You are not logged in. [Log In] KiXtart.org website » Forums » KiXtart » Basic Scripting » If not in one group, add to another
Register User       Forum List       Calendar       FAQ
Page 1 of 1 1
Topic Options
#130505 - 2004-12-02 09:43 PM If not in one group, add to another
tjcarst Offline
Hey THIS is FUN

Registered: 2003-09-08
Posts: 243
Loc: USA
I found this code on the site, but receive an error:

ERROR : Error in expression: this type of array not supported in expressions.!
Script: X:\nomail.KIX
Line : 6

Code:

BREAK ON
$ou = GetObject("LDAP://ou=Users,dc=domain.dc=local")
Dim $Filter[0]
$Filter[0] = "user" 
$ou.Filter = $Filter
for each $account in $ou 
   $name = $account.name
   ? "name = $name" 
   $groups = $account.groups

   for each $group in $groups 
      $groupname = $group.name
      ?"groupname = $groupname"
      if $groupname = "Internet Mail Access"
         ?"Internet Mail Access is enabled"
       exit 0
       else
      GroupAdd($account,"Internet Mail Denied", $account)
         ?"No Internet Mail"
      endif 
   next
next


tjcarst
Top
#130506 - 2004-12-02 11:10 PM Re: If not in one group, add to another
Chris S. Offline
MM club member
*****

Registered: 2002-03-18
Posts: 2368
Loc: Earth
I notice that your GetObject line has a "." in it. It should be a comma. You should do some error checking after the GetObject command to verify that you where able to properly get the object for the OU.

Code:

BREAK ON

$ou = GetObject("LDAP://ou=Users,dc=domain,dc=local")
If @ERROR @SERROR ? EndIf
Dim $Filter[0]
$Filter[0] = "user" 
$ou.Filter = $Filter
for each $account in $ou 
   $name = $account.name
   ? "name = $name" 
   $groups = $account.groups
   
   for each $group in $groups 
      $groupname = $group.name
      ?"groupname = $groupname"
      if $groupname = "Internet Mail Access"
         ?"Internet Mail Access is enabled"
         exit 0
      else
         GroupAdd($account,"Internet Mail Denied", $account)
         ?"No Internet Mail"
      endif 
   next
next

Top
#130507 - 2004-12-03 04:03 AM Re: If not in one group, add to another
tjcarst Offline
Hey THIS is FUN

Registered: 2003-09-08
Posts: 243
Loc: USA
Thanks for that catch! I'll give it a try at work tomorrow and see if it was that simple.

tjcarst
Top
#130508 - 2004-12-03 08:14 PM Re: If not in one group, add to another
tjcarst Offline
Hey THIS is FUN

Registered: 2003-09-08
Posts: 243
Loc: USA
Same error
Top
#130509 - 2004-12-03 08:20 PM Re: If not in one group, add to another
maciep Offline
Korg Regular
*****

Registered: 2002-06-14
Posts: 947
Loc: Pittsburgh
Are you sure it's an OU and not just a Container. Try

Code:

$ou = GetObject("LDAP://cn=Users,dc=domain,dc=local")


Edited by maciep (2004-12-03 08:20 PM)
_________________________
Eric

Top
#130510 - 2004-12-03 08:48 PM Re: If not in one group, add to another
Les Offline
KiX Master
*****

Registered: 2001-06-11
Posts: 12734
Loc: fortfrances.on.ca
I tested the code after changing the period to a comma with all KiX versions back to 4.02 and it works provided I modify the LDAP path to suit my AD. What version of KiX you running?

Never mind... I am sure maciep nailed it in that it is not an OU.

Edited by Les (2004-12-03 08:52 PM)
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.

Top
#130511 - 2004-12-03 09:14 PM Re: If not in one group, add to another
tjcarst Offline
Hey THIS is FUN

Registered: 2003-09-08
Posts: 243
Loc: USA
Yes, maciep is correct. I forgot that the default container Users is a container, even though it looks like an OU. Thanks.

I kicked it off and it chugged along for a bit, never adding any users, but did generate this:

Code:

ERROR : unexpected command!
Script: X:\nomail.KIX
Line  : 0
Top
#130512 - 2004-12-03 10:10 PM Re: If not in one group, add to another
Chris S. Offline
MM club member
*****

Registered: 2002-03-18
Posts: 2368
Loc: Earth
Did you post the entire script? AFAIK, GroupAdd() is not a built-in KiX function.
Top
#130513 - 2004-12-03 10:45 PM Re: If not in one group, add to another
tjcarst Offline
Hey THIS is FUN

Registered: 2003-09-08
Posts: 243
Loc: USA
It is a function that I found here on the message boards

Code:

BREAK ON
$ou = GetObject("LDAP://cn=Users,dc=domain,dc=local")
Dim $Filter[0]
$Filter[0] = "user" 
$ou.Filter = $Filter
for each $account in $ou 
   $name = $account.name
   ? "name = $name" 
   $groups = $account.groups

   for each $group in $groups 
      $groupname = $group.name
      ?"groupname = $groupname"
      if $groupname = "Internet Mail Access"
         ?"Internet Mail Access is enabled"
       exit 0
       else
      GroupAdd($account,"Internet Mail Denied", $account)
         ?"No Internet Mail"
      endif 
   next
next 


;function GroupAdd($Target, $Group, $ObjToAdd)
;NAME        GroupAdd
;
;ACTION      Add's a object (user or group) to a group (global or local)
;
;SYNTAX      GroupAdd(Target, Group, Object to add)
;
;PARAMETERS  Target
;               The Domain name or Workstation to work with.  For faster workstation 
;               execution, include the Domain Name that the workstation is a meber of.
;
;               "Kixtart/beanbag" would be working with the workstation Beanbag in the 
;               Kixtart domain
;
;            Group
;               The Group you want to add to
;
;            Object to add
;               This can be a local group or a userid, depending on what type of group 
;               the Group variable is.  Always try to give the full name of the object.
;
;
;RETURNS     @error code
;
;REMARKS     ADSI com object must be installed.
;
;EXAMPLES    ;this adds the domain user "testuser" to the global group "Domain Admins"
;            $nul = groupadd("kixtart","Domain admins","testuser")
;
;            ;this adds the user "testuser" in the domain "kixtart" to the local administrators 
;            ;group on the workstation beanbag
;            $nul = Groupadd("kixtart/beanbag", "administrators", "kixtart\testuser")
	DIM $target, $group, $OBJToAdd
	DIM $obj, $objhome
	if substr($target,1,2) = "\\"
		$target = substr($target,3,len($target))
	endif
	If instr($objtoadd,"\") <> 0 
		$objtoadd	= split($objtoadd,"\")
		if ubound($objtoadd) <> 1 exit(13) endif
		$objhome 	= $objtoadd[0]
		$obj		= $objtoadd[1]
	ELSE
		$objhome 	= $target
		$obj		= $objtoadd
	endif
	$group = GetObject("WinNT://$target/$group")
	if vartype($group) = 9 and @error = 0
		$group.Add ("WinNT://$objhome/$obj")
	else
		$GroupAdd = @error
		exit(@error)
	endif
	$GroupAdd = @error
	exit(@error)
endfunction
Top
#130514 - 2004-12-03 10:53 PM Re: If not in one group, add to another
ShaneEP Moderator Offline
MM club member
*****

Registered: 2002-11-29
Posts: 2127
Loc: Tulsa, OK
I think your loop logic needs a lil work. If I understand your code correctly (entirely possible that i dont)...

Code:

for each $group in $groups 
  $groupname = $group.name
  ?"groupname = $groupname"
  if $groupname = "Internet Mail Access"
    ?"Internet Mail Access is enabled"
    exit 0
  else
    GroupAdd($account,"Internet Mail Denied", $account)
    ?"No Internet Mail"
  endif 
next


Would this not loop through and add the user to the Internet Mail Denied group every time it sees a group that is not equal to Internet Mail Access? So if the user is a member of say 10 groups...it is going to add the user to Internet Mail Denied 10 times?
Top
#130515 - 2004-12-03 11:05 PM Re: If not in one group, add to another
ShaneEP Moderator Offline
MM club member
*****

Registered: 2002-11-29
Posts: 2127
Loc: Tulsa, OK
I also just noticed that the "function GroupAdd($Target, $Group, $ObjToAdd)" line was REM'd out in your posted code too, which could cause some issues. I would try something like the below code, if you're able to use atleast the 4.22 version of Kix, which I believe is when AScan was introduced.

Code:

BREAK ON
$ou = GetObject("LDAP://cn=Users,dc=domain,dc=local")
Dim $Filter[0]
$Filter[0] = "user" 
$ou.Filter = $Filter
for each $account in $ou 
   $name = $account.name
   ? "name = $name" 
   $groups = $account.groups
   If AScan ($groups, "Internet Mail Access") < 0
      GroupAdd($account,"Internet Mail Denied", $account)
   Endif
next 

function GroupAdd($Target, $Group, $ObjToAdd)
;NAME GroupAdd
;
;ACTION Add's a object (user or group) to a group (global or local)
;
;SYNTAX GroupAdd(Target, Group, Object to add)
;
;PARAMETERS Target
; The Domain name or Workstation to work with. For faster workstation 
; execution, include the Domain Name that the workstation is a meber of.
;
; "Kixtart/beanbag" would be working with the workstation Beanbag in the 
; Kixtart domain
;
; Group
; The Group you want to add to
;
; Object to add
; This can be a local group or a userid, depending on what type of group 
; the Group variable is. Always try to give the full name of the object.
;
;
;RETURNS @error code
;
;REMARKS ADSI com object must be installed.
;
;EXAMPLES ;this adds the domain user "testuser" to the global group "Domain Admins"
; $nul = groupadd("kixtart","Domain admins","testuser")
;
; ;this adds the user "testuser" in the domain "kixtart" to the local administrators 
; ;group on the workstation beanbag
; $nul = Groupadd("kixtart/beanbag", "administrators", "kixtart\testuser")
   DIM $target, $group, $OBJToAdd
   DIM $obj, $objhome
   if substr($target,1,2) = "\\"
      $target = substr($target,3,len($target))
   endif
   If instr($objtoadd,"\") <> 0 
      $objtoadd = split($objtoadd,"\")
      if ubound($objtoadd) <> 1
         exit(13)
      endif
      $objhome = $objtoadd[0]
      $obj = $objtoadd[1]
   ELSE
      $objhome = $target
      $obj = $objtoadd
   endif
   $group = GetObject("WinNT://$target/$group")
   if vartype($group) = 9 and @error = 0
      $group.Add ("WinNT://$objhome/$obj")
   else
      $GroupAdd = @error
      exit(@error)
   endif
   $GroupAdd = @error
   exit(@error)
endfunction
Top
#130516 - 2004-12-03 11:05 PM Re: If not in one group, add to another
tjcarst Offline
Hey THIS is FUN

Registered: 2003-09-08
Posts: 243
Loc: USA
What I want to do is look at the properties of the user and determine if they are in Internet Mail Access group. If they are not, I want it to add them to Internet Mail Denied group.

tjcarst
Top
#130517 - 2004-12-03 11:07 PM Re: If not in one group, add to another
tjcarst Offline
Hey THIS is FUN

Registered: 2003-09-08
Posts: 243
Loc: USA
Thanks, CitrixMan. I'll modify and give it a try. I am running 4.22.

tjcarst
Top
#130518 - 2004-12-03 11:12 PM Re: If not in one group, add to another
tjcarst Offline
Hey THIS is FUN

Registered: 2003-09-08
Posts: 243
Loc: USA
Using your code, I now receive the following error:

Code:

ERROR : IDispatch pointers not allowed in expressions!
Script: X:\nomail.KIX
Line  : 54
Top
#130519 - 2004-12-03 11:15 PM Re: If not in one group, add to another
Bryce Offline
KiX Supporter
*****

Registered: 2000-02-29
Posts: 3167
Loc: Houston TX
I see the problem.

GroupAdd() uses the WinNT naming convention, and can not handle a ADSI object passed to it. you need to pass the name of an object, one that you can use in the WinNT:\\ naming convention.

Also i am a little confused on what you are trying to add to what group? I am guessing that you are wanting to add users to the "Internet Mail Denied" group if they are not a member of the "Internet Mail Access is enabled" group, is this correct?

i think the syntax for groupadd() you are wanting is... (untested)

groupadd(@domain,"Internet Mail Denied",split($account,"CN=")[1])



Top
#130520 - 2004-12-03 11:24 PM Re: If not in one group, add to another
NTDOC Administrator Online content
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Bryce, I think some accounts might end up with an extra \ in them (a few do on my accounts). But anyways. You could also run code to extract all the current members of the mail group and one from all users and then run a for each to add those not in mail to the no access group.
Top
#130521 - 2004-12-08 09:04 PM Re: If not in one group, add to another
tjcarst Offline
Hey THIS is FUN

Registered: 2003-09-08
Posts: 243
Loc: USA
Bryce - yes, that is what I am wanting to do. Exchange 2003 recommends that you restrict internet access based on a deny rather than an allow.

With 5.5, I denied all internet email with an exception allowing Internet Mail group users. With 2003, it is recommended that I create a group that allows all with the exception of denying to a group, Internet Mail Denied. I have it working by using the 5.5 method, but was trying to implement the recommended method.

I have 1,000+ users and less than half have internet mail. I didn't want to click through each user in AD Users & Computers and if they weren't in Internet Mail, add them to Internet Mail Denied. Although, with my scripting skills, I could have done it manually three times over before getting my script to work.

Thanks for everyone's input. I'm away from work but will give this a run tomorrow with recommended changes.

tjcarst
Top
#130522 - 2004-12-10 03:31 AM Re: If not in one group, add to another
tjcarst Offline
Hey THIS is FUN

Registered: 2003-09-08
Posts: 243
Loc: USA
Sorry everyone, I didn't get around to this today. Too many other fires to put out. I'll try to make it a priority to try on Dec 10. I do appreciate everyone's assitance and don't want you to think I'm ignoring your efforts.

tjcarst
Top
Page 1 of 1 1


Moderator:  Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 1471 anonymous users online.
details
Newest Members
Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users
My Cookies · Mark all read Powered by UBB.threads™ Contact Us · KiXtart.org website · Top

Generated in 0.077 seconds in which 0.029 seconds were spent on a total of 12 queries. Zlib compression enabled.
Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org