Stopping logons

[SpuffMonkey]

Hi - we're doing some serious work on our storage SANs next week - so I need to stop nearly everyone logging in (w2k3 and XP) - anyone got a simple way to do this - normally I'd consider pulling the network plug - but I need a running network for some of the work - so I don't really want to have to manually alter 1500 user login details...?

[Mcshammer_dj]

change the login times for all users

[PEO]

select all users - right click and disable

[jamesb]

Stop the net logon service?

[SpuffMonkey]

select all users - right click and disable

Yeah - but I've 1500 users spread over a zillion AD areas (small exaggeration..) *sigh*

[SpuffMonkey]

Stop the net logon service?

Yebbut nobbut yebbut a couple of us need to be logged on to do the work..

[Potato-Peeler]

Turn off all switches to areas you dont need to log in?

[sted]

at a guess all the users you need to block are staff/students and not admins couldnt you just create a group for them and then block that group

[srochford]

I always like the "select all the accounts and right click" type answers - I wouldn't have thought that there were many people here with an AD small enough for that to work :-)

You could use the script I posted the other day at Script to populate AD fields with a bit of modification:

Set oRoot=getobject("LDAP://rootdse")
sDomain=oRoot.get("defaultNamingContext")
Set oConn = CreateObject("ADODB.Connection")
oConn.Provider = "ADsDSOOBJECT"
oconn.Open
sQuery = "<LDAP://" & sDomain & ">;(&(objectClass=user)(objectcategory=person));ADsPath, sAMAccountName, displayname;subtree"
Set oRS = oConn.Execute(sQuery)
do While Not oRS.EOF
    sUser=oRS("ADSPath")
    sAccount=lcase(ors("sAMAccountName"))
    if instr(sAccount,"|administrator|steve|andy|bryan|")=0 then     
      Set oUser=getobject(sUser)
      oUser.AccountDisabled=true
      oUser.setinfo
    end if
    
  oRS.MoveNext
loop

key bits in red; first checks for accounts you want to keep active (usernames in lower case or it won't work!), second disables everything else.

When you're done, re-run the script but change the "true" to "false" and the accounts are re-enabled.

[kmount]

Whilst I like Steve's solution there, for the right click disablers you could just search the domain for users, sort by type to get the groups out of the way, highlight all of the users, deselect the few you don't want to disable and then right click disable.

[SpuffMonkey]

Steve - you are my scripting God! And nice one Kim - I like that too - cheers guys - I knew there'd be some clever suggestions!

[IrritableTech]

Search domain for Users, Contacts and Groups, leave the search field blank. Order by type. Select first user hold shift and select last user, right click and disable. Easy.

Sorry, didn't read Kims post. Move on now people.