I have a script that I found on the internet that creates user accounts and shares etc... I am having a couple problems I am hoping to get help with. I have exausted my ability. Any help with any of the following would be great. They are listed in priority order. 1 being most important.
Thanks a million. or at least 500.
1. When permissions are set on the share, it is giving share permissions not NTFS permissions. My goal is to have everyone full on share permission and have local admin, domain admin, and the user on NTFS. I have read comments on using xacls but not sure how to inject into current script.
2. Set the flags for do not allow user to change password.
3. Set the flag for password never expires.
4. When the user account is created there is no , between last name and first name. In users and computers it is created as Doe John, i would like Doe, John.
'Option Explicit
Dim WshShell, fso
Set WSHShell = WScript.CreateObject("WScr
ipt.Shell"
)
Set fso = CreateObject("Scripting.Fi
leSystemOb
ject")
Set WshNetwork = WScript.CreateObject("WScr
ipt.Networ
k")
Set objIADs = GetObject("LDAP://RootDSE"
)
Set ADSystemInfo = WScript.CreateObject("ADSy
stemInfo")
Set shell = wscript.createobject("WScr
ipt.Shell"
)
Set environment = shell.environment("PROCESS
")
'logonserver = environment.Item("LOGONSER
VER")
logonserver = "MOBSDC1"
DomainDNSName = ADSystemInfo.DomainDNSName
DomainDN = objIADs.Get("defaultNaming
Context")
OUName = "Users"
'MsgBox logonserver
Set dom = GetObject("LDAP://" & logonserver & "/" & DomainDN)
InputPrompt1 = "Domain = "&DomainDNSName&vbCrLf&"Co
ntainer = "&OUName&vbCrLf&vbCrLf&"En
ter First Initial and Last Name:"
InputPrompt2 = "Domain = "&DomainDNSName&vbCrLf&"Co
ntainer = "&OUName&vbCrLf&vbCrLf&"En
ter Users First Name:"
InputPrompt3 = "Domain = "&DomainDNSName&vbCrLf&"Co
ntainer = "&OUName&vbCrLf&vbCrLf&"En
ter Users Surname:"
InputPrompt4 = "Domain = "&DomainDNSName&vbCrLf&"Co
ntainer = "&OUName&vbCrLf&vbCrLf&"En
ter Users Job Title:"
InputPrompt5 = "Domain = "&DomainDNSName&vbCrLf&"Co
ntainer = "&OUName&vbCrLf&vbCrLf&"En
ter Users Password:"
UserName = InputBox(InputPrompt1, "UserInitials")
FirstName = InputBox(InputPrompt2, "FirstName")
Surname = InputBox(InputPrompt3, "Surname")
Department = InputBox(InputPrompt4, "Job Title")
DefaultPassword = InputBox(InputPrompt5)
Set usr = dom.Create("user", "CN=" & Surname & " " & FirstName & ",CN=" & OUName)
Set ProfileServer = fso.GetFolder("\\mobsdc1\p
rofiles$")
Set HomeServer = fso.GetFolder("\\mobsfil1\
users$")
'Create User
usr.put "samAccountName", LCase(UserName)
usr.put "userPrincipalName", UserName & "@" & DomainDNSName
usr.put "givenName", FirstName
usr.put "sn", Surname
usr.put "displayName", Surname & ", " & FirstName
'usr.put "initials", LCase(Mid(UserName,2,1))
usr.put "description", Department
usr.put "homeDirectory", "\\mobsfil1\" & LCase(UserName) & "$"
usr.put "homeDrive", "H:"
usr.put "profilePath", "\\mobsdc1\profiles$\" & LCase(UserName)
'Usr.put "logonScript", "SLogic"
usr.setinfo
usr.setpassword DefaultPassword
usr.accountdisabled = False
usr.setinfo
'Create Users Mailbox
Dim oIADSUser
Dim MStore
Set oIADSUser = GetObject("LDAP://" & logonserver & "/CN=" & Surname & " " & FirstName & ",CN=Users," & DomainDN)
MStore = "Mailbox Store (MOBSXCH1)"
oIADSUser.CreateMailbox ("LDAP://" & logonserver & "/CN=Mailbox Store (MOBSXCH1),CN=First Storage Group,CN=InformationStore,
CN=MOBSXCH
1,CN=Serve
rs,CN=MOBI
LE,CN=Admi
nistrative
Groups,CN=Mobile Register,CN=Microsoft Exchange,CN=Services,CN=Co
nfiguratio
n," & DomainDN)
oIADSUser.SetInfo
'Add member to groups
Const ADS_PROPERTY_APPEND = 3
Set objGroup = GetObject("LDAP://CN=Every
one,OU=Exc
hange Distribution Groups," & DomainDN)
objGroup.PutEx ADS_PROPERTY_APPEND, "member", Array("CN=" & Surname & " " & FirstName & ",cn=Users," & DomainDN)
objGroup.SetInfo
'Wscript.quit
'Create users home directory
If fso.FolderExists(HomeServe
r & "\" & UserName) = False Then
fso.CreateFolder(HomeServe
r & "\" & LCase(UserName))
'fso.CreateFolder(ProfileS
erver & "" & UserName & "interface")
End If
'Share user home directory
AdminServer = "MOBSFIL1"
ShareName = LCase(Username) & "$"
FolderName = "D:\users\" & UserName
'Set Services = GetObject("WINMGMTS:{imper
sonationLe
vel=impers
onate,(Sec
urity)}!\\
" & AdminServer & "ROOT\CIMV2")
Set Services = GetObject("winmgmts:{imper
sonationLe
vel=impers
onate}!\\"
& AdminServer & "\root\cimv2")
Set SecDescClass = Services.Get("Win32_Securi
tyDescript
or")
Set SecDesc = SecDescClass.SpawnInstance
_()
Set Share = Services.Get("Win32_Share"
)
Set InParam = Share.Methods_("Create").I
nParameter
s.SpawnIns
tance_()
InParam.Properties_.Item("
Access") = SecDesc
InParam.Properties_.Item("
Descriptio
n") = "Home Directory"
InParam.Properties_.Item("
Name") = ShareName
InParam.Properties_.Item("
Path") = FolderName
InParam.Properties_.Item("
Type") = 0
Share.ExecMethod_"Create",
InParam
ReplaceACL "\\mobsfil1\" & LCase(UserName) & "$","add(" & UserName & ":F)+add(domain admins:F)"
Set WshShell = Nothing
Set fso = Nothing
Set WshNetwork = Nothing
Set usr = Nothing
Set NewShare = Nothing
Set Services = Nothing
Set SecDescClass = Nothing
Set SecDesc = Nothing
Set Share = Nothing
Set InParam = Nothing
Set sec = Nothing
Set sd = Nothing
Set dacl = Nothing
Set ace = Nothing
Set oIADSUser = Nothing
Set objGroup = Nothing
MsgBox "The creation of user: " & FirstName & " " & Surname & VbCrLf &_
"has completed without error"
'Functions
'Set permissions on users home directory
Function ReplaceACL(foldernm, permspart)
foldernm = HomeServer & "\" & UserName
If fso.FolderExists(foldernm)
= False Then
MsgBox "Sorry this folder is not present on the server"
Else
ChangeACLS foldernm, permspart, "REPLACE", "FOLDER"
End If
End Function
'Edit ACLS of specified folder
Function ChangeAcls(FILE,PERMS,REDI
T,FFOLDER)
Const ADS_ACETYPE_ACCESS_ALLOWED
= 0
Const ADS_ACETYPE_ACCESS_DENIED = 1
Const ADS_ACEFLAG_INHERIT_ACE = 2
Const ADS_ACEFLAG_SUB_NEW = 9
Const ADS_PATH_FILESHARE = 2
Const ADS_SD_FORMAT_IID = 1
Set sec = Wscript.CreateObject("ADsS
ecurityUti
lity")
Set sd = sec.GetSecurityDescriptor(
"\\mobsfil
1\" & LCase(UserName) & "$", ADS_PATH_FILESHARE, ADS_SD_FORMAT_IID)
Set dacl = sd.DiscretionaryAcl
If UCase(REDIT)="REPLACE" Then
For Each existingAce In dacl
dacl.removeace existingace
Next
End If
'break up Perms into individual actions
cmdArray=split(perms,"+")
For x=0 to ubound(cmdarray)
tmpVar1=cmdarray(x)
If UCase(left(tmpVar1,3))="DE
L" Then
ACLAction="DEL"
Else
ACLAction="ADD"
End If
tmpcmdVar=left(tmpVar1,len
(tmpVar1)-
1)
tmpcmdVar=right(tmpcmdVar,
len(tmpcmd
Var)-4)
cmdparts=split(tmpcmdVar,"
:")
nameVar=cmdparts(0)
rightVar=cmdparts(1)
If ACLAction="ADD" Then
If UCase(FFOLDER)="FOLDER" Then
addace dacl, namevar, rightvar, ADS_ACETYPE_ACCESS_ALLOWED
, ADS_ACEFLAG_SUB_NEW
addace dacl, namevar, rightvar, ADS_ACETYPE_ACCESS_ALLOWED
, ADS_ACEFLAG_INHERIT_ACE
Else
addace dacl, namevar, rightvar, ADS_ACETYPE_ACCESS_ALLOWED
,0
End If
End If
Next
For Each ace in dacl
If instr(ucase(ace.trustee),"
NT AUTHORITY") then
newtrustee=right(ace.trust
ee, len(ace.trustee)-instr(ace
.trustee, ""))
ace.trustee=newtrustee
End If
Next
sd.DiscretionaryAcl = dacl
sec.SetSecurityDescriptor "\\mobsfil1\" & LCase(UserName) & "$", ADS_PATH_FILESHARE, SD, ADS_SD_FORMAT_IID
End Function
Function addace(dacl,trustee, maskvar, acetype, aceflags)
' add ace to the specified dacl
Const RIGHT_READ = &H80000000
Const RIGHT_EXECUTE = &H20000000
Const RIGHT_WRITE = &H40000000
Const RIGHT_DELETE = &H10000
Const RIGHT_FULL = &H10000000
Const RIGHT_CHANGE_PERMS = &H40000
Const RIGHT_TAKE_OWNERSHIP = &H80000
Set ace = CreateObject("AccessContro
lEntry")
ace.Trustee = trustee
Select Case UCase(MaskVar)
Case "F"
ace.AccessMask = RIGHT_FULL
Case "C"
ace.AccessMask = RIGHT_READ or RIGHT_WRITE or RIGHT_EXECUTE or RIGHT_DELETE
Case "R"
ace.AccessMask = RIGHT_READ or RIGHT_EXECUTE
End Select
ace.AceType = acetype
ace.AceFlags = aceflags
dacl.AddAce ace
End Function