Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 903
  • Last Modified:

VBScript: How do I assign a group to another group in Win2K?

L.S.,

I'm working on an automated procedure to implement a security model on a server, like doing user to group assignments, user creation, file system rights, things like that.

There's one thing I can't get done: assigning groups to other groups. I keep getting error 'A new member could not be added to a local group because the member has the wrong account type.'

Here's the code I use:

Sub doAddGroupsToGroup(strDomain, strParentGroup, strNestedGroup)
      Dim objDomain
      Dim objParentGroup
      Dim objNestedGroup
      Set objDomain = GetObject("WinNT://" & strDomain)
      Set objParentGroup = GetObject("WinNT://" & strDomain & "/" & strParentGroup & ",group")
      Set objNestedGroup = GetObject("WinNT://" & strDomain & "/" & strNestedGroup & ",group")
            
      doLog 4, "Adding group '" & objNestedGroup.Name & "' to group '" & objParentGroup.Name & "'..."
      objParentGroup.Add(objNestedGroup.AdsPath)
      
      ' most-common error trapping            
      If (Hex(Err.Number) = 80070562) Then ' user already resides in that group
            doLog 4, "Group '" & objNestedGroup.Name & "' already resides in group '" & objParentGroup.Name & "'."
      Else
            doLog 0, "Group '" & objNestedGroup.Name & "' was added to group '" & objParentGroup.Name & "' successfully."
      End If
              
      Set objGroup = Nothing
      Set objDomain = Nothing
End Sub

Notes:
- the doLog subroutine is a routine that basically does nothing but echo to the console log and log the same thing to a log file.
- I know the error handling is NOT what it should be right now, I'll get to that later...

Thanks for any help! Regards,
Steven Dijkman.
0
stevendijkman
Asked:
stevendijkman
1 Solution
 
mpantanaCommented:
In my experience, you can not add a global group to another global group.  You can only add global groups to local groups.  Standard practice is that when you have files on a disk that you want to give access to a global group, you should create a local version of that group first and then add the global group to the local.  Then assign the rights to the local group.
0
 
Julian_CCommented:
Yes, to confirm the above from mpantana, you should just try this using the MMC snapin (or usrmgr on NT). I don't think it's possible to nest global groups like this so I don't recko the manual method will work either.

Cheers
Julian
0

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now