dsrm tool

We just finished writing a windows cmd script to locate and delete aging computer accounts from AD. The script uses a combination of the ds* tools to find old accounts, check to see whether they have a flag to exclude their deletion and if not delete them from AD. We ran into a problem where some accounts had child objects (virtual server hosts for one) that requires us to use the -subtree option with dsrm. It works like a charm.

The script can be found here:
http://linux2.gmartin.org:82/tiki/tiki-view_blog_post.php?blogId=2&postId=138

But it got me thinking, what if a bug in the script caused cn=computer,ou=servers,dc=corp,dc=com to drop the CN and leave the OU inplace. The subtree switch would allow dsrm to delete the OU and everything in it. So I have two thoughts.

- We're going to set the "prevent accidental deletion" flag on all OUs. This is a good practice anyway. We found this script reference for that:
http://msmvps.com/blogs/ulfbsimonweidner/archive/2007/09/25/protect-objects-from-accidential-deletion-in-windows-server-2008.aspx

- Second, would it make sense to ask MS to add a switch to dsrm that would prevent it from deleting OUs? That way, if you wrap it in a script you could specify the -nooudelete switch and regardless of what you asked, it would refuse to act.

Any thoughts on this?

\\uSlackr

.

Relevant Pages

  • Re: dsrm tool
    ... The script uses a combination of the ds* tools to find old accounts, check to see whether they have a flag to exclude their deletion and if not delete them from AD. ... We ran into a problem where some accounts had child objects that requires us to use the -subtree option with dsrm. ... The subtree switch would allow dsrm to delete the OU and everything in it. ...
    (microsoft.public.windows.server.active_directory)
  • Re: dsrm tool
    ... Here is the meat for deleting inactive computer accounts. ... The script uses a combination of the ds* tools to find old accounts, check to see whether they have a flag to exclude their deletion and if not delete them from AD. ... We ran into a problem where some accounts had child objects that requires us to use the -subtree option with dsrm. ... The subtree switch would allow dsrm to delete the OU and everything in it. ...
    (microsoft.public.windows.server.active_directory)
  • Re: dsrm tool
    ... I took our script for managing aging user accounts and mod'd it for computer accounts. ... Why would the subtree switch dsrm cause it to delete the OU? ... As I said, if there was a bug in my script that I hadn't accounted for that somehow munged the DN having the -subtree switch in the command adds a lot of risk. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Last Logon Time Stamp
    ... > I am new to script. ... > I need to list out inactive accounts more than 90 days in both AD accounts ... Use ADO to retrieve lastLogonTimeStamp for all users. ... And here is a sample program that retrieves the distinguishedName for all ...
    (microsoft.public.windows.server.scripting)
  • Re: Script to delete computer accounts not working
    ... thanks for the initial script as well. ... computer accounts that are disabled and haven't been modified for 30 days. ... Set objCommand = CreateObject ...
    (microsoft.public.scripting.vbscript)
Loading