After the Organizational Units have been created, we populate the Active Directory with user accounts and security groups. Group membership for users is based on both the Organizational Unit (or ‘team’) they belong to, and their function in the team (team leader, coordinator, clerk). Each user will be member of 1 group only (eg: team leader of the Production Team, clerk in the Communications team, …).<\/p>\n
By making each global group member of a number of local groups, users acquire membership of several local groups which then can be used to manage file and directory access, group policy filtering, and so on.<\/p>\n
The script obviously assumes a certain design in the Active Directory : an Organizational Unit logical structure, users with membership to groups, therefore also a logical structure of somain local and global groups, etc. This is described in Active Directory Design and Implementation.<\/p>\n
Furthermore, user profiles, user home directory and user special folders are located on the server, so we use this script to create the relevant directorys and set the correct NTFS permissions. Please refer to and Group Policy : Roaming User Profiles and Folder Redirection<\/p>\n
This script takes input from a text file (eg. ‘users.txt’) that lists user names, the team they belong to, and their role or function in the team. The user name will provide the user account name, the team name will indicate the OU and a part of the group names, the function or role will provide the name of the group that the user will be made member of. Because of the repetitive structure of the groups in the Organizational Units, the script can be built around a number of FOR statements.<\/p>\n
input file : users.txt<\/p>\n
\tUser\t\tRole -> Group\tTeam<\/p>\n
\t—————————————–
\n\tChristine\tCoordinators\tPT
\n\tKoen\t\tClerks\t\tPT
\n\tKaat\t\tTeamleiders\tFT
\n\tBrigitte\tClerks\t\tFT
\n\tElsk\t\tClerks\t\tST
\n\tIna\t\tTeamleiders\tCT
\n\tKristel\t\tClerks\t\tCT
\n\tAnne\t\tTeamleiders\tND
\n\t< ...><\/p>\n
This file can be made manually, or we can use scripts that generate the desired output<\/p>\n
batch file<\/p>\n
@echo OFF
\n\tset theDomain=dc=kicks, dc=local
\n\tset input=users.txt
\n\tIF NOT EXIST .%input% GOTO ERR1<\/p>\n
REM create users and user home directory (including NTFS Permissions)
\nREM Profile will later be complemented with
\nREM group policy user configuration (Folder Redirection, Logon scripts e.a.)<\/p>\n
FOR \/F “tokens=1-3 skip=3” %%i in (%input%) do (
\n\tREM create user home and profile directory in advance
\n\tmd F:home%%i
\n\tmd F:users%%i<\/p>\n
\tREM create user account
\n\tdsadd user “cn=%%i, ou=%%k, ou=theOffice, %theDomain%”
\n\t\t\t\t-pwd aaaAAA111 -mustchpwd yes -canchpwd yes
\n\t\t\t\t-profile \\SRV01users$dsadd user “cn=%%i, ou=%%k, ou=theOffice, %theDomain%”
\n\t\t\t\t-hmdir \\SRV01home$%%i -hmdrv P:
\n\t\t\t\t-loscr logon.bat<\/p>\n
\tREM while we’re at it, set NTFS security for user home and profile folder
\n\tREM \t User : Read\/Write \tAdministrators : Full Control,<\/p>\n
\txcacls F:home%%i \/c \/y \/t \/e \/g “%%i”:rcd;ew Administrators:f;f
\n\txcacls F:users%%i \/c \/y \/t \/e \/g “%%i”:rcd;ew Administrators:f;f<\/p>\n
)<\/p>\n
REM create groups in each OU<\/p>\n
dsadd group “cn=lTeam, ou=theOffice, %theDomain%” -secgrp yes -scope L -samid lTeam<\/p>\n
for %%i in (Teamleiders, Administratie, Coordinators, Stagiairs) do (
\n\tdsadd group “cn=l%%i, ou=theOffice, %theDomain%” -secgrp yes -scope L -samid l%%i
\n)<\/p>\n
for %%j in (PT,CT,VT,FT,ND) do (
\n\tdsadd group “cn=lTeam, ou=%%j, ou=theOffice, %theDomain%” -secgrp yes -scope L -samid lTeam_%%j<\/p>\n
\tfor %%i in (Teamleiders, Administratie, Coordinators, Stagiairs) do (<\/p>\n
\t\tdsadd group “cn=%%i, ou=%%j, ou=theOffice, %theDomain%” -secgrp yes -scope G -samid %%i_%%j<\/p>\n
\t\techo \tmake GLOBAL GROUPS member of LOCAL GROUPS
\n\t\tdsmod group “cn=lTeam, ou=theOffice, %theDomain%” -addmbr “cn=%%i, ou=%%j, ou=theOffice, %theDomain%”<\/p>\n
\t\tdsmod group “cn=lTeam, ou=%%j, ou=theOffice, %theDomain%” -addmbr “cn=%%i, ou=%%j, ou=theOffice, %theDomain%”<\/p>\n
\t\tdsmod group “cn=l%%i, ou=theOffice, %theDomain%” -addmbr “cn=%%i, ou=%%j, ou=theOffice, %theDomain%”
\n\t)
\n)<\/p>\n
REM make users member of group according to listing in inputfile<\/p>\n
for \/F “tokens=1-3 skip=3” %%i in (%input%) do (
\n\tdsmod group “cn=%%j, ou=%%k, ou=theOffice, %theDomain%” -addmbr “cn=%%i, ou=%%k, ou=theOffice, %theDomain%”
\n)<\/p>\n
REM remove groups that we don’t want (if any)<\/p>\n
REM remove groups (Administratie, Coordinators, Stagiairs) from ou ND,
\nREM dsrm ObjectDN … [-subtree] -noprompt\t;;removes objects
\nREM dsmod group GroupDN -rmmbr MemberDN\t;;removes members from a group<\/p>\n
dsrm “cn=Administratie, ou=ND, ou=theOffice, %theDomain%” -noprompt
\ndsrm “cn=Coordinators, ou=ND, ou=theOffice, %theDomain%” -noprompt
\ndsrm “cn=Stagiairs, ou=ND, ou=theOffice, %theDomain%” -noprompt<\/p>\n
REM custom modifications : for exeptions eg. for users in more than 1 group
\nREM add statements here<\/p>\n
REM FINISH
\nGOTO BATCHEND<\/p>\n
:ERR1
\nECHO %0 requires input from %input%. inputfile %input% not found.
\nEXIT \/B 1<\/p>\n
:BATCHEND
\nECHO %0 done.<\/p>\n
When the list of user accounts has the user distinguished name, it makes sense to use the distinguished name to create the account. Using the distinguished name to create the account automatically puts the user in the correct Organizational unit, as OU’s and domain are part of the name. Distinghuished names can be retrieved by scripts. The dsadd user statement used in the above script can be used to create accounts based in distinguished names.<\/p>\n
\t(…)
\n \tCN=Leen,OU=ST,OU=kantoor,DC=KICKS,DC=LOCAL Leen
\n \tCN=Elsk,OU=ST,OU=kantoor,DC=KICKS,DC=LOCAL Elsk
\n \tCN=Ina,OU=CT,OU=kantoor,DC=KICKS,DC=LOCAL Ina
\n \t(…)<\/p>\n
\tREM (line breaks added for readibility)<\/p>\n
\tFOR \/L “tokens=1-2” %%x in (users.txt) do (<\/p>\n
\t\tDsadd\tuser “%%x” \t-samid %%y
\n\t\t\t\t\t-pwd aaaAAA111
\n\t\t\t\t\t-mustchpwd yes
\n\t\t\t\t\t-canchpwd yes
\n\t\t\t\t\t-profile \\SRV01users$%%y
\n\t\t\t\t\t-hmdir \\SRV01home$%%y
\n\t\t\t\t\t-hmdrv P :
\n\t\t\t\t\t-loscr logon.bat
\n\t)<\/p>\n
On earlier Windows systems (eg. Windows 2000), ADSI scripts can be used to create a user in a given Organizational unit :<\/p>\n
\t\tSet objOU = GetObject(“LDAP:\/\/ou=PT,dc=kicks,dc=local”)<\/p>\n
\t\tSet objUser = objOU.Create(“User”, “cn=Lennart”)
\n\t\tobjUser.Put “sAMAccountName”, “Lennart”<\/p>\n
\t\tobjUser.SetInfo<\/p>\n
By default, there is no assigned password for this user account, and the account is disabled, so the following statementys may be added :<\/p>\n
\t\tobjUser.SetPassword “AA123456”
\n\t\tobjUser.AccountDisabled = True<\/p>\n
\t\tobjUser.SetInfo<\/p>\n","protected":false},"excerpt":{"rendered":"
After the Organizational Units have been created, we populate the Active Directory with user accounts and security groups. Group membership for users is based on both the Organizational Unit (or ‘team’) they belong to, and their function in the team (team leader, coordinator, clerk). Each user will be member of 1 group only (eg: team […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[2,1],"tags":[],"_links":{"self":[{"href":"https:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/posts\/1269"}],"collection":[{"href":"https:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/obieta.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1269"}],"version-history":[{"count":0,"href":"https:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/posts\/1269\/revisions"}],"wp:attachment":[{"href":"https:\/\/obieta.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1269"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/obieta.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1269"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/obieta.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1269"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}