Re: Login scripts based on Organisational Units

Tech-Archive recommends: Fix windows errors by optimizing your registry

"Richard Mueller [MVP]" <rlmueller-nospam@xxxxxxxxxxxxxxxxxxxx> wrote in
message news:u3Ro%23vD7JHA.2656@xxxxxxxxxxxxxxxxxxxxxxx

"microsoft" <microsoft@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1E49AEEC-401E-427C-BF77-FB59C3E7ACB6@xxxxxxxxxxxxxxxx
Hi

Could anyone assist with a login script that maps shares to drives based
on
the organisational unit the user is assigned.

any assitance would be greatly appreciated.

thanks

If you don't want to use GPO's linked to your OU's (or group membership),
a scripting solution requires that you parse the user Distinguished Name.
There is no built in method or attribute that you can use. The most
reliable method I have found follows:
=========
Dim objSysInfo, strUserDN, objUser
Dim strOUPath, arrContainers, arrOU, strOU

' Bind to current user object.
Set objSysInfo = CreateObject("ADSystemInfo")
strUserDN = objSysInfo.UserName
' Escape any embedded forward slash characters.
strUserDN = Replace(strUserDN, "/", "\/")
Set objUser = GetObject("LDAP://"; & strUserDN)

' Retrieve DN of parent OU/Container.
strOUPath = objUser.Parent

' Replace any escaped commas with Chr(164).
strOUPath = Replace(strOUPath, "\,", Chr(164))

' Parse Parent DN into comma delimited components.
arrContainers = Split(strOUPath, ",")

' Parse the first component to retrive name of the OU/Container.
arrOU = Split(arrContainers(0), "=")
strOU = arrOU(1)

' Restore any escaped commas.
strOU = Replace(strOU, Chr(164), "\,")

Wscript.Echo "User is in OU/Container " & strOU
=======
Another method would be to bind to the parent OU, using the DN retrieved
with the Parent method of the user object, and retrieving the value of the
ou attribute. However, this will fail if the user is in a container (or in
the root of the domain). It also requires one more binding operation,
which can be avoided. The above works in all cases I can think of.

Note, however, that in general the relative distinguished name of the OU
may not be unique. There can be several OU's called "Sales", as along as
they are in different parent OU's, for example. It is best to use the
Distinguished Names of the OU's, and make the comparisons case
insensitive. For example:
=========
' Bind to current user object.
Set objSysInfo = CreateObject("ADSystemInfo")
strUserDN = objSysInfo.UserName
' Escape any embedded forward slash characters.
strUserDN = Replace(strUserDN, "/", "\/")
Set objUser = GetObject("LDAP://"; & strUserDN)

' Retrieve DN of parent OU/Container.
strOUPath = objUser.Parent

Select Case LCase(strOUPath)
Case "ou=sales,ou=east,dc=mydomain,dc=com"
' Do something.
Case "ou=sales,ou=west,dc=mydomain,dc=com"
' Do something.
Case "ou=sales,ou=north,dc=mydomain,dc=com"
' Do something.
Case "ou=sales,ou=south,dc=mydomain,dc=com"
' Do something.
End Select

--
Richard Mueller
MVP Directory Services
Hilltop Lab - http://www.rlmueller.net
--




Hi Richard,

Sounds complicated to me, whereas a script based on group membership may be
much simpler no matter what OU the user account exists in!

Ace


.

Relevant Pages

  • Re: Finding the lowest OU a user is in
    ... In a logon script you can use the ADSystemInfo object to retrieve the ... then use the Parent method to retrieve the Distinguished Name of the parent ... ' Retrieve DN of Parent container. ...
    (microsoft.public.scripting.vbscript)
  • Re: Login scripts based on Organisational Units
    ... Dim strOUPath, arrContainers, arrOU, strOU ... ' Retrieve DN of parent OU/Container. ... ' Replace any escaped commas with Chr. ... ' Parse Parent DN into comma delimited components. ...
    (microsoft.public.windows.server.general)
  • createElement(script) in iframes parent page
    ... I had an iframe in the same domain as it's parent page (so no x-security ... When I was debugging the code I would encounter the ... "interactive" state as also good enough to create the script element. ...
    (microsoft.public.scripting.jscript)
  • Re: Creating Directories without AUTO Parent Propagation?
    ... If the parent directory has any specific user settings .. ... Then all new sub folders created below that folder will not have propagation ... As you can see the below script first does as follows.. ... > remove the the check / propagate from parent option.. ...
    (comp.os.ms-windows.nt.admin.security)
  • Re: Creating Directories without AUTO Parent Propagation?
    ... If the parent directory has any specific user settings .. ... Then all new sub folders created below that folder will not have propagation ... As you can see the below script first does as follows.. ... > remove the the check / propagate from parent option.. ...
    (comp.os.ms-windows.nt.admin.security)