Easy way to enable dialin access in AD

[localzuk]

I now have my network VLANs working fine, with MAC based VLAN assignment. I have successfully created the 300 or so users in the AD which are checked against and VLANs assigned accordingly. However, all of these have their Remote Access Permissions set to 'Deny Access'.

 

I've looked at vbscript and have come up short - does anyone know of a quick and easy way of scripting the enabling of access?

 

I know I can likely do it in c# but don't want to go into so much hassle as to write an entire program just to do this... And I don't want to go clicking my way through the AD either.

 

Ideas?

[Iain]

The Dial-in Remote Access Permission can be be set to allow or deny by setting the LDAP attribite msNPAllowDialin to TRUE or FALSE respectively in the user object.

 

For example using vbscript:

Set objUser=GetObject("LDAP://")
objUser.Put "msNPAllowDialin", TRUE
objUser.SetInfo

 

Obviously you'll need to wrap that in code to iterate through the required users.

 

Hope that is of some help,

 

Iain.

[localzuk]

I'm afraid that hasn't worked. I've tried using that method, and the method described here: http://msdn2.microsoft.com/en-us/library/ms717026.aspx

 

Your method simply adds an LDAP field but the AD seems to ignore this. The method described at the link seems to run, but doesn't make any difference...

[localzuk]

UPDATE: Well, it does seem to have worked actually... I checked directly on each AD server and none of them were reflecting any changes... but checking again now, they all are.

 

So, patience was the key.

[Iain]

My guess it that you are working in a Win2K mixed mode domain, in which case you can't set this property via ADSI [see KB257341] A workaround seems to be available though: KB252398

 

Iain

[localzuk]

I already spotted that and changed to a 2000 native domain instead. All is working fine now.