Active Directory Script - Set Directory focus to a specific DC to make the changes on.

Posted on 2004-11-16
Last Modified: 2012-06-27
Hello - This is my first time on Experts Exchange.
I use the following script to disable and move my AD IIS accounts to a specific OU.  I'd like to add a line in my script which sets my Directory focus to a specific DC to make the chages on.  I've copied in the script for info.

@echo off

REM ### IIS Account Cleanup Batch File
REM ###
REM ### This script takes a computername as input and:
REM ###    a) Disables the associated IWAM and IUSR accounts in the domain
REM ###    b) Moves the associated IWAM and IUSR accounts to a separate OU.
REM ###


@Echo Disabling user IWAM_%1
dsquery user -samid IWAM_%1|dsmod user -disabled yes

@Echo Disabling user IUSR_%1
dsquery user -samid IUSR_%1|dsmod user -disabled yes

@Echo Moving user IWAM_%1
dsquery user -samid IWAM_%1|dsmove -newparent "OU=IIS Service Accounts,OU=Domain Management,DC=Child,DC=ForestRoot,Dc=net"

@Echo Moving User IUSR_%1
dsquery user -samid IUSR_%1|dsmove -newparent "OU=IIS Service Accounts,OU=Domain Management,DC=Child,DC=ForestRoot,Dc=net"

Goto :EOF

@Echo ERROR: This batch file must be passed the computername for which to disable the IIS accounts.
@Echo Correct Usage: LockIISUser [ComputerName]
Goto :EOF
Question by:AMS1780
    LVL 11

    Expert Comment

    use "-s" parameter of dsquery

    Author Comment

    Thanks WeHe,

    I've tried running

    dsquery server -s server1

    Is this the correct syntax.  All this does is list all the servers in my domain.  Could you give any advice on what the syntax should be ?

    Thanks in advance.
    LVL 11

    Expert Comment

    syntax is right.
    the result is ok too. "dsquery server" is supposed to list all servers in AD.
    with the "-s server1" it queries this list from AD at server1.

    Author Comment


    Thats not what I'm looking for.  I'm trying to ge the script to hit a specific AD server so that I can make the changes.  For example I'd like to hit the PDC emulator everytime I run the script. (regardless of which DC it's run from)

    LVL 11

    Accepted Solution

    that's what you get with "-s".
    it will do the changes/queries on the server given with "-s".
    of corse you have to use the "-s" parameter for your piped commands too. (dsmod/dsmove)

    Featured Post

    Highfive + Dolby Voice = No More Audio Complaints!

    Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

    Join & Write a Comment

    So you have two Windows Servers and you have a directory/folder/files on one that you'd like to mirror to the other?  You don't really want to deal with DFS or a 3rd party solution like Doubletake. You can use Robocopy from the Windows Server 200…
    I've always wanted to allow a user to have a printer no matter where they login. The steps below will show you how to achieve just that. In this Article I'll show how to deploy printers automatically with group policy and then using security fil…
    Need more eyes on your posted question? Go ahead and follow the quick steps in this video to learn how to Request Attention to your question. *Log into your Experts Exchange account *Find the question you want to Request Attention for *Go to the e…
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now