Richard
Fri Mar 07 09:28:41 PST 2008
Harrison wrote:
> Due to some customization I added an attribute to my 2003 AD schema for
> all users in my domain. I need this attribute set to the same value for
> everyone. Does anyone know how I can set this attribute for all users?
It might be possible to do this with command line utilities. Otherwise, a
VBScript program can use ADO to retrieve the Distinguished Names of all
users. You would bind to each user object and assign the desired value to
your attribute, assuming it is a single-valued string attribute. For
example:
=============
Option Explicit
Dim adoCommand, adoConnection, strBase, strFilter, strAttributes
Dim objRootDSE, strDNSDomain, strQuery, adoRecordset, strDN
Dim strValue, objUser
' Value to be assigned to your attribute.
strValue = "New Value"
' Setup ADO objects.
Set adoCommand = CreateObject("ADODB.Command")
Set adoConnection = CreateObject("ADODB.Connection")
adoConnection.Provider = "ADsDSOObject"
adoConnection.Open "Active Directory Provider"
adoCommand.ActiveConnection = adoConnection
' Search entire Active Directory domain.
Set objRootDSE = GetObject("LDAP://RootDSE")
strDNSDomain = objRootDSE.Get("defaultNamingContext")
strBase = "<LDAP://" & strDNSDomain & ">"
' Filter on user objects.
strFilter = "(&(objectCategory=person)(objectClass=user))"
' Comma delimited list of attribute values to retrieve.
strAttributes = "distinguishedName"
' Construct the LDAP syntax query.
strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
adoCommand.CommandText = strQuery
adoCommand.Properties("Page Size") = 100
adoCommand.Properties("Timeout") = 30
adoCommand.Properties("Cache Results") = False
' Run the query.
Set adoRecordset = adoCommand.Execute
' Enumerate the resulting recordset.
Do Until adoRecordset.EOF
' Retrieve value.
strDN = adoRecordset.Fields("distinguishedName").Value
' Bind to the user object.
Set objUser = GetObject("LDAP://" & strDN)
' Assign value to your attribute, called "NewAttribute".
objUser.NewAttribute = strValue
' Save changes.
objUser.SetInfo
' Move to the next record in the recordset.
adoRecordset.MoveNext
Loop
' Clean up.
adoRecordset.Close
adoConnection.Close
===========
Remember, this will modify all users, including Administrator, Guest,
disabled users, etc. You could restrict the script to an OU by changing the
base of the query. For example, change:
strBase = "<LDAP://" & strDNSDomain & ">"
to something similar to:
strBase = "<LDAP://ou=Sales,ou=West," & strDNSDomain & ">"
to only modify users in the ou=Sales Organizational Unit (which is a child
of the ou=West OU). For more on using ADO in VBScript programs, see this
link:
http://www.rlmueller.net/ADOSearchTips.htm
--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab -
http://www.rlmueller.net
--