0x80005000 error from login script

OregonSteve · Feb 13, 2004

Greetings-

W2k3 server; single forest; single domain; Two W2K3 DCs; WinXPpro workstations. Applying logon script through Group Policy. Using VBscript to create a login script for my organization. Right now we're testing it in IT and some (NOT ALL) users get an error SOMETIMES:

Script:
\\Domain.com\SysVol\Domain.com\Policies\etc., etc.
Line: 42
Char: 4
Error: 0x80005000
Code:80005000
Source: Null

Here is the section containing line 42 from the script; Line 42 is the "Set objUser" line; character four is the "S" in Set objUser.

'----THIS SECTION CREATES THE DICTIONARY OBJECTS ENUMERATING GROUP
MEMBERSHIP----
Function CreateMemberOfObject(strDomain, strUserName)
Dim objUser, objGroup

Set CreateMemberOfObject = CreateObject("Scripting.Dictionary&quot

CreateMemberOfObject.CompareMode = vbTextCompare
Set objUser = GetObject("WinNT://" _
& strDomain & "/" _
& strUserName & ",user&quot

For Each objGroup In objUser.Groups
CreateMemberOfObject.Add objGroup.Name, "-"
Next
Set objUser = Nothing

End Function

As I said, this is a sporadic error. Only some users are getting it and not every time they log in. I'm not a Scripter so I need some help.

Thanx
OregonSteve

porkchop411 · Feb 11, 2005

I'm currently working on a script that fails with the same error when attempting to enumerate groups. Only difference in my case is that I'm using the LDAP service provider instead of WinNT.

Just before I left for the day I found that the problem only occurs with users who belong to a specific OU. This could explain why you see sporadic results.

I suspect a security issue on the OU itself because about two weeks ago our logon script choked with the same error after IT Security changed permissions on the OU called "Built In." In that case, nobody but Domain Admin had read access, so the logon script would die on 0x80005000 for anyone with lesser privileges.

I didn't have time to look further into the security scenario today. I'll know more on Monday. Meanwhile, I would start trying to narrow it down to users in specific OUs. I'm curious to know how this turns out in your case.

porkchop411 · Feb 16, 2005

I found the needle in the haystack.

There is a global group that the failing users all belong to called "ZZZ Edge BU/Liasions DL". The ' / ' symbol in that group name requires an escape character in order for the LDAP query to work. When trying to bind to the group object, the script uses this command:

Set objGroup = GetObject("LDAP://CN=ZZZ Edge BU/Liasions DL,OU=Distribution Lists,OU=Exchange Support,OU=admin-support,DC=zzz,DC=com")

The above command (and ultimately the script) fails because the syntax of the LDAP command is incorrect. In order for the script to function properly, the LDAP query to that group name needs to look like this (note the extra backslash after "BU"):

Set objGroup = GetObject("LDAP://CN=ZZZ Edge BU\/Liasions DL,OU=Distribution Lists,OU=Exchange Support,OU=admin-support,DC=zzz,DC=com")

So, instead of using LDAP to bind to the human-friendly group name, I modified the script to determine each group's security identifier (SID) and bind to that instead. You don't need to worry about escape characters using this method and that's why it works.

Hope this info saves somebody lots of debugging hours.

Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

0x80005000 error from login script

OregonSteve

MIS

porkchop411

Programmer

porkchop411

Programmer

Similar threads

Part and Inventory Search

Sponsor