I am in a pickle and would just love to hear from someone in an AD environment. Here's the predicament:

A generic ID (EDMD, for example) auto-logs into the OS (Win XP) on a domain account. No problem, we do this all the time. This kicks off Vergence which is bio-metric. User swipes card or places fingerprint and system validates them via LDAP (domain\UName) and allows them to log onto the desktop.

Now, keep in mind that EDMD is is the one actively connected to the domain. The user is only at the desktop. The HKCU belongs to EDMD, %username% and other env. variables are set for EDMD.

Vergence will allow me to run a seperate logon script (.BAT file only) for the desktop and can pass it 3 variables: Domain, Username, and Password.

So, EDMD logs on to OS, login script for EDMD runs, GP is set, etc.

User logs on, Vergence run the batch file, batch file calls KiXtart. KiXtart script does my drive mappings for me, since users will be in different groups depending upon function (Admin, Nurse, Doctor, etc...).

Kicker: Ingroup() is working as designed... It checks against all of the groups for EDMD, not the user. What I apparently need to do is get a list of the groups for the current user to check against. I have no idea how to go about this.

BATCH file run by Vergence. Works fine. passes appropriate info.
 Code:
REM MapDrives.bat
@ECHO OFF
CD KIXTART
KIX32 MCGroups.kix /f /i %1 %2 %3


KiXtart script that works normally, but not with Vergence.
 Code:
break on
GLOBAL $Credentials
;DM=Domain  UN=UserName  PW=password
for each $Arg in GetCommandLine(1)
	$Ct = $Ct + 1
 	if $Ct = 4 $DM = $Arg endif
	if $Ct = 5 $UN = $Arg endif
	if $Ct = 6 $PW = $Arg endif
next

$Credentials = $DM + "\" + $UN

;Sample of using Ingroup(). Left more out for brevity
if ingroup("MC\MIG User Group",0)
        use R: /DELETE
        use R: "\\MCTECH\Images" /user:$Credentials /password:$PW
endif

EXIT


A piece of code I found that has SOMETHING to do with this, however, I have been unable to figure out how to get it to give me any type of inumeration of groups for a specific user, then, just to complicate matters, a users ID may be in another container besides "Users".
 Code:
Break On 

$sMCsPath = "LDAP://"+GetObject("LDAP://rootDSE").Get("defaultNamingContext") 
$objDomain = GetObject($sMCsPath) 

For Each $objContainer in $objDomain 
    $objContainer.Name ? 
Next 

Exit
_________________________
John K. Fischer
University of Kentucky
HealthCare - ITS