Re: Script not working correctly for users w/out admin rights to t

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Al Dunbar [MS-MVP] (alan-no-drub-spam_at_hotmail.com)
Date: 06/12/04

  • Next message: Richard Mueller [MVP]: "Re: Script not working correctly for users w/out admin rights to t" 
    Date: Sat, 12 Jun 2004 17:14:17 -0600

    Could it be that when you have tested this for accounts that have admin
    rights, those accounts also happen to have some different group membership
    settings that happen to not cause your script to fail, whereas the
    non-admins do not?

    Clearly, the script works in some cases and fails in others. Richard
    explained "the right way" to do this stuff in the general case, because
    doing it the wrong way "works in some cases and fails in others". I'd
    suggest you try it Richard's way, and let us know if you still have the
    problem. If you don't, then you will know the answer to your question below.
    If the problem persists, then we will need to have another look.

    /Al

    "Jerry" <Jerry@discussions.microsoft.com> wrote in message
    news:57955E09-FD92-4EC5-8C68-A9E4970958CE@microsoft.com...
    > Thanks but that does not explain why it works if the users have admin
    rights to the server.
    >
    > "Richard Mueller [MVP]" wrote:
    >
    > > Jerry wrote:
    > >
    > > > I have a small network running Server 2003. I have created a logon
    script
    > > based on the example I obtained from Help & Support. It looks something
    like
    > > this:
    > > >
    > > > Const SOME_GROUP = "cn=somegroup"
    > > >
    > > > Set wshNetwork = CreateObject("WScript.Network")
    > > >
    > > > wshNetwork.MapNetworkDrive "u:", "\\Server\SomeFolder" &
    > > wshNetwork.UserName
    > > > wshNetwork.MapNetworkDrive "m:", "\\Server\SomeFolder"
    > > >
    > > > Set ADSysInfo = CreateObject("ADSystemInfo")
    > > > Set CurrentUser = GetObject("LDAP://" & ADSysInfo.UserName)
    > > > strGroups = LCase(Join(CurrentUser.MemberOf))
    > > >
    > > > If InStr(strGroups, SOME_GROUP) Then
    > > >
    > > > wshNetwork.MapNetworkDrive "Q:", "\\Server\SomeFolder"
    > > >
    > > > End If
    > > >
    > > > My problem is that my users that do not have admin rights to the
    server
    > > get an type mismatch error for the "Join" setting in line 10. I don't
    want
    > > to give all my users admin rights to the server but so far that is the
    only
    > > way I have found to fix the problem. Can someone please provide a better

    > > way?
    > >
    > > Hi,
    > >
    > > Every user should have rights to read the memberOf attribute of their
    user
    > > object, unless this permission has been specifically denied. A more
    likely
    > > explanation is that the code you posted will fail if
    CurrentUser.memberOf is
    > > not an array. The code should account for the memberOf attribute having
    many
    > > values, one value, or no values. A "type mismatch" error is raised if
    > > memberOf has one or no values in the collection. I use code similar to:
    > >
    > > colGroups = objCurrentUser.memberOf
    > > If IsEmpty(colGroups) Then
    > > strGroups = ""
    > > ElseIf TypeName(colGroups) = "String" Then
    > > strGroups = LCase(colGroups)
    > > Else
    > > strGroups = LCase(Join(colGroups))
    > > End If
    > >
    > > --
    > > Richard
    > > Microsoft MVP Scripting and ADSI
    > > HilltopLab web site - http://www.rlmueller.net
    > > --
    > >
    > >
    > >

  • Next message: Richard Mueller [MVP]: "Re: Script not working correctly for users w/out admin rights to t"

    Relevant Pages

    • Mapping to W2003 user rights/access?
      ... was required to have a lot of people with domain admin ... when it comes to access/user rights. ... Hopefully not domain admin... ... What access can be used for accounts used to do ...
      (microsoft.public.windows.server.migration)
    • Re: vb6 file locking
      ... Both my process are running under different accounts with admin ... try out if it can read when the second process has admin rights. ...
      (microsoft.public.vb.general.discussion)
    • Re: Unable to Push Adv Client to XP machines
      ... The account is listed as an admin on each of the client ... The accounts you are ... >specified have admin rights on your target machines. ...
      (microsoft.public.sms.admin)
    • Cant set local admin rights on domain
      ... using a local administrator account ... admin rights on the machine. ... Admin password and have them add their domain accounts to ...
      (microsoft.public.windowsxp.security_admin)
    • Re: Win2K AD account rights dont carry through on XP Pro
      ... if you log on to your XP machine as a local admin and enter this at ... except for passwords and accounts. ... > and I have local admin rights. ...
      (microsoft.public.windowsxp.security_admin)