Startup Script to update AD Description

[linkazoid]

Hi All,

 

With the help of Edugeek I've been playing with updating AD Information with the Model, Serial, HDD and RAM into the Computer Object descripton field. - http://www.edugeek.net/forums/windows/92976-network-pc-inventory-script.html

 

I am now using the following script

 

Option Explicit
On Error Resume Next

Dim objRootDSE, objNetwork, objWMIService, objComputer
Dim strComputer, strMake, strModel, strSerialNumber, strMacAddresses, strMemory, intMemory
Dim colBIOS, objBIOS
Dim colItems, objItem, strHDD
Dim colNetworkAdapterConfiguration, objNetworkAdapterConfiguration
Dim colComputerSystem, objComputerSystem
Dim colPhysicalMemory, objPhysicalMemory
Dim adoConnection, adoRecordset

strComputer = "."
strMemory = ""
strMake = ""
strModel = ""
strSerialNumber = ""
strMacAddresses = ""

Set objRootDSE = GetObject("LDAP://RootDSE")
Set objNetwork = WScript.CreateObject("WScript.Network")
Set objWMIService = GetObject("Winmgmts:\\" & strComputer & "\root\cimv2") 

Set colComputerSystem = objWMIService.ExecQuery("SELECT * FROM Win32_ComputerSystem") 

If Not colComputerSystem Is Nothing Then
For Each objComputerSystem In colComputerSystem 
	strMake = objComputerSystem.Manufacturer 
	strModel = objComputerSystem.Model 
Next
End If

Set colBIOS = objWMIService.ExecQuery("Select * From Win32_BIOS")

If Not colBIOS Is Nothing Then
For Each objBIOS in colBIOS
	strSerialNumber = objBIOS.SerialNumber
Next
End If

Set colItems = objWMIService.ExecQuery("Select * From Win32_DiskDrive")

If Not colItems Is Nothing Then
For Each objItem in colItems
	strHDD = objItem.Model
Next
End If

Set colPhysicalMemory = objWMIService.ExecQuery("Select * From Win32_PhysicalMemory")

If Not colPhysicalMemory Is Nothing Then
intMemory = 0
For Each objPhysicalMemory In colPhysicalMemory
	intMemory = intMemory + Int(objPhysicalMemory.Capacity)
Next
strMemory = (intMemory / 1024 / 1024 / 1024) & " GB"
End If

Set adoConnection = CreateObject("ADODB.Connection")
adoConnection.Provider = "ADsDSOObject"
adoConnection.Open "Active Directory Provider"

If Err.Number <> 0 Then
MsgBox "Connect Error: " & Err.Description
WScript.Quit
End If

Set adoRecordset = adoConnection.Execute(";(&(objectCategory=Computer)(name=" & objNetwork.Computername & "));adspath;subtree")

If Err.Number <> 0 Then
MsgBox "Query Error: " & Err.Description
WScript.Quit
End If

If Not adoRecordset.EOF Then
Set objComputer = GetObject(adoRecordset.Fields(0).Value)
objComputer.Put "description", "" &strModel & ", HDD: " & strHDD & ", " & strMemory & " RAM" & ", Serial: " & strSerialNumber 
objComputer.SetInfo
End If

If Err.Number <> 0 Then
MsgBox "Write Error: " & Err.Description
WScript.Quit
End If

 

This works fine when run manually, but I'd like this to populate the description on startup. I have applied the script to the startup script for the ALLPCs GPO but the information is not filling out.

 

Do I need to change any AD permissions for the PC to be able to update it's own description field?

 

Thanks,

 

Michael

[Duke5A]

Hi All,

This works fine when run manually, but I'd like this to populate the description on startup. I have applied the script to the startup script for the ALLPCs GPO but the information is not filling out.

 

Do I need to change any AD permissions for the PC to be able to update it's own description field?

 

Thanks,

 

Michael

 

Yes, startup scripts run with computer credentials, so it's using that security context to try and update the computer object's description field. Try delegating the security group "Domain Computers" to have read/write of the description property on computer objects within the OU where these computer objects reside. By default all domain joined computers are a member of that group.

[linkazoid]

I have set delegation for the following but still the information is not being populated.

 

You chose to delegate control of objects
in the following Active Directory folder:

   mydomain.com/School/Windows 7/

The groups, users, or computers to which you
have given control are:

   Domain Computers (mydomain\Domain Computers)

They have the following permissions:

   Read Description
   Write Description

For the following object types:

   Computer

 

Can you suggest anything else?

 

Thanks,

 

Michael

[Firefox]

We do something similar with Powershell with different requirements however. We then run this as a startup script via GPO

 

Srcipt to change AD Object Description to local variables
#$cred = Get-Credential
$strName = $env:computername

$CompSys = wmiobject -class win32_computersystem;
$Nic = wmiobject -class win32_networkadapterconfiguration | where {$_.IPEnabled -eq "True"}
$OS = wmiobject -class win32_operatingsystem

$Mfacture = $CompSys.Manufacturer;
$Model = $CompSys.Model;
$CUser = $CompSys.UserName;
$Name = $CompSys.Name;
$IPv4 = $Nic.IPAddress[0];
$MAC = $Nic.MACAddress;
$OSName = $OS.Caption;
$Dom = $CompSys.Domain;

$strFilter = "(&(objectCategory=Computer)(Name=$strName))"

$objDomain = New-Object System.DirectoryServices.DirectoryEntry

$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.SearchRoot = $objDomain
$objSearcher.PageSize = 1
$objSearcher.Filter = $strFilter
$objSearcher.SearchScope = "Subtree"

$colProplist = "name", "description"
foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)}

$colResults = $objSearcher.FindAll()

foreach ($objResult in $colResults)
  {$objItem = $objResult.Properties 
  $cname = $objitem.name
  $desc = $objItem.description 
  $strDN = [string]$User.properties.Item("distinguishedName")
  }

$OldCompDesc = $desc;
$NewCompDesc = ("$CUser , $Name , $MAC , $IPv4 , $Mfacture $Model , $OSName")

#Build LDAP DN Search
$LDAPdn = ("$strDN")
$namerem = ("$strName,")
$LDAPdn = $LDAPdn.Replace("CN=","")
$LDAPdn = $LDAPdn.Replace($namerem,"")
$Target = [ADSI]"LDAP://$LDAPdn"

if ($OldCompDesc -ne $NewCompDesc)

{
Function UpdateDesc($Parent)
{
   	ForEach ($Child In $Parent.Get_Children())
   	{
       	If ($Child.Class -eq "Computer")
       	{
			If ($Child.Name -eq $strName)
			{
				If ($Child.Description -ne $NewCompDesc)
				{
           			$Child.Put("description", $NewCompDesc)
        			$Child.SetInfo()
				}
			}
       	}
   	}
}

UpdateDesc $Target
}
#elseif ($OldCompDesc -eq $NewCompDesc){"No Change Required"}

#

[linkazoid]

For whatever reason, the delegating control to the computer objects seems to work today. AD is populating the information now.

[Duke5A]

For whatever reason, the delegating control to the computer objects seems to work today. AD is populating the information now.

 

Multiple domain controllers? Probably just needed to replicate.