Windowmaker's blog

Executing a set of commands against all DCs in the forest

Funny how things turn out. I was visiting today a customer which is undergoing a process of upgrading his Domain Controllers to W2K3 R2 and I was asked to help them get a report of OS version on all the DCs in the forest (multi-domain forest). First I thought to query the AD directly, but it appears that there is no way to distinguish between W2K3 and W2K3 R2 when looking at operatingSystem, operatingSystemVersion and operatingSystemServicePack attributes of the DC's computer account. Now what...

Bulk add user accounts from a file to security group using batch

If you have a file containing the names of users (sAMAccountName) and you want to add all of them to a specific group in AD, here is a batch script that might make your life easier: :: GrpFromFile.CMD - Guy Teverovsky - January 2007 :: :: Add users from a file to specific group @echo off setlocal ENABLEDELAYEDEXPANSION setlocal ENABLEEXTENSIONS if "%1" == "" goto :SYNTAX if "%1" == "/?" goto :SYNTAX echo/ :: Define initial environment set groupname=%1 set filename=%2 set scriptname=GrpFromFile :...

Copying AD user group membership with dsquery and dsmod

A question was asked at Daniel Petri's forums about copying AD user's group membership using dsquery/dsmod tools. Having some spare time I have written a batch script that does just that - looks at memberOf attribute of source user account and joins the target account to those groups. Important: if the source account is a member in a group that resides in another forest or the group is of Domain Local type, the fact is not reflected in the memberOf attribute and membership in those group will not...