 Then Wscript.Echo "Error assigning permissions for user " & strCN & " to home folder " & strHomeFolder End If End If End If 'Do While objSheet.Cells(intRow, intCol).Value <> "" ' Set the users group Set objGroup = GetObject("LDAP://cn=" & strGroupDN & "," & strGroupDNT ) If Err.Number <> 0 Then Err.Clear On Error GoTo 0 Wscript "Unable to bind to group: " & strGroupDN Else objGroup.Add objUser.AdsPath If Err.Number <> 0 Then Err.Clear On Error GoTo 0 Wscript.Echo "Unable to add user " & strCN & " to group " & strGroupDN End If End If 'On Error GoTo 0 ' Increment to next group DN 'intCol = intCol + 1 'Loop Call PasswordChange("cn=" & strCN & "," & "ou=" & strDescription & "," & strContainerStudentDN) End If ' End of Student section ' Start of Staff section If strGroupDN = strStaffGroup Then ' Set the username variable by combining the first letter of the first name followed by the whole last name strCN = Left(Trim(strFirst), 1) & Trim(strLast) ' Set home folder with all the variables - will be placed on profile page strHomeFolder = "\\" & strStaffServer & "\" & strCN & "$" Set objContainer = GetObject("LDAP://" & strContainerStaffDN) If Err.Number <> 0 Then Err.Clear On Error GoTo 0 Wscript.Echo "Unable to bind to container: " & objContainer objExcel.ActiveWorkbook.Close objExcel.Application.Quit Wscript.Quit End If On Error GoTo 0 ' Create user object On Error Resume Next Err.Clear Set objUser = objContainer.Create("user", "cn=" & strCN) If Err.Number <> 0 Then Err.Clear On Error GoTo 0 Wscript.Echo "Unable to create user: " & strCN On Error Resume Next Else On Error GoTo 0 ' Assign mandatory attributes and then save the account objUser.SAMAccountName = strCN On Error Resume Next Err.Clear objUser.SetInfo If Err.Number <> 0 Then Err.Clear On Error GoTo 0 Wscript.Echo "Unable to create user with NT name: " & strCN On Error Resume Next Else ' set user's password objUser.SetPassword strPW If Err.Number <> 0 Then Err.Clear On Error GoTo 0 Wcript.Echo "Unable to set password for user: " & strCN End If On Error GoTo 0 ' Assign remaining Attributes objUser.AccountDisabled = False objUser.givenName = strFirst objUser.sn = strLast objUser.description = strDescription objUser.userPrincipalName = strCN objUser.homeDirectory = strHomeFolder objUser.scriptPath = strStaffBatch On Error Resume Next Err.Clear objUser.SetInfo If Err.Number <> 0 Then Err.Clear On Error GoTo 0 Wcript.Echo "Unable to set attributes for user with NT name: " & strCN End If On Error GoTo 0 Set objFSO = CreateObject("Scripting.FileSystemObject") Set objFolder = objFSO.CreateFolder( strStaffShare & strCN) ' Assign user permission to home folder. intRunError = objShell.Run("%COMSPEC% /c Echo Y| cacls " & strStaffShare & strCN & " /T /E /C /G " & strNetBIOSDomain & "\" & strCN & ":F", 2, True) intRunError = objShell.Run("%COMSPEC% /c Echo Y| cacls " & strStaffShare & strCN & " /T /E /C /G Administrators:F", 2, True) intRunError = objShell.Run("%COMSPEC% /c Echo Y| cacls " & strStaffShare & strCN & " /T /E /R " & strStaffGroup, 2, True) strStaffDirName = strStaffDir & strCN Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strStaffServer & "\root\cimv2") Set objNewShare = objWMIService.Get("Win32_Share") errReturn = objNewShare.Create ( strStaffDirName , strCN & "$" , FILE_SHARE, MAXIMUM_CONNECTIONS, "Created by remote command.") If intRunError <> 0 Then Wscript.Echo "Error assigning permissions for user " & strCN & " to home folder " & strHomeFolder End If End If End If 'Do While objSheet.Cells(intRow, intCol).Value <> "" ' Set the users group Set objGroup = GetObject("LDAP://cn=" & strGroupDN & "," & strGroupDNT ) If Err.Number <> 0 Then Err.Clear On Error GoTo 0 Wscript "Unable to bind to group: " & strGroupDN Else objGroup.Add objUser.AdsPath If Err.Number <> 0 Then Err.Clear On Error GoTo 0 Wscript.Echo "Unable to add user " & strCN & " to group " & strGroupDN End If End If 'On Error GoTo 0 ' Increment to next group DN 'intCol = intCol + 1 'Loop Call PasswordChange("cn=" & strCN & "," & strContainerStaffDN) End If ' End of Staff Section ' Increment to next user. intRow = intRow + 1 Loop Wscript.Echo "Done Creating all users." ' Next two functions set password to never expire Function PasswordChange(strDN) On Error Resume Next Err.Clear Set objUser = GetObject("LDAP://" & strDN) If Err.Number <> 0 Then Err.Clear Wscript.Echo "User not found" & vbCrLf & strDN Wscript.Quit(1) End If On Error GoTo 0 ' Bind to the user security objects. Set objSecDescriptor = objUser.Get("ntSecurityDescriptor") Set objDACL = objSecDescriptor.discretionaryAcl ' Search for ACE's for Change Password and modify. blnSelf = False blnEveryone = False blnModified = False For Each objACE In objDACL If UCase(objACE.objectType) = UCase(CHANGE_PASSWORD_GUID) Then If UCase(objACE.Trustee) = "NT AUTHORITY\SELF" Then If objACE.AceType = ADS_ACETYPE_ACCESS_ALLOWED_OBJECT Then objACE.AceType = ADS_ACETYPE_ACCESS_DENIED_OBJECT blnModified = True End If blnSelf = True End If If UCase(objACE.Trustee) = "EVERYONE" Then If objACE.AceType = ADS_ACETYPE_ACCESS_ALLOWED_OBJECT Then objACE.AceType = ADS_ACETYPE_ACCESS_DENIED_OBJECT blnModified = True End If blnEveryone = True End If End If Next ' If ACE's found and modified, save changes and exit. If (blnSelf = True) And (blnEveryone = True) Then objSecDescriptor.discretionaryACL = Reorder(objDACL) objUser.Put "ntSecurityDescriptor", objSecDescriptor objUser.Put "userAccountControl", ADS_UF_DONT_EXPIRE_PASSWD objUser.SetInfo ' Wscript.Echo "User modified so they cannot change their password" End If ' If ACE's not found, add to DACL. If blnSelf = False Then ' Create the ACE for Self. Set objACESelf = CreateObject("AccessControlEntry") objACESelf.Trustee = "NT AUTHORITY\SELF" objACESelf.AceFlags = 0 objACESelf.AceType = ADS_ACETYPE_ACCESS_DENIED_OBJECT objACESelf.Flags = ADS_ACEFLAG_OBJECT_TYPE_PRESENT objACESelf.objectType = CHANGE_PASSWORD_GUID objACESelf.AccessMask = ADS_RIGHT_DS_CONTROL_ACCESS objDACL.AddAce objACESelf End If If blnEveryone = False Then ' Create the ACE for Everyone. Set objACEEveryone = CreateObject("AccessControlEntry") objACEEveryone.Trustee = "Everyone" objACEEveryone.AceFlags = 0 objACEEveryone.AceType = ADS_ACETYPE_ACCESS_DENIED_OBJECT objACEEveryone.Flags = ADS_ACEFLAG_OBJECT_TYPE_PRESENT objACEEveryone.objectType = CHANGE_PASSWORD_GUID objACEEveryone.AccessMask = ADS_RIGHT_DS_CONTROL_ACCESS objDACL.AddAce objACEEveryone End If objSecDescriptor.discretionaryACL = Reorder(objDACL) ' Update the user object. objUser.Put "ntSecurityDescriptor", objSecDescriptor objUser.SetInfo ' Clean up. Set objUser = Nothing Set objACESelf = Nothing Set objACEEveryone = Nothing Set objDACL = Nothing Set objACE = Nothing Set objSecDescriptor = Nothing End Function Function Reorder(objDACL) ' Reorder ACE's in DACL. Dim objNewDACL, objInheritedDACL, objAllowDACL, objDenyDACL Dim objAllowObjectDACL, objDenyObjectDACL, objACE Set objNewDACL = CreateObject("AccessControlList") Set objInheritedDACL = CreateObject("AccessControlList") Set objAllowDACL = CreateObject("AccessControlList") Set objDenyDACL = CreateObject("AccessControlList") Set objAllowObjectDACL = CreateObject("AccessControlList") Set objDenyObjectDACL = CreateObject("AccessControlList") For Each objACE In objDACL If ((objACE.AceFlags And ADS_ACEFLAG_INHERITED_ACE) = _ ADS_ACEFLAG_INHERITED_ACE) Then objInheritedDACL.AddAce objACE Else Select Case objACE.AceType Case ADS_ACETYPE_ACCESS_ALLOWED objAllowDACL.AddAce objACE Case ADS_ACETYPE_ACCESS_DENIED objDenyDACL.AddAce objACE Case ADS_ACETYPE_ACCESS_ALLOWED_OBJECT objAllowObjectDACL.AddAce objACE Case ADS_ACETYPE_ACCESS_DENIED_OBJECT objDenyObjectDACL.AddAce objACE Case Else blnACL = False End Select End If Next For Each objACE In objDenyDACL objNewDACL.AddAce objACE Next For Each objACE In objDenyObjectDACL objNewDACL.AddAce objACE Next For Each objACE In objAllowDACL objNewDACL.AddAce objACE Next For Each objACE In objAllowObjectDACL objNewDACL.AddAce objACE Next For Each objACE In objInheritedDACL objNewDACL.AddAce objACE Next objNewDACL.ACLRevision = objDACL.ACLRevision Set Reorder = objNewDACL Set objNewDACL = Nothing Set objInheritedDACL = Nothing Set objAllowDACL = Nothing Set objDenyDACL = Nothing Set objAllowObjectDACL = Nothing Set objDenyObjectDACL = Nothing Set objACE = Nothing End Function ' Clean up. Set objUser = Nothing Set objGroup = Nothing Set objContainer = Nothing Set objSheet = Nothing 'Set objExcel = Nothing Set objFSO = Nothing Set objShell = Nothing Set objTrans = Nothing Set objRootDSE = Nothing objExcel.ActiveWorkbook.Close objExcel.Application.Quit ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ' DO NOT MODIFY ABOVE HERE ' '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''

Слова: windows, Active Directory, AD, script
Nov. 17, 7600 // 11:13 [ permalink : LJ ]

Комментарии Отключены