#72148 - 2002-12-08 03:09 PM
LDAP Connection into AD
|
Richie19Rich77
Seasoned Scripter
Registered: 2002-08-16
Posts: 624
Loc: London, England
|
Hi Everyone
I have made this script up with help from this board, that reads a excel file and then builds users into AD.
This works fine, but I have 2 domain controllers, and when the script runs, it builds the users on the active PDC and then you have to wait 5-10 minutes until Microsoft replicates the 2 domain controllers.
code:
$adsDomain = GetObject("LDAP://OU=Users,OU=QEH Users,DC=qeh-tr,DC=sthames,DC=nhs,DC=uk")
That is the line I am using, but can I specify a domain controller, and then what I could do is run the line twice using the DC1, then DC2.
The reason I need to do this is because I also create the home folders for the users and set permissions using CACLS, but when I run CACLS it says user does not exist.
Please help.
Thank You.
Richard
|
|
Top
|
|
|
|
|
#72150 - 2002-12-08 03:24 PM
Re: LDAP Connection into AD
|
Richie19Rich77
Seasoned Scripter
Registered: 2002-08-16
Posts: 624
Loc: London, England
|
Thanks for the quick return, but I get this error message, I will find out why.
code:
C:\Documents and Settings\administrator.QEH-TR>net accounts /sync /domain
You used an option with an invalid value.
More help is available by typing NET HELPMSG 3505.
Richard
|
|
Top
|
|
|
|
|
#72152 - 2002-12-08 03:38 PM
Re: LDAP Connection into AD
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
You can direct the ADSI action to individual servers, but you can not duplicate the same account creation on both servers as you will get two different accounts that will collide and result in the replacement of one with the other. In AD the last write wins during domain replication.
If you know that the home directory for user1 is on server2 then you can create the account on server2 with the home directory and let it replicate back to server1. If the home directory for user2 will exist on server1 then create the account there and let it replicate to server2.
You can use the LDAP format that specifies the target container like:
code:
"LDAP://$server/$ADS_NAME_TYPE_1779"
$adsObject = GetObject("LDAP://" + $server + "/OU=Users,OU=QEH Users,DC=qeh-tr,DC=sthames,DC=nhs,DC=uk")
[ 08. December 2002, 15:39: Message edited by: Howard Bullock ]
|
|
Top
|
|
|
|
|
#72158 - 2002-12-09 12:24 AM
Re: LDAP Connection into AD
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
Still wondering why you want to force a replication. Are your home directories on a server other than on the domain controller? Could you provide more details of your architecture?
|
|
Top
|
|
|
|
|
#72160 - 2002-12-09 12:47 AM
Re: LDAP Connection into AD
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
Well, I assume that the server where the home directory exist is in a known site and that you can specify the DC. If you use the code I gave you above, then your could create the account on the DC that services the site where the home directory server is. If you create the account on the remote DC then XCALCS should find the exisiting account. Have tried that?
|
|
Top
|
|
|
|
|
#72162 - 2002-12-09 01:01 AM
Re: LDAP Connection into AD
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
First question: is the clustered File&Print Server a W2K server in the AD architecture? If it is, the DC selected to service the secure channel connection will be the DC in the same SITE (assuming you have configured W2K sites).
Have you ever use NLTEST.exe? It will show you which DC it is using for authenticating accounts.
Are your DCs in separate sites?
|
|
Top
|
|
|
|
|
#72163 - 2002-12-09 01:22 AM
Re: LDAP Connection into AD
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
If you want to know the server name of the AD DC to which your file/print cluster is currently connected, I can add a method to Win32Admin that will return that information.
Then your script could create the home directory first, query the trust to get the server name of the AD DC, create the account on that server, and follow-up with XCALCS which should be using the same DC where the accounts were created.
[ 09. December 2002, 12:40: Message edited by: Howard Bullock ]
|
|
Top
|
|
|
|
Moderator: Glenn Barnas, NTDOC, Arend_, Jochen, Radimus, Allen, ShaneEP, Ruud van Velsen, Mart
|
0 registered
and 661 anonymous users online.
|
|
|
