fail to set permissions to folder for a new user just created

[P01nt3r]

I can't be able to set permission by script for a user just created.

'----------- sample script-----------------
net user testuser
md c:\testdir
cacls c:\testdir /e /t /G testuser:F
'------------------------------------------

the 3rd command on this script fail!! It is like that the user just created isn't ready yet for the cacls command.

I have this problem from the time I moved the PDC in a server different from those where the script run and where the directory must be created.

There are any time that I must be wait from when the user is created? How could be the solution?

I have also try to write the script using the ADSI but it seems the same problem.

Please help

 

[fgrasso]

You have domain with one or more PDC ?
If yes you have to wait the domain replication (default 5 mins).
If you have 1 PDC the new user must work immediatly

 

[P01nt3r]

I have only 1 PDC and from those I know there must be only a PDC for domain. Is not it?

 

[fgrasso]

In NT domain you can have only 1 PDC.
In your domain have BDC ? If yes the SAM replication is for default 5 min.
You tried to put a pause (f.e. 10 seconds) in your script.

 

[P01nt3r]

Yes I have more than a BDC, but doesn't queries done on PDC anyway? Why if I open the User Manager the user just exists?

I have not try to set a sleep but I have separated the user creation with the creation of 2 virtual dirs on IIS that take me more than a minute! Isn't a minute enought?

 

[fgrasso]

The user SAM is read/write on PDC and only read on BDC.
When you create a new user you always create it on the PDC then by five minutes is replicated on BDC.
When a command that require authentication is issued, due the load balancing, the answer may come from the PDC or a BDC (if the BDC is not updated the authentication fails)

 

[P01nt3r]

Ok I think this is the problem... the machine where I must set the permissions is a BDC. To Let the script wait for 5 minutes every time is a bad solution, so... does exist a way where I can query directly the PDC instead of the BDC? A thing like to edit the regedit or something like this.

Thank you

 

[fgrasso]

I remember to have see a command line utility in the nt4 resource kit, check it