J3ff Dixon's Blog: Active Directory

Active Directory - Updating login scripts for user accounts in AD

To continue from previous posts, I was able to get listings of what login scripts were set and who didn’t have one at all. The next step now that I had this info was to start updating them. With the output files created from before I was able to parse out groups of users I wanted to update into separate lists.

So take for example the master list that showed everyone and their script. I could bring that into excel and sort by scripts, remove anyone listed I didn’t want to update, and remove any content other than the username. Why? Well because I want to take that new list, put it back into a text file so that it contains nothing but a list of usernames I want to change and run a script against it. If the file contains commas and comments, etc I take all that out. Find and replace makes it simple as does splitting data into columns and then removing columns. There’s different ways to do it, whatever works.

You can do this different ways, one at a time, all at once, etc, and lots of modifications can be made to the script to do things differently or to do more but let’s keep it simple. I have a text file with one username on each line. I want to update the login script for all these users to bluebananas.bat. In comes another batch file to the rescue. Simply update the name of the text file in the batch file to reflect yours then scroll down and update the name of the login script you want them to have. Save it and run it, ensure your user has permission to edit AD. The batch file will create two log files to verify which users successfully updated and which ones did not. That’s it, in just few moments you could update the login script for every user in your organization.

@ECHO OFF

SET UserList=userstoupdate.txt

SET SuccessFile=All-Successful.log

SET FailedFile=All-Failed.log

echo ----------------------------------- >> %FailedFile%

echo %date:~-10,10% %time:~-11,5% >> %FailedFile%

echo ----------------------------------- >> %FailedFile%

echo ----------------------------------- >> %SuccessFile%

echo %date:~-10,10% %time:~-11,5% >> %SuccessFile%

echo ----------------------------------- >> %SuccessFile%

REM -----------------------------------

CLS

ECHO.

IF NOT EXIST "%UserList%" (

ECHO Cannot locate Machine List: %UserList%

PAUSE>NUL

GOTO :EOF

)

FOR /f "tokens=*" %%M in (%UserList%) do CALL :CHECK "%%M"

GOTO :EOF

:CHECK

SET USER=%~1

SET USER=%USER: =%

NET USER %USER% /scriptpath:bluebananas.bat

IF %ERRORLEVEL% NEQ 0 ECHO %USER%>>%FailedFile%

IF %ERRORLEVEL% NEQ 1 ECHO %USER%>>%SuccessFile%

EXIT /B

:EOF

Active Directory – List login script for all user accounts

This is simply a continuation from the last post. This version of the VBS will return a listing of all users and what script if any is listed in their account. See previous post if you need help saving and running it.

VBS Script:

'Option Explicit

Dim adoCommand, adoConnection, strBase, strFilter, strAttributes

Dim objRootDSE, strDNSDomain, strQuery, adoRecordset, strName, strScript

' Setup ADO objects.

Set adoCommand = CreateObject("ADODB.Command")

Set adoConnection = CreateObject("ADODB.Connection")

adoConnection.Provider = "ADsDSOObject"

adoConnection.Open "Active Directory Provider"

adoCommand.ActiveConnection = adoConnection

' Search entire Active Directory domain.

Set objRootDSE = GetObject("LDAP://RootDSE")

strDNSDomain = objRootDSE.Get("defaultNamingContext")

strBase = "<LDAP://" & strDNSDomain & ">"

' Filter on user objects.

strFilter = "(&(objectCategory=person)(objectClass=user))"

' Comma delimited list of attribute values to retrieve.

strAttributes = "sAMAccountName,scriptPath"

' Construct the LDAP syntax query.

strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"

adoCommand.CommandText = strQuery

adoCommand.Properties("Page Size") = 100

adoCommand.Properties("Timeout") = 30

adoCommand.Properties("Cache Results") = False

' Run the query.

Set adoRecordset = adoCommand.Execute

' Enumerate the resulting recordset.

Do Until adoRecordset.EOF

' Retrieve values and display.

strName = adoRecordset.Fields("sAMAccountName").Value

strScript = adoRecordset.Fields("scriptPath").value

Wscript.Echo strName & "," & strScript

' Move to the next record in the recordset.

adoRecordset.MoveNext

Loop

' Clean up.

adoRecordset.Close

adoConnection.Close

Active Directory – Find users with no login script specified in their user account

Recently I was trying to clean up the login scripts set in my user accounts. I have a lot of users, they had different scripts set and some had none at all. I made a lot of changes to my login script to streamline things and it was time to apply this change and also cleanup who was configured with what. Some were outdated and should have changed; some were missing the script, and so on. Now to be truthful it wasn’t all that bad but I like things neat and proper when possible and time allows. Thing is, there was just no way I was going to go through one by one and look at and update each user, I would have never finished that one so I started working on a solution. As a whole, users were set as they should be; however, I had noticed that there were many users I kept seeing with no login script. This was my main concern. I wanted to be sure that all my users that need the script had it. Enter VBS. I’ll go ahead and note this is not my script; I’m not that good of a programmer.

To create the file copy the text below into notepad and save as noscript.vbs or whatever you’d like to name it.

Copy the vbs file to the AD server you want to run it on. From that server, in order to output a list of all users with no script listed in there account, run the following command (must be in the directory where the vbs file is located or specify the path with the file):

cscript noscript.vbs > outputfile.txt

For a better analysis if desired you can then pull the data from the txt file into a spreadsheet and break the data into columns.

VBS Script: