Skyport is working hard to help customers recover from recent attacks, like the Petya worm. This work has brought to light some important lessons. New malware attacks like this can take down your entire environment. Learn from others mistakes on how to prevent Petya like worms.
Solved
Wscript - Check machine OU membership
Posted on 2004-09-22
We run a single login script in our W2K environment at the top level for users, this script performs various actions depending upon group memberships (map drives etc). I need to add a section to the script to perform the following actions:
Check if the user logging on is a member of the Test OU within user departments.
If so ensure the machine they are logging on to is a member of the Desktops\Test OU.
If the machine is from any other OU the users should be logged off.
Here's what I've tried, but it seems to log everyone off, no matter what. Help greatly appreciated. Variables are set further up the script for DIM settings, domain name etc.
'Don't allow Test users to log on to non test machines
Set sMachineOU = GetObject ("LDAP://cn="&sComputerNam
bFoundTestMachine = TRUE
If Err.Number = E_ADS_OBJECT_NOT_FOUND Then
bFoundTestMachine = FALSE
end if
Set oTestUser = GetObject ("LDAP://cn="&sUserName&",
bFoundTestUser = TRUE
If Err.Number = E_ADS_OBJECT_NOT_FOUND Then
bFoundTestUser = FALSE
end if
If bFoundTestUser = TRUE and bFoundTestMachine = FALSE Then
sRunner = oshell.run ("Nologon.exe",false)
WScript.Sleep 5000
sRunner = oshell.run ("logoff.exe /N /F", HIDE_WINDOW ,TRUE)
wscript.quit(1)
end if
Err.Clear
Check if the user logging on is a member of the Test OU within user departments.
If so ensure the machine they are logging on to is a member of the Desktops\Test OU.
If the machine is from any other OU the users should be logged off.
Here's what I've tried, but it seems to log everyone off, no matter what. Help greatly appreciated. Variables are set further up the script for DIM settings, domain name etc.
'Don't allow Test users to log on to non test machines
Set sMachineOU = GetObject ("LDAP://cn="&sComputerNam
bFoundTestMachine = TRUE
If Err.Number = E_ADS_OBJECT_NOT_FOUND Then
bFoundTestMachine = FALSE
end if
Set oTestUser = GetObject ("LDAP://cn="&sUserName&",
bFoundTestUser = TRUE
If Err.Number = E_ADS_OBJECT_NOT_FOUND Then
bFoundTestUser = FALSE
end if
If bFoundTestUser = TRUE and bFoundTestMachine = FALSE Then
sRunner = oshell.run ("Nologon.exe",false)
WScript.Sleep 5000
sRunner = oshell.run ("logoff.exe /N /F", HIDE_WINDOW ,TRUE)
wscript.quit(1)
end if
Err.Clear
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
-
3
-
3
6 Comments
PS. Nologon.exe is a self written .exe that displays a message explaining to the user what is happening, stored within netlogon share.
youre1m
Try this:
'Don't allow Test users to log on to non test machines
Set sMachineOU = GetObject ("LDAP://cn="&sComputerNam
bFoundTestMachine = TRUE
If Err.Number <> 0 bFoundTestMachine = FALSE
end if
Set oTestUser = GetObject ("LDAP://cn="&sUserName&",
bFoundTestUser = TRUE
If Err.Number <> 0 then bFoundTestUser = FALSE
end if
If bFoundTestUser = TRUE and bFoundTestMachine = FALSE Then
sRunner = oshell.run ("Nologon.exe",false)
WScript.Sleep 5000
sRunner = oshell.run ("logoff.exe /N /F", HIDE_WINDOW ,TRUE)
wscript.quit(1)
end if
Err.Clear
Cheers
JamesDS
Try this:
'Don't allow Test users to log on to non test machines
Set sMachineOU = GetObject ("LDAP://cn="&sComputerNam
bFoundTestMachine = TRUE
If Err.Number <> 0 bFoundTestMachine = FALSE
end if
Set oTestUser = GetObject ("LDAP://cn="&sUserName&",
bFoundTestUser = TRUE
If Err.Number <> 0 then bFoundTestUser = FALSE
end if
If bFoundTestUser = TRUE and bFoundTestMachine = FALSE Then
sRunner = oshell.run ("Nologon.exe",false)
WScript.Sleep 5000
sRunner = oshell.run ("logoff.exe /N /F", HIDE_WINDOW ,TRUE)
wscript.quit(1)
end if
Err.Clear
Cheers
JamesDS
James,
Sorry about the long delay, I've been working on something else for a while.
I have tried to use your script but get an error message stating a "then" was expected on the line I have put a * next to below. I have tried adding a then but still get the same error message. Any ideas??
Set sMachineOU = GetObject ("LDAP://cn="&sComputerNam
bFoundTestMachine = TRUE
If Err.Number <> 0 bFoundTestMachine = FALSE *
end if
Set oTestUser = GetObject ("LDAP://cn="&sUserName&",
bFoundTestUser = TRUE
If Err.Number <> 0 then bFoundTestUser = FALSE
end if
If bFoundTestUser = TRUE and bFoundTestMachine = FALSE Then
sRunner = oshell.run ("Nologon.exe",false)
WScript.Sleep 5000
sRunner = oshell.run ("logoff.exe /N /F", HIDE_WINDOW ,TRUE)
wscript.quit(1)
end if
Err.Clear
Sorry about the long delay, I've been working on something else for a while.
I have tried to use your script but get an error message stating a "then" was expected on the line I have put a * next to below. I have tried adding a then but still get the same error message. Any ideas??
Set sMachineOU = GetObject ("LDAP://cn="&sComputerNam
bFoundTestMachine = TRUE
If Err.Number <> 0 bFoundTestMachine = FALSE *
end if
Set oTestUser = GetObject ("LDAP://cn="&sUserName&",
bFoundTestUser = TRUE
If Err.Number <> 0 then bFoundTestUser = FALSE
end if
If bFoundTestUser = TRUE and bFoundTestMachine = FALSE Then
sRunner = oshell.run ("Nologon.exe",false)
WScript.Sleep 5000
sRunner = oshell.run ("logoff.exe /N /F", HIDE_WINDOW ,TRUE)
wscript.quit(1)
end if
Err.Clear
![[Webinar] Lessons on Recovering from Petya](https://filedb.experts-exchange.com/files/public/2017/7/11/dcb3272a-62a8-4274-a34e-d1771610ec3b.png)
youre1m
Oops, missing that "then" statement!
Try this
Set sMachineOU = GetObject ("LDAP://cn="&sComputerNam
bFoundTestMachine = TRUE
If Err.Number <> 0 then bFoundTestMachine = FALSE
end if
Set oTestUser = GetObject ("LDAP://cn="&sUserName&",
bFoundTestUser = TRUE
If Err.Number <> 0 then bFoundTestUser = FALSE
end if
If bFoundTestUser = TRUE and bFoundTestMachine = FALSE Then
sRunner = oshell.run ("Nologon.exe",false)
WScript.Sleep 5000
sRunner = oshell.run ("logoff.exe /N /F", HIDE_WINDOW ,TRUE)
wscript.quit(1)
end if
Err.Clear
Cheers
JamesDS
Oops, missing that "then" statement!
Try this
Set sMachineOU = GetObject ("LDAP://cn="&sComputerNam
bFoundTestMachine = TRUE
If Err.Number <> 0 then bFoundTestMachine = FALSE
end if
Set oTestUser = GetObject ("LDAP://cn="&sUserName&",
bFoundTestUser = TRUE
If Err.Number <> 0 then bFoundTestUser = FALSE
end if
If bFoundTestUser = TRUE and bFoundTestMachine = FALSE Then
sRunner = oshell.run ("Nologon.exe",false)
WScript.Sleep 5000
sRunner = oshell.run ("logoff.exe /N /F", HIDE_WINDOW ,TRUE)
wscript.quit(1)
end if
Err.Clear
Cheers
JamesDS
Ok, below is what I've found that works, but you can have the points for effort, couldn't get your solution to work.
'Determine whether user is a test User
bTestUser = FALSE
If strUserOU = "test" then
bTargetuser = TRUE
end if
'Determine Whether machine is in Target Training machine
bTargetMachine = FALSE
If strCompOU = "test machine" then
bTestMachine = TRUE
end if
If bTestuser = TRUE and bTestMachine = FALSE then
sRunner = oshell.run ("Nologon.exe",false)
WScript.Sleep 5000
sRunner = oshell.run ("logoff.exe /N /F", HIDE_WINDOW ,TRUE)
wscript.quit(1)
end if
'Determine whether user is a test User
bTestUser = FALSE
If strUserOU = "test" then
bTargetuser = TRUE
end if
'Determine Whether machine is in Target Training machine
bTargetMachine = FALSE
If strCompOU = "test machine" then
bTestMachine = TRUE
end if
If bTestuser = TRUE and bTestMachine = FALSE then
sRunner = oshell.run ("Nologon.exe",false)
WScript.Sleep 5000
sRunner = oshell.run ("logoff.exe /N /F", HIDE_WINDOW ,TRUE)
wscript.quit(1)
end if
Featured Post
Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.
One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Geo-targeting is the practice of distributing content based on a person’s location, as best as you can determine it. Let’s look at some ways you could successfully use this tactic. The following tips and case studies could lead to meaningful results.
This tutorial will teach you the special effect of super speed similar to the fictional character Wally West aka "The Flash"
After Shake : http://www.videocopilot.net/presets/after_shake/
All lightning effects with instructions : http://www.mediaf…
How to fix incompatible JVM issue while installing Eclipse
While installing Eclipse in windows, got one error like above and unable to proceed with the installation.
This video describes how to successfully install Eclipse.
How to solve incompa…
Suggested Courses
Course of the Month12 days, 6 hours left to enroll
650 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.