Guy's Scripting Ezine number 58 More Groups Part 2

IPAM will assist you in managing IP addresses.

To let you into a secret, this utilities is fun to use, even if you don't have a pressing need to calculate your IP address space.

Get a free evaluation copy of Orion IPAM

Is your server running slowly? Check with SolarWinds ipMonitor

Get a free evaluation copy of ipMonitor

Contents for Guy's Scripting Ezine 58 More Groups 2

This week’s secret

This week I feel like one of those swans who appear to be gliding serenely on the surface, while all the time they are frantically paddling like mad under the surface.

No worries - your example script WILL work. However, its development was far from smooth. Problems with scripts make me frustrated but never angry, and there is no feeling as great as when your code finally works.

This week's mission - to control the group Type and Scope

Firstly, a reminder that this is More Groups (2), so I recommend reviewing More Groups (1) - particularly if you need to add users to groups.

While I haven't forgotten my promise to deal with CONST, we will have to wait one more week for a dedicated ezine explaining Constants. For this week's script, I suggest that you just accept that we have to use CONST declarations to control the Type and Scope of the group.

My project to script groups started well, here are the CONST values that my research uncovered:

However when I entered these values exactly as above, the script failed. So, back to the drawing board. Next I found that VBScript wanted the CONST precisely in this format: &Hx. Naturally H stands for Hex.

The CONST statement is really 'picky', for example, a space between ampersand and H results in another 0800 error. = &H8 is correct but = & H8 fails because of the space between & and H8.

Hooray! I had mastered the Scope of the group, but what about the Type? Once you add one of these ADS_Group constants, the default type of group changes from security to distribution. Another problem to overcome.

So, how do you create a Security group? Firstly, seek out the ADS_GROUP_TYPE_SECURITY_ENABLED Constant.

Then, what should you do? Change the value of ADS_GROUP_TYPE_SECURITY_ENABLED = 0x80000000 to: &H8?
Wrong it should be: = &H80000000

To be crystal clear, here is the complete answer:
Const ADS_GROUP_TYPE_SECURITY_ENABLED = &H80000000

Next how could I persuade the script to add the two properties, Security_Enabled and Type_Universal? Here was my suggestion:

If you think that would work, you must be joking - no chance. Undaunted, I researched the problem and found a suggestion to add the | (pipe symbol down near the control). This was close - but no cigar. What you really needed was an OR statement. Strange but true. This was the final code:

Incidentally, have you noticed with scripting that once thing goes wrong you get more and more errors? Well you have probably guessed that this week I had a ' bad hair day'. The good news is that the converse also applies, when you are on a run, all scripts working perfectly, then you believe that you can 'walk on water'.

If you are looking for handy network utilities, try some of the free downloads at Tools4Ever

Example - Creating a Security Universal Group

This script creates a new group. It is designed to change the Scope from Global (default) to Universal. With care, you could alter the CONST statement, for example, to create a Domain Local Group.

The trickiest part is controlling the Type. If you remember when you create a group using script with the default values it turns out to be a Global Security group. The minute you change the scope to Universal the default Type changes to Distribution. Wacky? However, all is not lost, just add
Or ADS_GROUP_TYPE_SECURITY_ENABLED and force the group Type to be security.

' UniSecureGroup1.vbs
' VBscript to create a Universal Security Group
' Author Guy Thomas http://computerperformance.co.uk/
' Version 4.9 - January 9th 2005
' ----------------------------------------------------------'
Option Explicit
Dim strOU, strNewGroup, strNewGroupLong, strDNSDomain
Dim objOU, objGroup, objRootDSE
Dim strGuyGp, strGPType

Const ADS_GROUP_TYPE_UNIVERSAL_GROUP = &h8
Const ADS_GROUP_TYPE_SECURITY_ENABLED = &H80000000
' If you want a global group, here is the CONST
' Const ADS_GROUP_TYPE_GLOBAL_GROUP = &h2

' Challenge - Make sure you have an OU called strOU
' Option change the strNewGroup = "UniSec"
strOU = "OU=Cowbridge,"
strNewGroup = "GuyUniSec"
strNewGroupLong = "CN=" & strNewGroup

' Bind to Active Directory
Set objRootDSE = GetObject("LDAP://RootDSE")
strDNSDomain = objRootDSE.Get("DefaultNamingContext")

' Create new Group
Set objOU = GetObject("LDAP://" & strOU & strDNSDomain )
Set objGroup = objOU.Create("Group",strNewGroupLong)
objGroup.Put "sAMAccountName", strNewGroup

' Here is where you set the group Type and Scope
objGroup.Put "groupType", ADS_GROUP_TYPE_UNIVERSAL_GROUP _
or ADS_GROUP_TYPE_SECURITY_ENABLED
objGroup.setInfo

Wscript.Echo "Created " &strNewGroup
Wscript.Quit

' End of example VBScript

Learning Points

Note 1: Const ADS_GROUP_TYPE_UNIVERSAL_GROUP = &h8 is responsible for creating the Universal Group. Consult the notes to change the scope to Global or Domain Local.

Note 2: Pay close attention to these two lines, under: ' Here is where you set group... In this script the group Type is Security, should you want a distribution group, just remove the _ and the line:
or ADS_GROUP_TYPE_SECURITY_ENABLED

Challenges - Add error correcting code

' Challenge 2 - Add after objGroup.SetInfo
If err.number = vbEmpty then
Wscript.Echo "Created " & strNewGroup & " type " & strGPType
ElseIf err.number = -2147019886 then
Wscript.Echo err.number & " Group Already Exists"
Else
Wscript.Echo err.number & " Must Research"
End If

Summary - Groups Type and Scope

It is fiendishly difficult for VBScript to manipulate the Type and the Scope of a new group. Pay particular attention to the CONST = statements at the start of the script.

Computer Training Software - Recommended Training Videos

Guy Thomas recommends Computer Training Software.

Their topics and material are ideal for getting you started with VBScript. The videos are easy to follow and you can control the pace. Try their free demo material and then see if you want to buy the full package. See more about VB Script Training CD.

Guy's Scripting Ezine 58 More Groups 2

Contents for Guy's Scripting Ezine 58 More Groups 2