Help updating VBS to disable AD domain admin users

[meckeard]

Hi all,

I've had the following script that disables AD users but my requirements have recently changed. I now need to disable any active accounts but only if they are in the 'Domain Admin' group.

My script is below. What can I add to my If statement to check the group the user is in?

Thanks!

CONST sInactiveUsersOU = "LDAP://ou=Disabled Accounts,DC=corp,DC=somebank,DC=com"

Set objOU = GetObject(sInactiveUsersOU)

objOU.Filter = Array("user")

For Each objUser In objOU
'-- If it's enabled, disable it
If objUser.AccountDisabled = FALSE Then
objUser.AccountDisabled = TRUE
objUser.Put "description", "##### Disabled by system " & Now
objUser.SetInfo
End If
Next

set objOU = Nothing
Set objUserr = Nothing

 

[markdmac]

I think you are going about this a bad way. Just bind to the Admin group and enumerate through its members. Why check every user that logs in?

Be very careful that when coding this you don't accidentally remove the Administrator account from Domain Admins or you will not be able to manage your domain.

To be honest, since you are only talking about a single group, I would just open that group up in ADUC and manually look at the memberships.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[meckeard]

markdmac,

How can I bind to that particular user group?

TIA.

 

[markdmac]

Bind to a group and display the members:

On Error Resume Next
 
Set objGroup = GetObject _
  ("LDAP://cn=Scientists,ou=R&D,dc=NA,dc=fabrikam,dc=com")
objGroup.GetInfo
 
arrMemberOf = objGroup.GetEx("member")
 
WScript.Echo "Members:"
For Each strMember in arrMemberOf
    WScript.echo strMember
Next

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.