We help IT Professionals succeed at work.

Remove Logon Workstations IN AD

dbguy2626
dbguy2626 asked
on
3,028 Views
Last Modified: 2011-11-11
Hello everyone, we have about 500 users with Logon Workstations Restrictions set in their user profile (I have a screen snap shot of exactly what I am talking about)  We are trying to script the removal of this field but have had NO luck.  Please help.  Here is the code we are trying to use.  Please help!!
Set objUser = GetObject _
 
  ("LDAP://cn=genuser1,ou=generic,ou=people,dc=enterprise,dc=domain,dc=org") (This path is subject to change depending on the user, this was a test user)
 
 
 
objUser.Put "userPrincipalName", "genuser1@enterprise.domain.org"
 
objUser.Put "sAMAccountName", "genuser1"
 
objUser.Put "userWorkstations","" (to set it for all left blank, also tried putting all in there, either comment may work)
 
objUser.SetInfo

Open in new window

AD.jpg
Comment
Watch Question

Try using a tool called Hyena:

http://www.systemtools.com/hyena/

you get a 30day fully functional copy (it's a very good tool and well worth the money).  This should allow you to select all your users, right click and set the properties for those users so that it clears the logon workstation.
You are trying to modify multi valued attribute so need to use putex instead of put.

Const ADS_PROPERTY_CLEAR=1
Set objUser = GetObject _
 
  ("LDAP://cn=genuser1,ou=generic,ou=people,dc=enterprise,dc=domain,dc=org") (This path is subject to change depending on the user, this was a test user)
 
 
 
objUser.Put "userPrincipalName", "genuser1@enterprise.domain.org"
 
objUser.Put "sAMAccountName", "genuser1"
 
objUser.PutEx ADS_PROPERTY_CLEAR, "userWorkstations","" 
 
objUser.SetInfo

Open in new window

This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Author

Commented:
thank you for your help..  you got me on the right track
Jeffrey Kane - TechSoEasyPrincipal Consultant
CERTIFIED EXPERT
Most Valuable Expert 2016
Top Expert 2014

Commented:
Happened upon this posting when trying to resolve this issue on a failed Essential Business Server migration.  For anyone who may need it, the following VBSScript will change all users in AD back to "All Computers" setting.

Put it on the desktop of your DC and double-click to run.  

I don't suggest that you use it in enviornments with more than 50 users or so because it will create a pop-up for every user changed.

Jeff
TechSoEasy
Set rootDSE = GetObject("LDAP://RootDSE")
    DomainContainer = rootDSE.Get("defaultNamingContext")
    Set conn = CreateObject("ADODB.Connection")
    conn.Provider = "ADSDSOObject"
    conn.Open "ADs Provider"
    ldapStr = "<LDAP://" & DomainContainer & ">;(&(objectCategory=person)(objectClass=user));adspath;subtree"
    Set rs = conn.Execute(ldapStr)
    While Not rs.EOF
 Set oUser = GetObject (rs.Fields(0).Value)
 if (len(oUser.userWorkstations) >= 1) then
  wscript.echo oUser.displayName & " ::: " & oUser.userWorkstations
  
  oUser.userWorkstations = vbnull
  oUser.PutEx 1, "userWorkstations", 0
  oUser.setinfo
  
 end if
      rs.MoveNext
  
    Wend
  wscript.echo "Finished"

Open in new window

Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.