VBS Active Directory user attribute update problem

I made a script to modify our users Network access permissions under the Dial In tab in AD.
The scripts seem to be doing it´s job and the right radio button is selected when you view it in AD users and computers, BUT the users dont have access.
The property is not really updated although it looks that way.
If I reselct the allow access button, although it´s already selected, then the apply button becomes active and if I apply, it finally works.
But what is the reason that the vb script cant do it and is there any way around this?
As you can see in the script I tried some different ways to update the attribute, but none of them works.
Option Explicit
'Const ADS_PROPERTY_CLEAR = 1
'Const ADS_PROPERTY_UPDATE = 2
Dim strMember, strDNSDomain, strContainer
Dim objGroup, objUser, objRootDSE
Dim arrMemberOf

strContainer = "cn=tin-elev,OU=Grupper,ou=Tinderhøj-skole,"
Set objRootDSE = GetObject("LDAP://RootDSE")
strDNSDomain = objRootDSE.Get("DefaultNamingContext")

Set objGroup = GetObject("LDAP://"& strContainer & strDNSDomain)
objGroup.getInfo

arrMemberOf = objGroup.GetEx("member")

For Each strMember in arrMemberOf
Set objUser = GetObject("LDAP://" & strMember) 
'objUser.PutEx ADS_PROPERTY_CLEAR, "msNPAllowDialIn", 0
'objUser.SetInfo 
'objUser.PutEx ADS_PROPERTY_UPDATE, "msNPAllowDialIn", TRUE
'objUser.SetInfo 
objUser.Put "msNPAllowDialIn", True
objUser.SetInfo 
Next

Wscript.Quit

Open in new window

LVL 1
DucknaldiAsked:
Who is Participating?
 
Chris DentConnect With a Mentor PowerShell DeveloperCommented:

Ahh here we go, it even has KB articles, and it does need another attribute (a change to userParameters):

http://support.microsoft.com/?id=252398
http://support.microsoft.com/?id=257341

Is your domain Mixed mode? If so, in theory a change to Native should allow this to work. Of course, that kind of change depends on your Domain Controllers.

Chris
0
 
DucknaldiAuthor Commented:
By the way, even when I look in ADSI edit, the value is set as it should be, but it´s not working before I do it manually in ADUC anyway.
0
 
markpalinuxCommented:


take a look at the functions in this script:
http://www.wisesoft.co.uk/scripts/vbscript_write_msnpallowdialin_attribute.aspx

seems like msNPAllowDialIn is a single value (.Put)  rather then a multivalued (.PutEx)

Like you said things should work manually before the script.


Mark
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
Chris DentPowerShell DeveloperCommented:

Ignore that value and look for others it sets. It wouldn't be the first in the GUI that sets more than one in the background.

Chris
0
 
DucknaldiAuthor Commented:
Markpalinux.
As you see in my script I use put, but I have also tried putex, now "outcommented", they both give the same result, the radio button is set but to make it work I have to do it manually in ADUC.

Chris-Dent
Sounds like a good idea, what do you recommend for checking other changes made by the radio button?
I found the kb articles also, but my domain is running 2008 native mode, so I dont think that´s the reason.
0
 
RobSampsonCommented:
Hi guys, Chris, hopefully you can find this useful.....This post shows the properties associated with the Dial In, and how to *show* the information, but I have no idea just yet how to set this, or in which order.  I might be able to play around with it at some stage later this week, but for now, I don't have time:
http://www.experts-exchange.com/Programming/Languages/Visual_Basic/VB_Script/Q_23516965.html

Regards,

Rob.
0
 
DucknaldiAuthor Commented:
I found another link to somebody with the exact same problems.
He seemed to sort it out by making a c script, but I really dont have any knowledge about c scripting and wouldn´t know how to convert this to my own situation.
http://www.autoitscript.com/forum/topic/70526-ad-dialinprivilege-msnpallowdialin-attribute-problem-adsi-question/
0
 
DucknaldiAuthor Commented:
Rob, the examples use the same methods as I´ve been trying. Thx anyway;)
0
 
DucknaldiAuthor Commented:
Ok, solved it now.
The radio button sets a second parameter like Chris suggested.
By adding the second parameter it now works.

 
Option Explicit
Dim strMember, strDNSDomain, strContainer
Dim objGroup, objUser, objRootDSE
Dim arrMemberOf

strContainer = "cn=blabla,OU=Groups,ou=whatever,"
Set objRootDSE = GetObject("LDAP://RootDSE")
strDNSDomain = objRootDSE.Get("DefaultNamingContext")

Set objGroup = GetObject("LDAP://"& strContainer & strDNSDomain)
objGroup.getInfo

arrMemberOf = objGroup.GetEx("member")

For Each strMember in arrMemberOf
Set objUser = GetObject("LDAP://" & strMember) 
objUser.Put "msNPAllowDialIn", True
objUser.Put "userParameters", "m:                    d	                        "
objUser.SetInfo 
Next

Wscript.Quit

Open in new window


This line is what makes it work

 
objUser.Put "userParameters", "m:                    d	                        "

Open in new window

0
 
DucknaldiAuthor Commented:
The complete solution was not given, only hints in the right direction, but thanks anyway.
0
 
Chris DentPowerShell DeveloperCommented:

Apologies for the lack of feedback, I ended up being a bit busier than expected over the weekend.

Chris
0
 
DucknaldiAuthor Commented:
It´s ok, the important thing is that the problem was solved.
Thanks mate;)
0
 
RobSampsonCommented:
Wow, that's pretty cryptic:
objUser.Put "userParameters", "m:                    d                              "

But it seems userParameters is a binary value.  Perhaps it would be better to set up an account with the settings that you actually want for dial-in, then export that binary value from that test user.  Then, you should use those settings to set the binary value of userParameters with.  My feeling is that you don't really know what
objUser.Put "userParameters", "m:                    d                              "
 
is actually setting, and it may be overwriting (or not setting) some of the settings that you want.

Thanks for sharing!

Rob.
0
 
DucknaldiAuthor Commented:
Hi Rob, thank you for the suggestions.
I only need this one setting, it´s not really a dialin connection so I dont need other settings.
I use it for web authentication on a wlc and cisco secure access server and it works fine for everyone now, but you´re right, that´s an insane value.
I found the value by enabling in gui and checking with adsi edit, then copied the value from there in to the script and it worked.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.