[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

80070005 error on vbscript to move Computers to new OU

Posted on 2011-03-21
5
Medium Priority
?
927 Views
Last Modified: 2012-05-11
I wanted to create a script that a standard user could run via the login script which will move the user's PC to their corresponding computers container in active directory.

The script is rough (as I am no vb expert), but works as an admin user. How can I make it work as a standard user. I get an access denied 80070005 error.  I tried playing with the impersonate command but with no joy. Any ideas ?

Option Explicit
Dim objSysInfo
DIM OU, OU1, OU2, COMPPATH, strADsPath, strADsPath1
DIM objNetwork
DIM objConnection
DIM objCommand
DIM WshShell
DIM WshNetwork
DIM colUserEnvVariables
DIM currentuser
DIM objNewOU
DIm objMoveComputer
DIm objRootDSE
DIM strDNSDomain
DIM test1
Dim strComputer
DIM objWMIService


'======If an error is encountered, keep going======
'On Error Resume Next


Set objSysInfo = CreateObject("ADSystemInfo")
Set WshNetwork = WScript.CreateObject("WScript.Network")
Set WshShell = CreateObject("Wscript.Shell")
Set CurrentUser = GetObject("LDAP://" & objSysInfo.UserName)

'Retrieve the collection of system variables
Set colUserEnvVariables = WshShell.Environment("System")


'------------------------------------------------------------------------------------
'-                  Get current OU of the user and comp
'------------------------------------------------------------------------------------
OU = objSysInfo.username
comppath= objSysInfo.computername

'------------------------------------------------------------------------------------
'-         Format the OU string for the query to provide location of new computers container
'------------------------------------------------------------------------------------
OU1= replace(ou, "USERS", "COMPUTERS")
OU2= instr (ou1, "OU=COMPUTERS")
strADsPath= mid (OU1,OU2)
strADsPath1= "OU=" & mid (OU1,OU2)
'------------------------------------------------------------------------------------
'-   TESTING
'------------------------------------------------------------------------------------
'msgbox ou
'msgbox ou1
msgbox ou2
msgbox comppath
msgbox strADsPath

'------------------------------------------------------------------------------------
'move PC to new OU
'------------------------------------------------------------------------------------

strComputer=WshNetwork.ComputerName
msgbox strComputer

CONST ForReading = 1
Const ForAppending = 8
 
Set objRootDSE = GetObject("LDAP://RootDSE")
strDNSDomain = objRootDSE.Get("defaultNamingContext")
Set objCommand = CreateObject("ADODB.Command")
Set objConnection = CreateObject("ADODB.Connection")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
objCommand.ActiveConnection = objConnection
Set objNewOU = GetObject("LDAP://" & strADsPath)
Set objMoveComputer = objNewOU.MoveHere ("LDAP://" & comppath, "CN=" & strComputer)

0
Comment
Question by:BlueDelta5
5 Comments
 
LVL 57

Expert Comment

by:McKnife
ID: 35184899
Hi.
Could you provide the goal behind this? Why should this be solved at the client side? What changed to make it necessary?
0
 
LVL 1

Author Comment

by:BlueDelta5
ID: 35184943
At the moment all PC's are in the standard computer  container. We have a user and computer container per dept. As machines are brought online and the user logs in for the first time, we want to move the PC to the right computer container.

The script works. I just need to know how to insert higher credentials so to allow the script to move an AD object,
0
 
LVL 57

Expert Comment

by:McKnife
ID: 35184989
0
 
LVL 21

Expert Comment

by:snusgubben
ID: 35185024
A domain user has only read access to the Computer object and OUs by default. If you want a domain user to be able to move objects, with a script, you'll need to grant them permissions. Not that I think that is a good idea.
0
 
LVL 65

Accepted Solution

by:
RobSampson earned 1000 total points
ID: 35186731
Hi, if you really want to put your username and password in the script, this will allow the current computer object to be moved to the target OU.

Regards,

Rob.
sADDomain = "yourdomain"
sADUser = "adminuser"
sADPassword = "adminpassword"

Const ADS_SECURE_AUTHENTICATION = 1
sDestOU = "LDAP://OU=targetOU,OU=sites,DC=domain,DC=com"
Set objRootDSE = GetObject("LDAP:")
Set objSysInfo = CreateObject("ADSystemInfo")
Set objDestOU = objRootDSE.OpenDSObject(sDestOU, sADDomain & "\" & sADUser, sADPassword, ADS_SECURE_AUTHENTICATION)
Set objComputer = objRootDSE.OpenDSObject("LDAP://" & objSysInfo.ComputerName, sADDomain & "\" & sADUser, sADPassword, ADS_SECURE_AUTHENTICATION)
On Error Resume Next
objDestOU.MoveHere "LDAP://" & objComputer.distinguishedName, vbNullString
If Err.Number = 0 Then
	MsgBox "Computer moved successfully."
Else
	MsgBox "Error " & Err.Number & ": " & Err.Description
	Err.Clear
End If

Open in new window

0

Featured Post

Vote for the Most Valuable Expert

It’s time to recognize experts that go above and beyond with helpful solutions and engagement on site. Choose from the top experts in the Hall of Fame or on the right rail of your favorite topic page. Look for the blue “Nominate” button on their profile to vote.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Active Directory can easily get cluttered with unused service, user and computer accounts. In this article, I will show you the way I like to implement ADCleanup..
Transferring FSMO roles is done when an admin wants to split roles between certain Domain Controllers or the Domain Controller holding the Roles has been forcefully demoted using dcpromo / forceremoval
This Micro Tutorial will teach you how to change your appearance and customize your Windows 7 interface to your unique preference. This will be demonstrated using Windows 7 operating system.
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …
Suggested Courses

873 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question