If not in one group, add to another - KiXtart.org

You are not logged in. [Log In] KiXtart.org website » Forums » KiXtart » Basic Scripting » If not in one group, add to another

Page 1 of 1

Topic Options

#130505 - 2004-12-02 09:43 PM

If not in one group, add to another

tjcarst Offline

Hey THIS is FUN

Registered: 2003-09-08
Posts: 243
Loc: USA

I found this code on the site, but receive an error:

ERROR : Error in expression: this type of array not supported in expressions.!
Script: X:\nomail.KIX
Line : 6

Code:


BREAK ON
$ou = GetObject("LDAP://ou=Users,dc=domain.dc=local")
Dim $Filter[0]
$Filter[0] = "user" 
$ou.Filter = $Filter
for each $account in $ou 
   $name = $account.name
   ? "name = $name" 
   $groups = $account.groups

   for each $group in $groups 
      $groupname = $group.name
      ?"groupname = $groupname"
      if $groupname = "Internet Mail Access"
         ?"Internet Mail Access is enabled"
       exit 0
       else
      GroupAdd($account,"Internet Mail Denied", $account)
         ?"No Internet Mail"
      endif 
   next
next

tjcarst

Top

#130506 - 2004-12-02 11:10 PM

Re: If not in one group, add to another

Chris S. Offline

MM club member

Registered: 2002-03-18
Posts: 2368
Loc: Earth

I notice that your GetObject line has a "." in it. It should be a comma. You should do some error checking after the GetObject command to verify that you where able to properly get the object for the OU.

Code:


BREAK ON

$ou = GetObject("LDAP://ou=Users,dc=domain,dc=local")
If @ERROR @SERROR ? EndIf
Dim $Filter[0]
$Filter[0] = "user" 
$ou.Filter = $Filter
for each $account in $ou 
   $name = $account.name
   ? "name = $name" 
   $groups = $account.groups
   
   for each $group in $groups 
      $groupname = $group.name
      ?"groupname = $groupname"
      if $groupname = "Internet Mail Access"
         ?"Internet Mail Access is enabled"
         exit 0
      else
         GroupAdd($account,"Internet Mail Denied", $account)
         ?"No Internet Mail"
      endif 
   next
next

Top

#130507 - 2004-12-03 04:03 AM Re: If not in one group, add to another
tjcarst tjcarst Hey THIS is FUN Registered: 2003-09-08 Posts: 243 Loc: USA	Thanks for that catch! I'll give it a try at work tomorrow and see if it was that simple. tjcarst
Top

#130508 - 2004-12-03 08:14 PM Re: If not in one group, add to another
tjcarst tjcarst Hey THIS is FUN Registered: 2003-09-08 Posts: 243 Loc: USA	Same error
Top

#130509 - 2004-12-03 08:20 PM Re: If not in one group, add to another
maciep maciep Korg Regular Registered: 2002-06-14 Posts: 947 Loc: Pittsburgh	Are you sure it's an OU and not just a Container. Try Code: $ou = GetObject("LDAP://cn=Users,dc=domain,dc=local") Edited by maciep (2004-12-03 08:20 PM) _________________________ Eric
Top

#130510 - 2004-12-03 08:48 PM Re: If not in one group, add to another
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	I tested the code after changing the period to a comma with all KiX versions back to 4.02 and it works provided I modify the LDAP path to suit my AD. What version of KiX you running? Never mind... I am sure maciep nailed it in that it is not an OU. Edited by Les (2004-12-03 08:52 PM) _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#130511 - 2004-12-03 09:14 PM Re: If not in one group, add to another
tjcarst tjcarst Hey THIS is FUN Registered: 2003-09-08 Posts: 243 Loc: USA	Yes, maciep is correct. I forgot that the default container Users is a container, even though it looks like an OU. Thanks. I kicked it off and it chugged along for a bit, never adding any users, but did generate this: Code: ERROR : unexpected command! Script: X:\nomail.KIX Line : 0
Top

#130512 - 2004-12-03 10:10 PM Re: If not in one group, add to another
Chris S. Chris S. MM club member Registered: 2002-03-18 Posts: 2368 Loc: Earth	Did you post the entire script? AFAIK, GroupAdd() is not a built-in KiX function.
Top

#130513 - 2004-12-03 10:45 PM

Re: If not in one group, add to another

tjcarst Offline

Hey THIS is FUN

Registered: 2003-09-08
Posts: 243
Loc: USA

It is a function that I found here on the message boards

Code:


BREAK ON
$ou = GetObject("LDAP://cn=Users,dc=domain,dc=local")
Dim $Filter[0]
$Filter[0] = "user" 
$ou.Filter = $Filter
for each $account in $ou 
   $name = $account.name
   ? "name = $name" 
   $groups = $account.groups

   for each $group in $groups 
      $groupname = $group.name
      ?"groupname = $groupname"
      if $groupname = "Internet Mail Access"
         ?"Internet Mail Access is enabled"
       exit 0
       else
      GroupAdd($account,"Internet Mail Denied", $account)
         ?"No Internet Mail"
      endif 
   next
next 


;function GroupAdd($Target, $Group, $ObjToAdd)
;NAME        GroupAdd
;
;ACTION      Add's a object (user or group) to a group (global or local)
;
;SYNTAX      GroupAdd(Target, Group, Object to add)
;
;PARAMETERS  Target
;               The Domain name or Workstation to work with.  For faster workstation 
;               execution, include the Domain Name that the workstation is a meber of.
;
;               "Kixtart/beanbag" would be working with the workstation Beanbag in the 
;               Kixtart domain
;
;            Group
;               The Group you want to add to
;
;            Object to add
;               This can be a local group or a userid, depending on what type of group 
;               the Group variable is.  Always try to give the full name of the object.
;
;
;RETURNS     @error code
;
;REMARKS     ADSI com object must be installed.
;
;EXAMPLES    ;this adds the domain user "testuser" to the global group "Domain Admins"
;            $nul = groupadd("kixtart","Domain admins","testuser")
;
;            ;this adds the user "testuser" in the domain "kixtart" to the local administrators 
;            ;group on the workstation beanbag
;            $nul = Groupadd("kixtart/beanbag", "administrators", "kixtart\testuser")
	DIM $target, $group, $OBJToAdd
	DIM $obj, $objhome
	if substr($target,1,2) = "\\"
		$target = substr($target,3,len($target))
	endif
	If instr($objtoadd,"\") <> 0 
		$objtoadd	= split($objtoadd,"\")
		if ubound($objtoadd) <> 1 exit(13) endif
		$objhome 	= $objtoadd[0]
		$obj		= $objtoadd[1]
	ELSE
		$objhome 	= $target
		$obj		= $objtoadd
	endif
	$group = GetObject("WinNT://$target/$group")
	if vartype($group) = 9 and @error = 0
		$group.Add ("WinNT://$objhome/$obj")
	else
		$GroupAdd = @error
		exit(@error)
	endif
	$GroupAdd = @error
	exit(@error)
endfunction

Top

#130514 - 2004-12-03 10:53 PM Re: If not in one group, add to another
ShaneEP ShaneEP MM club member Registered: 2002-11-29 Posts: 2127 Loc: Tulsa, OK	I think your loop logic needs a lil work. If I understand your code correctly (entirely possible that i dont)... Code: for each $group in $groups $groupname = $group.name ?"groupname = $groupname" if $groupname = "Internet Mail Access" ?"Internet Mail Access is enabled" exit 0 else GroupAdd($account,"Internet Mail Denied", $account) ?"No Internet Mail" endif next Would this not loop through and add the user to the Internet Mail Denied group every time it sees a group that is not equal to Internet Mail Access? So if the user is a member of say 10 groups...it is going to add the user to Internet Mail Denied 10 times?
Top

#130515 - 2004-12-03 11:05 PM

Re: If not in one group, add to another

ShaneEP Offline

MM club member

Registered: 2002-11-29
Posts: 2127
Loc: Tulsa, OK

I also just noticed that the "function GroupAdd($Target, $Group, $ObjToAdd)" line was REM'd out in your posted code too, which could cause some issues. I would try something like the below code, if you're able to use atleast the 4.22 version of Kix, which I believe is when AScan was introduced.

Code:


BREAK ON
$ou = GetObject("LDAP://cn=Users,dc=domain,dc=local")
Dim $Filter[0]
$Filter[0] = "user" 
$ou.Filter = $Filter
for each $account in $ou 
   $name = $account.name
   ? "name = $name" 
   $groups = $account.groups
   If AScan ($groups, "Internet Mail Access") < 0
      GroupAdd($account,"Internet Mail Denied", $account)
   Endif
next 

function GroupAdd($Target, $Group, $ObjToAdd)
;NAME GroupAdd
;
;ACTION Add's a object (user or group) to a group (global or local)
;
;SYNTAX GroupAdd(Target, Group, Object to add)
;
;PARAMETERS Target
; The Domain name or Workstation to work with. For faster workstation 
; execution, include the Domain Name that the workstation is a meber of.
;
; "Kixtart/beanbag" would be working with the workstation Beanbag in the 
; Kixtart domain
;
; Group
; The Group you want to add to
;
; Object to add
; This can be a local group or a userid, depending on what type of group 
; the Group variable is. Always try to give the full name of the object.
;
;
;RETURNS @error code
;
;REMARKS ADSI com object must be installed.
;
;EXAMPLES ;this adds the domain user "testuser" to the global group "Domain Admins"
; $nul = groupadd("kixtart","Domain admins","testuser")
;
; ;this adds the user "testuser" in the domain "kixtart" to the local administrators 
; ;group on the workstation beanbag
; $nul = Groupadd("kixtart/beanbag", "administrators", "kixtart\testuser")
   DIM $target, $group, $OBJToAdd
   DIM $obj, $objhome
   if substr($target,1,2) = "\\"
      $target = substr($target,3,len($target))
   endif
   If instr($objtoadd,"\") <> 0 
      $objtoadd = split($objtoadd,"\")
      if ubound($objtoadd) <> 1
         exit(13)
      endif
      $objhome = $objtoadd[0]
      $obj = $objtoadd[1]
   ELSE
      $objhome = $target
      $obj = $objtoadd
   endif
   $group = GetObject("WinNT://$target/$group")
   if vartype($group) = 9 and @error = 0
      $group.Add ("WinNT://$objhome/$obj")
   else
      $GroupAdd = @error
      exit(@error)
   endif
   $GroupAdd = @error
   exit(@error)
endfunction

Top

#130516 - 2004-12-03 11:05 PM Re: If not in one group, add to another
tjcarst tjcarst Hey THIS is FUN Registered: 2003-09-08 Posts: 243 Loc: USA	What I want to do is look at the properties of the user and determine if they are in Internet Mail Access group. If they are not, I want it to add them to Internet Mail Denied group. tjcarst
Top

#130517 - 2004-12-03 11:07 PM Re: If not in one group, add to another
tjcarst tjcarst Hey THIS is FUN Registered: 2003-09-08 Posts: 243 Loc: USA	Thanks, CitrixMan. I'll modify and give it a try. I am running 4.22. tjcarst
Top

#130518 - 2004-12-03 11:12 PM Re: If not in one group, add to another
tjcarst tjcarst Hey THIS is FUN Registered: 2003-09-08 Posts: 243 Loc: USA	Using your code, I now receive the following error: Code: ERROR : IDispatch pointers not allowed in expressions! Script: X:\nomail.KIX Line : 54
Top

#130519 - 2004-12-03 11:15 PM Re: If not in one group, add to another
Bryce Bryce KiX Supporter Registered: 2000-02-29 Posts: 3167 Loc: Houston TX	I see the problem. GroupAdd() uses the WinNT naming convention, and can not handle a ADSI object passed to it. you need to pass the name of an object, one that you can use in the WinNT:\\ naming convention. Also i am a little confused on what you are trying to add to what group? I am guessing that you are wanting to add users to the "Internet Mail Denied" group if they are not a member of the "Internet Mail Access is enabled" group, is this correct? i think the syntax for groupadd() you are wanting is... (untested) groupadd(@domain,"Internet Mail Denied",split($account,"CN=")[1])
Top

#130520 - 2004-12-03 11:24 PM Re: If not in one group, add to another
NTDOC NTDOC Administrator Registered: 2000-07-28 Posts: 11634 Loc: Space	Bryce, I think some accounts might end up with an extra \ in them (a few do on my accounts). But anyways. You could also run code to extract all the current members of the mail group and one from all users and then run a for each to add those not in mail to the no access group.
Top

#130521 - 2004-12-08 09:04 PM Re: If not in one group, add to another
tjcarst tjcarst Hey THIS is FUN Registered: 2003-09-08 Posts: 243 Loc: USA	Bryce - yes, that is what I am wanting to do. Exchange 2003 recommends that you restrict internet access based on a deny rather than an allow. With 5.5, I denied all internet email with an exception allowing Internet Mail group users. With 2003, it is recommended that I create a group that allows all with the exception of denying to a group, Internet Mail Denied. I have it working by using the 5.5 method, but was trying to implement the recommended method. I have 1,000+ users and less than half have internet mail. I didn't want to click through each user in AD Users & Computers and if they weren't in Internet Mail, add them to Internet Mail Denied. Although, with my scripting skills, I could have done it manually three times over before getting my script to work. Thanks for everyone's input. I'm away from work but will give this a run tomorrow with recommended changes. tjcarst
Top

#130522 - 2004-12-10 03:31 AM Re: If not in one group, add to another
tjcarst tjcarst Hey THIS is FUN Registered: 2003-09-08 Posts: 243 Loc: USA	Sorry everyone, I didn't get around to this today. Too many other fires to put out. I'll try to make it a priority to try on Dec 10. I do appreciate everyone's assitance and don't want you to think I'm ignoring your efforts. tjcarst
Top

Page 1 of 1

Previous Topic View All Topics

Index Next Topic

Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart

Hop to:

Shout Box

Search the board with:
superb Board Search
or try with google:

	Web kixtart.org