The following code is used to check and set the LOGON script batch file for
all the accounts in User Manager. You can use the substr lines to
exclude certain accounts.
Example: New users have been added by the Helpdesk and or an Analyst
and they did not set the users account to use the LOGON.BAT file.
This script will check and change that for all Domain Accounts.

The lines for logging can be moved around or removed depending
on what kind of logging you may want or not want.

The code below will exclude all accounts starting with the following:
$ # SMS

If you want to add more exclusions you should probably implement a SELECT statement.

NOTE This code requires:
Run from a Windows 2000 system or NT 4.0 with ADSI installed and
KiXtart 2001 4.01 (Copyright Ruud van Velsen 2001)
KiXtart 32 bits v2001 Release 4.01 (build 64) KiX2001_401.zip (491 kB Zip file)
http://kixtart.org/bin/KiX2001_401.zip

code:

---

$target = @domain
$target = getobject("WinNT://$target")
$loginscript = "LOGON.BAT"
if @error <> 0 
	exit(1)
endif
for each $user in $target
	if $user.class = "USER"
		if $user.loginscript <> "$loginscript" AND substr($user.name,1,1) <> "$$" AND substr($user.name,1,1) <> "#" AND substr($user.name,1,3) <> "SMS"
			shell '%comspec% /c echo "' + $user.name + ' ' + $user.loginscript + '" >>c:\temp\beforelogons.txt'
			$user.put("loginscript",$loginscript)
			$user.setinfo
				if $user.loginscript <> "$loginscript"
			shell '%comspec% /c echo "' + $user.name + ' ' + $user.loginscript + '" >>c:\temp\afterlogons.txt'				
		endif
	endif
next

---

Thanks again Bryce... Now I can keep some of my rougue analysts in line

[ 21 December 2001: Message edited by: NTDOC ]

Looking over the code, I'm counting one less ENDIF than IFs. It seems the deepest nested IF is missing an ENDIF. Can you verify the code to see if anything else is missing?

This ADSI script runs through in about 1 minute. Oh, and try to scroll through 7,000+ accounts and pick out the ones you don't want to change. I think you will agree that this script is 100% faster and easier. This code can also probably be modified to change most other User Manager settings as well.

Yes, I did leave out an ENDIF I put in another line for logging. Then decided I did not really need it.

This should work ok.

code:

---

$target = @domain
$target = getobject("WinNT://$target")
$loginscript = "LOGON.BAT"
if @error <> 0 
	exit(1)
endif
for each $user in $target
	if $user.class = "USER"
		if $user.loginscript <> "$loginscript" AND substr($user.name,1,1) <> "$$" AND substr($user.name,1,1) <> "#" AND substr($user.name,1,3) <> "SMS"
			shell '%comspec% /c echo "' + $user.name + ' ' + $user.loginscript + '" >>c:\temp\beforelogons.txt'
			$user.put("loginscript",$loginscript)
			$user.setinfo
				if $user.loginscript <> "$loginscript"
					shell '%comspec% /c echo "' + $user.name + ' ' + $user.loginscript + '" >>c:\temp\afterlogons.txt'
				endif
		endif
	endif
next

---

I wasn't suggesting for a second that this wasn't useful or preferential. I was just trying to draw an example between NT4 and Win2K AD. There are a lot of things that don't work the same in AD.

I'm not up to speed on AD and ADSI yet, but suspect this script would only work on an NT SAM. There are a lot more user properties in AD and it would be nice to be able to do group mods on them too.

I'm not pissed... Its too hard to pee with a wedgee

AD what is that Another Dead idea stolen from Novell ?

Hope you don't loose all your hair on all this stuff. I'm alreay bald from just thinking about AD and I have not really got past a couple meetings on it so far.