Windows Server Hack [Electronic resources] نسخه متنی

Hack 26 Manage User Accounts in Active Directory

Use these five handy scripts to easily manage
domain user accounts.

While the usual way of managing user accounts in Active
Directory is to use the Active Directory Users and Computers (ADUC)
console, that GUI approach to managing accounts can be tedious if
your organization is large and you have many accounts to manage. This
hack provides examples of scripts you can use to simplify things and
speed up common administrative tasks, and I think
you'll find them quite useful. You can even use some
of them to delegate certain tasks to nonadministrators to save you
time and trouble.

To use one of these scripts, type it into Notepad (with Word Wrap
turned off) and save it with a .vbs extension.
Then, type cscript.exe
scriptname.vbs
from a command prompt, or create a shortcut to the script
and double-click on the shortcut to run the script.

Changing a User's Domain Password

This simple script allows you to
give others the ability to change end
users' passwords without having to install the
administration tools. The script prompts for the domain, username,
and new password, and notifies the user of whether the password
change was successful:

Dim UserName
Dim UserDomain
UserDomain = InputBox("Enter the user's domain:")
UserName = InputBox("Enter the user's login name:")
Set User = GetObject("WinNT://" & UserDomain & "/"& UserName &",user)
Dim NewPassword
NewPassword = InputBox("Enter new password")
Call User.SetPassword(NewPassword)
If err.number = 0 Then
Wscript.Echo "The password change was successful."
Else
Wscript.Echo "The password change failed!"
End if

Changing User Account Names in Active Directory

Using VBScript, changing a
user's account name in
the Active Directory is a quick process:

Set oDomain = GetObject("WINNT:\\domainname")
Set oUser = oDomain.GetObject("originalusername")
oDomain.MoveHere oUser.AdsPath, "newusername"

You just need to connect to the specific domain (as indicated in the
first line), set the original username (the second line), and then
change the username using the MoveHere method (the
third line). This is a much simpler process than opening up the MMC
and either navigating to the username or searching the Active
Directory for the account instances.

A script like this is extremely useful for occasions when names
change due to things like marriage, or when the user just
can't stand the name they were given for logging in.

Customize the script with the appropriate domain name
(domainname), the user's
old account name (originalusername), and
the user's new account name
(newusername).

Unlocking a Windows 2000 Domain Account

Need a quick and easy way to unlock a Windows 2000 domain account?
Use VBScript. The following script prompts for the username, then the
user's domain, and unlocks the specified account:

UserName = InputBox("Enter the user's login name that you want to unlock:")
DomainName = InputBox("Enter the domain name in which the user account exists:")
Set UserObj = GetObject("WinNT://"& DomainName &"/"& UserName &")
If UserObj.IsAccountLocked = -1 then UserObj.IsAccountLocked = 0
UserObj.SetInfo
If err.number = 0 Then
Wscript.Echo "The Account Unlock Failed. Check that the account is, " & _
"in fact, locked-out."
Else
Wscript.Echo "The Account Unlock was Successful"
End if

Disabling a Domain Account

Use this handy VBScript to quickly disable a user
account in the specified domain. This script prompts for the username
and domain and then disables the account you specify:

Dim Username
Dim UserDomain
UserDomain = InputBox("Enter the user's domain:")
UserName = InputBox("Enter the user's login name:")
Set UserObj = GetObject("WinNT://" & UserDomain & "/" & Username &)
UserObj.AccountDisabled = True
UserObj.SetInfo
Set UserObj = Nothing

Setting the Account to Not Expire

This handy script configures a
user account to not expire. The
script works by setting the expiration date attribute to a past date:

Set objUser = GetObject _
("LDAP://cn=yourcontainer,ou=yourOU,dc=yourDC,dc=com")
objUser.AccountExpirationDate = "01/01/1970"
objUser.SetInfo

To use the script, customize the second line as desired. For example,
if the user account for user Bob Smith resides in the
Sales OU in the mtit.com
domain, this line should be changed to:

("LDAP://cn=Bob Smith,ou=Sales,dc=mtit,dc=com")

Be judicious in deciding which accounts should be set to not expire,
as such accounts could pose a security risk. See [Hack #29] for a quick way to
search for such accounts on your network.

Rod Trent