[Last Call] Learn how to a build a cloud-first strategyRegister Now


Active Directory Script - Set Directory focus to a specific DC to make the changes on.

Posted on 2004-11-16
Medium Priority
Last Modified: 2012-06-27
Hello - This is my first time on Experts Exchange.
I use the following script to disable and move my AD IIS accounts to a specific OU.  I'd like to add a line in my script which sets my Directory focus to a specific DC to make the chages on.  I've copied in the script for info.

@echo off

REM ### IIS Account Cleanup Batch File
REM ###
REM ### This script takes a computername as input and:
REM ###    a) Disables the associated IWAM and IUSR accounts in the domain
REM ###    b) Moves the associated IWAM and IUSR accounts to a separate OU.
REM ###


@Echo Disabling user IWAM_%1
dsquery user -samid IWAM_%1|dsmod user -disabled yes

@Echo Disabling user IUSR_%1
dsquery user -samid IUSR_%1|dsmod user -disabled yes

@Echo Moving user IWAM_%1
dsquery user -samid IWAM_%1|dsmove -newparent "OU=IIS Service Accounts,OU=Domain Management,DC=Child,DC=ForestRoot,Dc=net"

@Echo Moving User IUSR_%1
dsquery user -samid IUSR_%1|dsmove -newparent "OU=IIS Service Accounts,OU=Domain Management,DC=Child,DC=ForestRoot,Dc=net"

Goto :EOF

@Echo ERROR: This batch file must be passed the computername for which to disable the IIS accounts.
@Echo Correct Usage: LockIISUser [ComputerName]
Goto :EOF
Question by:AMS1780
  • 3
  • 2
LVL 11

Expert Comment

ID: 12597924
use "-s" parameter of dsquery

Author Comment

ID: 12603220
Thanks WeHe,

I've tried running

dsquery server -s server1

Is this the correct syntax.  All this does is list all the servers in my domain.  Could you give any advice on what the syntax should be ?

Thanks in advance.
LVL 11

Expert Comment

ID: 12603532
syntax is right.
the result is ok too. "dsquery server" is supposed to list all servers in AD.
with the "-s server1" it queries this list from AD at server1.

Author Comment

ID: 12605096

Thats not what I'm looking for.  I'm trying to ge the script to hit a specific AD server so that I can make the changes.  For example I'd like to hit the PDC emulator everytime I run the script. (regardless of which DC it's run from)

LVL 11

Accepted Solution

WeHe earned 750 total points
ID: 12605150
that's what you get with "-s".
it will do the changes/queries on the server given with "-s".
of corse you have to use the "-s" parameter for your piped commands too. (dsmod/dsmove)

Featured Post

Vote for the Most Valuable Expert

It’s time to recognize experts that go above and beyond with helpful solutions and engagement on site. Choose from the top experts in the Hall of Fame or on the right rail of your favorite topic page. Look for the blue “Nominate” button on their profile to vote.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Numerous times I have been asked this questions that what is it that makes my machine log on so slow, there have been cases where computers took 23 minute exactly after taking password and getting to the desktop. Interesting thing was the fact th…
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Loops Section Overview
Whether it be Exchange Server Crash Issues, Dirty Shutdown Errors or Failed to mount error, Stellar Phoenix Mailbox Exchange Recovery has always got your back. With the help of its easy to understand user interface and 3 simple steps recovery proced…

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question