#70666 - 2002-10-07 10:18 PM
W2k Startup Scripts
|
avazquez49
Fresh Scripter
Registered: 2002-10-07
Posts: 6
Loc: Ohio
|
I am working on a way to tie Software installs that do not use MSI's to AD security groups.
I am trying to use kix during the startup sequence of the pc using Windows 2000 startup scripts feature vs the logon scripts.
I want to be able to assign a machine to a group in AD and from Kix be able to determine which group the machine is in. Now, the catch is when the script runs, there is no user logged into the machine. I tried the Ingroup function, but have had no success. Has anyone tried this? Any sugestions?
|
|
Top
|
|
|
|
#70667 - 2002-10-07 11:54 PM
Re: W2k Startup Scripts
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
How do you want to group the computers; by software, by department, by OU?
Are you placing the computer account into a Security group?
Have you looked into:
code:
$grp = GetObject("WinNT://ArcadiaBay/Administrators")
if grp.IsMember("WinNT://ArcadiaBay/jsmith ")
do something...
endif
|
|
Top
|
|
|
|
|
#70668 - 2002-10-08 03:31 PM
Re: W2k Startup Scripts
|
avazquez49
Fresh Scripter
Registered: 2002-10-07
Posts: 6
Loc: Ohio
|
I am placing the omputer accounts into Security groups. I havn't tried that. I will test.
|
|
Top
|
|
|
|
|
#70669 - 2002-10-08 03:33 PM
Re: W2k Startup Scripts
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
Remember computer accounts end with a "$", but I am not sure if ADSI needs it.
[ 08. October 2002, 15:34: Message edited by: Howard Bullock ]
|
|
Top
|
|
|
|
#70670 - 2002-10-08 06:37 PM
Re: W2k Startup Scripts
|
avazquez49
Fresh Scripter
Registered: 2002-10-07
Posts: 6
Loc: Ohio
|
I am having issues with this. I have never messes with ADSI before. Do you know, in KIX, if it is possible to obtain the computer's group membership information? The manual for KIX states that the Ingroup function is for determining user group membership information.
|
|
Top
|
|
|
|
|
#70672 - 2002-10-08 07:39 PM
Re: W2k Startup Scripts
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
This script uses the WinNT:// provider to determine if a computer account is a member of a Global security group on a W2K domain.
Change the $DomainNAme variable to suit your environment.
code:
$DomainName = "SomeDomain"
$computer = "Computer1"
$account = "WinNT://$DomainName/" + $computer + "$$"
$Group = GetObject("WinNT://$DomainName/TestGroup,Group")
$Members = $Group.Members
for each $member in $Members
? "Member: " + $member.name
next
if $Group.IsMember($account)
? "$account: Is member"
else
? "Is NOT a Member"
endif
[ 08. October 2002, 19:41: Message edited by: Howard Bullock ]
|
|
Top
|
|
|
|
#70673 - 2002-10-08 10:30 PM
Re: W2k Startup Scripts
|
avazquez49
Fresh Scripter
Registered: 2002-10-07
Posts: 6
Loc: Ohio
|
The code worked great! How would I manipulate the code to check group member of a group?
ex.
group1
group2
group3
group2 and group3 are members of group1
a script is assigned to group1.
how do I check if the script will work on a machine in group2 or group3?
By the Way, Thanks Howard Bullock.
|
|
Top
|
|
|
|
|
#70675 - 2002-10-09 01:49 AM
Re: W2k Startup Scripts
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
The domain I tested this on is a W2K in "Mixed" mode. I placed two global groups into a domain local group then adjusted the code a little to be more generic.
code:
$DomainName = "SomeDomain"
$ItemToFind = "group2"
$GroupToSearch = "localGrp1"
$account = "WinNT://$DomainName/" + $ItemToFind
? "ASDI object: " + $account
?
$oGroup = GetObject("WinNT://$DomainName/" + $GroupToSearch + ",Group")
? "Members of group " + $GroupToSearch
? "-----------------------------------"
$Members = $oGroup.Members
for each $member in $Members
? $member.name + " " + $member.class
next
?
if $oGroup.IsMember($account)
? "" + $ItemToFind + ": Is a member"
else
? "" + $ItemToFind + ": Is NOT a Member"
endif
?
[ 09. October 2002, 01:49: Message edited by: Howard Bullock ]
|
|
Top
|
|
|
|
|
#70677 - 2002-10-09 04:47 AM
Re: W2k Startup Scripts
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
I used WinNT:// to keep the example rather simple. No need for distinquished names etc. If you start using LDAP, then you should use TranslateName() UDF to return the DN since groups can be located anywhere in the OU hierarchy. By using TranslateName() you can simply supply the netbios domain name and the group name.
|
|
Top
|
|
|
|
|
#70678 - 2002-10-10 01:30 PM
Re: W2k Startup Scripts
|
avazquez49
Fresh Scripter
Registered: 2002-10-07
Posts: 6
Loc: Ohio
|
I have tried doing a recursive lookup on the group but can't seem to get it to work. I am working on a native win2k network and dealing with Global groups only. Here is the code I am trying:
code:
$DomainName = "Dirtdevil"
$computer = "@WKSTA"
$account = "WinNT://$DomainName/" + $computer + "$$"
$Group = "MScI - OS Service Pack"
$SP= "2600.xpsp1"
$aGroup = GetObject("WinNT://$DomainName/$Group")
$Members = $aGroup.Members
for each $member in $Members
? "Member: " + $member.name
next
if $aGroup.IsMember($account)
? "Is a Member"
if not ($os_service_pack>=$sp)
shell $XPSPScript
endif
endif
endif
I know I am doing this wrong. I am trying to learn as I go right now. I also found this note on the MSDN Site:
"The IADsGroup interface has an IADsGroup::IsMember method. This method returns TRUE if the specified object is a direct member of the group, that is, the group's member property contains the specified object.
Note A group can contain other groups (nesting). The IADsGroup::IsMember method does not recursively check the member properties of groups in its member property, groups within those groups, and so on. To recursively check if an object is a member of a group, you must enumerate the groups in the member property, check the members of those groups to see if the object is a member, and if those groups contain other groups, check their members, and so on."
How do I do this?
|
|
Top
|
|
|
|
|
#70680 - 2002-10-10 01:48 PM
Re: W2k Startup Scripts
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
If you examine my previous post, you will see that I added $member.class to the output. IF the class equals "group" then you will need to call your Function (UDF) again passing it the $account and new group name.
So far you only have a script. To use recursion you will have to define a function. See Function...Endfunction.
[ 10. October 2002, 13:48: Message edited by: Howard Bullock ]
|
|
Top
|
|
|
|
Moderator: Glenn Barnas, NTDOC, Arend_, Jochen, Radimus, Allen, ShaneEP, Ruud van Velsen, Mart
|
1 registered
(Allen)
and 1607 anonymous users online.
|
|
|
