A LDAP in VBScript's Clothing

Hello again,

It's been a while since my last post. Haven't been inspired much lately.

This post will be a short one, and hopefully the next one will be longer and will interest you more - I'm planning on doing a piece regarding DFS.

So, we had a situation today that required us to change a specific user attribute for all users in a specific group.

There are a couple of ways to deal with this situation. If this is a so-called "Mainstream" attribute, you can use the infamous dsmod cmd tool-  it allows you to change certain attributes, and if you combine it with dsquery and dsget it will come through for you. Sadly, not all cases are simple, forcing you to utilize an advanced set of solutions. 

First thing that comes to mind is Powershell. If you wish to use powershell you can do so using the DirectoryServices library. Another way, that's a little less complex is using the QAD (Quest Active Directory) add-on. 

There's also a handy tool called ADModify, enabling you to accomplish a vast variety of LDAP actions.

To my great disappointment, I had no Internet access and no machines with PS installed on them in the domain in question, so I did what any of you would do (I imagine) - wrote a VBScript. 

The common way to connect to your AD with VBScript is by creating an object that has a DN (Distinguished Name) string like so : 

dim objADUser

set objADUser = GetObject("LDAP://CN=username,OU=someou,DC=domain,DC=com")

In case you want to change a certain attribute of the user object, it is easily done in the following way :

objADUser.Put "AttributeName" = "NewValueForAttribute"

In my case, I neede to get all users from a certain group, which is done by writing :

dim objADGroup

set objADGroup = GetObject("LDAP://CN=groupname,OU=someou,DC=domain,DC=com")

objADGroup.GetInfo

(so far we've set up the group for exploration)

arrMembers = objADGroup.GetEx("member")

(this here, gets the group's membership and sets it into the arrMembers array)

After doing all this, we just need to combine it together into a simple script, like so :

dim objADUser

dim objADGroup

dim arrMembers

set objADGroup = GetObject("LDAP://CN=groupname,OU=someou,DC=domain,DC=com")

arrMembers = objADGroup.GetEx("member")

objADGroup.GetInfo

foreach strMember in arrMembers

dim objADUser

set objADUser = GetObject("LDAP://" & strMember)

objADUser.Put "AttributeName" = "NewValueForAttribute"

Next

I suppose this can be done in a more elegant and efficient way, but this few lines do the job well.

You're welcome to use them if you wish.

There are also other tools out there to modify AD objects, but seeing that making a script is so simple, there's no reason to use some third-party tools.

Hope you've learnt something from this post.

Until next time,

Dani .H

Technical Reference:

Great tutorials about VBScripting for AD - Users, Groups

QAD

DirectoryServices