Windows Logon Script - Group Membership

Guy recommends:
VBScript Training Video on CD

Windows Logon Script - Group Membership

Here are two VBScripts which will show you how to map a network drive based on group membership.  These are advanced scripts drawing upon multiple VBScript methods and because there are so many elements involved, I recommend that you build-up the script gradually.  In particular, check the names of your groups and the values for the UNC paths referenced in the scripts.

Topics for Group Membership

• Mission to Map a network drive based on Group Membership
• Stage one - Script to test Group Membership
• Stage two - Actually map the network drive
• Summary Group Membership

Mission to Map a network drive based on Group Membership.

Scripting for groups is one of my bugbears.  With most LDAP attributes there is only a single value, for example givenName = Guy.  However, because one group object can have many members, the group object must support multiple values.  When dealing with groups, the key LDAP attribute is MemberOf.

The scenario

You want to map network drives based on group membership.  Let us imagine that a group called Managers have their data stored on a different server from a group called Dentists.

We are going to create this script in stages.  Stage one just checks the group membership of the user who is logged on.  Stage two will actually map to different network drives depending on which group the logged-on user belongs to.

Pre-Requisites

You need an Active Directory domain for this VBscript.  Either Windows Server 2003 or Windows 2000.

To get the script to work as designed, pay close attention to the group membership.  Please create Global Groups called Dentists and Managers, or better amend the script to reflect your Active Directory groups.

Instructions

1. Important:  Make sure that the person testing the script is in a group called Managers, or Dentists.  Alternatively, alter dentists on line 11, to a group that you ARE a memberOf.
2. Optional: Edit the ' commented out lines.  Remember in the scenario, you want the script to map the network drive.  So edit that line to reflect a UNC share on your network.  See more here how to map a network drive. MapNetworkDrive
3. Copy and paste the script below into notepad or a script editor such as OnScript.
4. Save the file with .vbs extension e.g. GroupMap.vbs
5. Double click and observe the message box.

Stage one - Script to test Group Membership

Learning Points

Note 1: Constants.  This week I have introduced CONST to hold the group information.  Did you edit Dentists, or to be precise dentists?  "cn=dentists" is case sensitive.

Note 2: AdSystemInfo.  Here is a good method of extracting the information from Active Directory.

Note 3: InStr.  This means: in the string value.  InStr is useful for checking if a named value is contained in a much longer string.

Note 4: If.... ElseIf.  Check my 'If' statement.  Modify the clauses to suit groups on your network.  For example, if your group is called Human Resources and not Dentists, then amend the script accordingly.

Note 5:  When you are happy with .Echo message, why not remove the comment ' objNetwork and get the MapNetworkDrive method working.  Remember to uncomment the ' & objNetwork like as well.  Here is more help on MapNetworkDrive.

Note 6: I concatenated '& strGroup' to the Administrators group, you may like to add & strGroup to the other groups.  As ever what I want to do is get you started and give you the confidence to experiment for yourself.

Note 7: See more on MemberOf here

Stage two - Actually map the network drive

The purpose of this script is to actually map a network drive.  The precise path is dependent on the group to which the logged on user belongs.  For example, if you are an Administrator the script maps to \\ grand \home.  What is more it maps to a sub directory based on the user's name.  If the user is called guyt then this would be:
\\ grand \home \guyt.

If this is not clear then I suggest a refresher on MapNetworkDrive

Pre-requisite

Study the logic of my UNC paths and amend for your network. For example, it's unlikely that your server is called \\ grand, therefore replace with \\ yourservername.

Learning Points

Note 1:  If you have problems with this script, then double check the names of your groups, also seek out each UNC path and make sure it reflects a server and share on your network.

Note 2:  Each UNC path has _ & objNetwork.UserName appended.  This means that the network share must have a subfolder named after the logged on user.  If this is not the case, change to plain:
objNetwork.MapNetworkDrive "h:", "\\ alan\home"   Observe that I have removed the final backslash from \home".

Summary Logon Scripts and Group Membership

The secret of this mastering group membership scripts is planning; which groups, which UNC paths.  Once you have your plan, build the script in stages, get each method working, then bolt it all together.

See Also

Home Copyright © 1999-2008 Computer Performance LTD All rights reserved

Please report a broken link, or an error.