I need to make changes to AD fairly often--once to a development environment and then again in production. These AD changes are typically creating new global security groups in specific OUs and then adding existing global security groups to these groups. The group names are very long and I need to drill down pretty deep into the OU tree. I'd rather not have to do it twice (i.e. once in Dev and once in Prod), so I was thinking that a script would make things easier. The group names will contain several spaces, so the script needs to be able to handle that. Any one change is typically limited to one OU. All groups are contained in the one domain.
I'm running in Windows 2003 AD in native mode.
I'm thinking of a solution with the following characteristics:
Script calls some command and then uses a .txt file for all the parameters.
A parameter which I can use to specify the OU path.
A parameter which I can use to specify the domain name.
Can be assumed that the groups are always global security groups, so don't need way to change that.
A list of global security groups to add.
A list of existing global security groups to add to the newly created global groups.
"dsadd group" seems like it can do what I want, but I don't see a way to make it read a file for the parameters that I need. I guess having a bat file with multiple dsadd group commands would work. But I don't see how to designate the OU in which to create the new group.