Active directory - logon / user folder change

[Patrick]

Good morning guys/gals!

 

We have a request from the higher ups to change how the students logon to the computers in school. We have been asked to change the user name (to j.smith for example, from john.smith), but we also need to change the user folder as well to reflect this. This is because staff have read access to the student folders and need to see the name change also.

 

Whats the best way about going about this? Any tips or tricks?

 

Thanks ladies n gents.

[howartp]

I find Excel is the best scripting software for this purpose.

 

Export a list of your current students from somewhere, into Excel, with forename and surname in columns 1 and 2.

 

Add a new column:

 

=concatenate(left(a1,1),".",b1)

This will give you their new username

 

Then add a new column along the lines of:

 

=concatenate("rename ",a1," ",b1)

 

This gives you the (approximate) batch command to rename the folders - just make sure you cd into the parent directory first. Then you can copy the column contents from excel into a cmd prompt and it will rename them.

 

You will need to do similar for permissions, but I get so mixed up with cacls / icacls / xcacls/ anyothercacls so I'll leave that to someone else to help with, using the same approach as above.]

 

Peter

[Patrick]

Thanks for that.

 

I was hoping i could just rename the user in AD and it would change the users home directory, as the last part is the kicker. Changing names in AD doesn't change the SID, so the user folder stays the same. Server generates the user folder name from user logon name pre-windows 2000, so changing that in AD does create a new, user folder. I just wish it'd rename the current existing one

[howartp]

In that case, you might be able to do the same thing with Powershell and the AD cmdlets - either use Excel to generate the powershell commands then paste them into Powershell, or use Powershell to parse the initials and surname and do the same thing.

 

In other words, Powershell to rename the AD accounts (keeping same SID) and batch (or another powershell) to rename the folders as above.

 

Peter

[Duke5A]

Here is some VB that can do the user account changes:

 

strDomainName = "Your Domain Name Goes Here.com"
strLDAPPath = "LDAP://OU=Students,OU=Users,DC=yourdomainname,DC=com"
strHomePath = "\\yourfileserver\sharename\"

Set oContainer = GetObject(strLDAPPath)
oContainer.Filter = Array("user")

For Each User in oContainer

on error resume next

strFirstName = User.FirstName
strLastName = User.LastName

strUserName = Left(strFirstName, 1) & "." & strLastName
	
User.DisplayName = strFirstname & " " & strLastName
User.SAMAccountName = strUserName
User.userPrincipalName = strUserName & "@" & strDomainName
User.Put "homedirectory", strHomePath & strUserName 

User.SetInfo

wscript.sleep (30)

If err.number <> 0 Then
	msgbox err.description & " " & user.samaccountname
end if		

Next

Msgbox "Work is Done!"

 

You could add a couple lines to change the directory names as it flies though. I just pulled this out of my backside with no testing, so test it against dummy user accounts in a dummy organizational unit.

[Patrick]

Will that code rename the the users folder as well? what's the best way to use that script?

[Duke5A]

Will that code rename the the users folder as well? what's the best way to use that script?

 

No it won't, but adding that functionality could be done in a dozen lines or so - it's not hard. The script would run at the privilege level of the user who is logged into the computer, so you would probably need to run it as a domain admin and the strings at the top would need to be edited to match your domain. I'm going to be blunt though, you need to be able to pick something like this apart and at least be able to identify what does what before turning it lose on a production environment. Scripts can be great time savers, but can also break a lot in very short order. I never run anything against my AD without thoroughly testing it first.