domain user account locked out

I have three OU's and all users under this OU, how do I setup script to unlock user account.


help....

Generate a list (a simple text file, one user name per line) with all user names in this OU and pass the name of the file as second parameter (after /L) to the script:
The easiest way to obtain this list (unless you have a documentation of your users someplace that can be exported into a text format) is if you have a global or local security group that matches these users. Is that the case?

can you be more simple, i am confused inthis script or canu send me sample script file.

thanks a bunch
mak

All you need is a simple list (just a text file) with the user names of the accounts that you want to unlock; let's call it userlist.txt for example.
Then let's say you want the accounts of JohnDoe, JaneDoe and JohnSmith unlocked. Create a text file like this (without the cutting lines, of course):
====8<----[userlist.txt]----
johndoe
janedoe
johnsmith
====8<----[userlist.txt]----
Save this for example in C:\Tools.
Save the script (again without the cutting lines ...) from above into C:\Tools as well, for example as unlock.cmd. Replace the "%ComputerName%" in the 4th line with the name of your DC. You can do this basically on any machine that's a member of your domain, you don't need to run it on the domain controller itself. The machine only needs the file cusrmgr.exe from the W2k Resource Kit somewhere in the path (or in C:\Tools as well).
Open a command prompt and change into C:\Tools. Enter
unlock.cmd /L userlist.txt
If you used the exact script from above, you can use the sample text file to test (the cusrmgr.exe command is "ECHO"ed out); it should display something like
Processing johndoe ...
cusrmgr.exe -u johndoe -m \\DCName +s AccountLockout
and so on.
To "arm" the script, you need to edit it again and remove the "ECHO" in front of the "cusrmgr.exe" command.
To test it for real with a single user, for example johndoe, you can enter (in a command prompt again)
unlock.cmd johndoe
This should unlock johndoe's account.
If the tests work out fine, you can use the text file with your users to process a whole bunch at once.
Resource Kit provided again, you can easily gain a list of all your domain user with the global.exe tool.
Change into your C:\Tools directory, and enter
global.exe "Domain Users" YourDomainName >domainusers.txt
(I forgot to specify the "DomainName" in the example in my first comment.)
This command will create the file domainusers.txt in the C:\Tools directory. You can open it in notepad and remove the accounts that don't need to be unlocked, then use this file with the script.

Do I have to type at command line,

unlock.cmd /L userlist.txt

what is unlock.cmd? is it on resource CD? or yourscript and save as unlock.cmd?

That wold be following in my unlock.cmd

@echo off
setlocal
:: *** name of the domain controller:
set DC=%testserver%

if %1.==. goto leave
if /i not %1.==/L. goto process
if %2.==. goto leave
set UserFile=%2
set UserFile=%UserFile:"=%
if not exist "%UserFile%" goto leave
:: *** Process a list of users:
for /f "delims=" %%a in ('type "%UserFile%"') do call :process %%a
goto leave

:process
set User=%1
echo Processing %User% ...
:: *** test mode: remove the "ECHO" in front of the following line to "arm" the script:
ECHO cusrmgr.exe -u %User% -m \\%DC% +s AccountLockout

:leave

unlock.cmd is simply the script I posted. Copy the content between the cutting lines it to the clipboard, paste it into notepad, then save it in C:\Tools (or wherever it suit you) as unlock.cmd.

obda,

Do I need to add

script:
ECHO cusrmgr.exe -u %User% -m \\%DC% +s AccountLockout

help

You need to copy everything between the cutting lines. The first line you need is the "@echo off", the last line is ":leave". Once you have those in notepad, replace %ComputerName% with the name of your DC. Once you have successfully tested that the script handles your file with the users, edit it again and remove the "ECHO" in front of "ECHO cusrmgr.exe -u %User% -m \\%DC% +s AccountLockout"; that is the command that actually unlocks the account.

====8<----[unlock.cmd]----
@echo off
setlocal
:: *** name of the domain controller:
set DC=%ComputerName%

if %1.==. goto leave
if /i not %1.==/L. goto process
if %2.==. goto leave
set UserFile=%2
set UserFile=%UserFile:"=%
if not exist "%UserFile%" goto leave
:: *** Process a list of users:
for /f "delims=" %%a in ('type "%UserFile%"') do call :process %%a
goto leave

:process
set User=%1
echo Processing %User% ...
:: *** test mode: remove the "ECHO" in front of the following line to "arm" the script:
ECHO cusrmgr.exe -u %User% -m \\%DC% +s AccountLockout

:leave
====8<----[unlock.cmd]----

here is one problem, for getting users list.

i am using following command,

global "Domain Users" >aozusers.txt

under aozusers.txt file no users but,


Displays members of global groups on remote servers or domains.

GLOBAL group_name domain_name | \\server

  group_name      The name of the global group to list the members of.
  domain_name      The name of a network domain.
  \\server      The name of a network server.

Examples:
  Global "Domain Users" EastCoast
  Displays the members of the group 'Domain Users' in the EastCoast domain.

  Global PrintUsers \\BLACKCAT
  Displays the members of the group PrintUsers on server BLACKCAT.

Notes:
  Names that include space characters must be enclosed in double quotes.
  To list members of local groups use Local.Exe.
  To get the Server name for a give Domain use GetDC.Exe.


what to do?

help!!!!

You need to specify your domain name after the "Domain Users":

global "Domain Users" YourDomainName >aozusers.txt