How to work out domain string (LDAP I think)

[garethEds]

Hopefully someone can correct/help me - I have a line that looks like this:

 

cn=Joe,cn=users,OU=strOU,dc=MyDom,dc=com

 

How do I work out what to put where. As in what is the syntax.

 

Any pointers to websites that help also appreciated - that way I can teach myself.

 

Cheers

 

Gareth

[apoth0r]

cn=Joe(username?),cn=users(group they are a member of),OU=strOU(organisational unit),dc=MyDom(domain - school),dc=com(.county.sch.uk)

 

Don't quote me, but it's my guesstimate on what it is after

[localzuk]

cn=Joe(username?),cn=users(group they are a member of),OU=strOU(organisational unit),dc=MyDom(domain - school),dc=com(.county.sch.uk)

 

Don't quote me, but it's my guesstimate on what it is after

 

Ok. Imagine in your Active Directory/LDAP server you have the following structure

 

Domain: my.domain.co.uk

 

Staff

-> Art

-> Fred Bloggs

 

Staff and Art would be OU's (Organisational Units). Fred Bloggs is a User, so you refer to it by its CN (Common Name).

 

So, the string for that would be

 

CN=Fred Bloggs,OU=Art,OU=Staff,DC=My,DC=Domain,DC=Co,DC=UK

 

You can have more levels of CN's though, for example in an active directory the 'Users' container is also a CN, so if Fred Bloggs had been in there, the string would have been

 

CN=Fred Bloggs,CN=Users,DC=My,DC=Domain,DC=Co,DC=UK

 

Every part of the path is a seperate item, so your domain has to be split into its component parts.

Hope this helps.

[Soulfish]

Or do what I do - download ADExplorer from the Microsoft Sysinternals website. It'll give you the proper ldap string for any object

[garethEds]

So with that in mind I've tried to break it down into it's component parts:

 

OU=Curriculum-v1, OU=Workstations, OU=Secondary Schools, OU=YGGwyr, OU=Local, OU=ManagedWorkstations, OU=strOU, DC=school, DC=education, DC=swansea, DC=SCH, DC=UK

 

Ahha - ADExplorer gave it different:

 

OU=strOU, OU=ManagedWorkstations,OU=Local,OU=YGGwyr,OU=Secondary Schools,OU=Workstations,OU=Curriculum-v1,DC=school,DC=education,DC=swansea,DC=sch,DC=uk

 

So I wasn't far wrong

 

Where I have put OU=strOU - that is meant to be replaced by a string variable entered by the user. If that makes sense. Would it work like that or does it need to be put in different?

 

I'm trying to adapt a script that lets the user tell a WDS image where to drop itself in the LEA AD structure.

 

OU=YGGwyr is my school.

 

Gareth

Edited September 9, 2009 by garethedmondson

[garethEds]

Or do what I do - download ADExplorer from the Microsoft Sysinternals website. It'll give you the proper ldap string for any object

 

LOL - just seen this after my last post. Am trying it now.

 

GJE

[ahuxham]

Easiest way to remember is work backwards, when trying to figure it out. Just open AD, find the user, than work backwards from the top of the tree downwards.

 

domain.local

container0

container1

container3

-- group 1

-- group 2

---- user 1

 

 

user1, group2, container3, domain, local and the such

[garethEds]

So I've adapted this script with what people have said and it works upto the line where it tries to add to the domain.

 

 
Const JOIN_DOMAIN = 1
Const ACCT_CREATE = 2
Const ACCT_DELETE = 4
Const WIN9X_UPGRADE = 16
Const DOMAIN_JOIN_IF_JOINED = 32
Const JOIN_UNSECURE = 64
Const MACHINE_PASSWORD_PASSED = 128
Const DEFERRED_SPN_SET = 256
Const INSTALL_INVOCATION = 262144
Password = "setup"
Username = "school\ygg-ris"
Name = InputBox("Please enter a computer name:", "Rename Computer")
strComputer = "."
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colComputers = objWMIService.ExecQuery("Select * from Win32_ComputerSystem")
For Each objComputer in colComputers
err = objComputer.Rename(Name, Password, Username)

Name = InputBox("Please enter where in the Gwyr AD you would like to put this:", "Place in OU")
Set objUser = GetObject("[url]ldap://school.education.swansea.sch.uk/[/url] OU=ManagedWorkstations,OU=Local,OU=YGGwyr,OU=Secondary Schools,OU=Workstations,OU=Curriculum-v1,DC=school,DC=education,DC=swansea,DC=sch,DC=uk")
If Err.Number = 0 Then
WScript.Echo "Successfully renamed computer to " & name & "!"
WScript.Echo "System will now restart for change to take effect!"
Call Restart
Else
WScript.Echo "An error occurred renaming the computer!"
WScript.Echo "Error Number: " & Err.Number
WScript.Echo "Error message: " & Err.Description
End If 
Next
Sub Restart
Dim wshShell
Set wshShell = CreateObject("WScript.Shell")
wshShell.Run "%WINDIR%\System32\shutdown.exe /r /t 0 /f /d p:2:4", 0
End Sub

 

The line causing me problems is:

 

 
Set objUser = GetObject("[url]ldap://school.education.swansea.sch.uk/[/url] OU=ManagedWorkstations,OU=Local,OU=YGGwyr,OU=Secondary Schools,OU=Workstations,OU=Curriculum-v1,DC=school,DC=education,DC=swansea,DC=sch,DC=uk")

Any advice welcome,

 

The error message says:

 

An operations error occured

80072020

 

 

GJE

[cookie_monster]

Not quite sure how to place it in your script yet but when I need to find the domain string I use this.

 

Set objDomain = getObject("LDAP://rootDse")
DomainString = Wshnetwork.UserDomain

[DrPerceptron]

When binding, you have to use a common name as the first component.

 

Also, you want to edit it to read:

 

Set objUser = GetObject("ldap:// OU=ManagedWorkstations,OU=Local,OU=YGGwyr,OU=Secondary Schools,OU=Workstations,OU=Curriculum-v1,DC=school,DC=education,DC=swansea,DC=sch,DC=uk")

 

But you'll still need a CN... or search your LDAP domain for the user and return a pre-built (I think) distinguished name

 

Hey, Scripting Guy! How Can I Bind to a User Account Using Something Other Than the CN Attribute?

 

Scripting guy may provide some insight for you.

[PiqueABoo]

Drop the FQDN from it:

 

Set objOU = GetObject("ldap://OU=ManagedWorkstations,OU=Local,OU=YGGwyr,OU=Secondary Schools,OU=Workstations,OU=Curriculum-v1,DC=school,DC=education,DC=swansea,DC=sch,DC=uk")

 

Note I've changed the variable to "objOU" because it will return an OU object. Plus what I can't see in there is any subsequent domain joining code - did you skip posting that bit?

[garethEds]

Drop the FQDN from it:

 

Set objOU = GetObject("ldap://OU=ManagedWorkstations,OU=Local,OU=YGGwyr,OU=Secondary Schools,OU=Workstations,OU=Curriculum-v1,DC=school,DC=education,DC=swansea,DC=sch,DC=uk")

 

Note I've changed the variable to "objOU" because it will return an OU object. Plus what I can't see in there is any subsequent domain joining code - did you skip posting that bit?

 

Hi - no the sysprep.ini file joins the domain for me. I have thought about taking that bit out of the sysprep.ini file - but haven't got there yet.

 

Basically this is what happens:

 

1. image installs from WDS

2. Post-image script is run (the one I posted)

3. Script asks user for the new name

4. Script changes the machine name from the one created by syspref.ini to the one provided in step 3

4. The script should then ask the user where in the Gwyr AD structure would I like to put the machine (I have not added this)

5. The script should then drop the machine into the correct OU container in our part of the AD>

 

I found the script for renaming the machines on the internet and am trying to edit it to include steps 4 and 5 above.

 

I'm not a scripter. This is the first I have ever done - but I am trying to learn by reading other people's scripts and asking advice.

 

Will try everyone's suggestions in the morning,

 

GJE

[PiqueABoo]

I am trying to learn by reading other people's scripts and asking advice

 

Ok I've attached a BDD/MDT script that might be a [useful|confusing|both] reference. It's in a WSF wrapper, but the code is VBS. This moves a computer that has already been joined to the domain from wherever it is now to a given OU. In this case all the info required for the move is already present in a bunch of environment variables.

Z-MoveComputer_HostOS.7z

[mortstar]

Using WDS it is pretty simple to get it to automatically join the domain with the correct machine name and in the OU you require.

 

All you need do is create a new Computer object for each machine (you do this 1 time and once it is set you don't need to do it again - you can create the Computer object in any OU you want) and when asked if it is managed tick yes. You can either use the GUID or the machine's MAC preceeded by 20 zeros (a whole bunch of our Evesham built machines have no GUID so we use the MAC address option). Now when WDS is imaging the machine it 'knows' which machine it is.

 

You need to change the sysprep to join domain (I can post our sysprep file if you are interested).

 

Then when you deploy the image the machine is named correctly and added to the domain automatically.

 

Simples

[garethEds]

Using WDS it is pretty simple to get it to automatically join the domain with the correct machine name and in the OU you require.

 

All you need do is create a new Computer object for each machine (you do this 1 time and once it is set you don't need to do it again - you can create the Computer object in any OU you want) and when asked if it is managed tick yes. You can either use the GUID or the machine's MAC preceeded by 20 zeros (a whole bunch of our Evesham built machines have no GUID so we use the MAC address option). Now when WDS is imaging the machine it 'knows' which machine it is.

 

You need to change the sysprep to join domain (I can post our sysprep file if you are interested).

 

Then when you deploy the image the machine is named correctly and added to the domain automatically.

 

Simples

 

Hi Mortstar,

 

Excuse my ignorance with this. Is this what they call prestaging? I get the concept of this but I'm not sure how it works by only creating the computer object once. What if you have sixty machines of the same spec? In the same room?

 

For example in my room we have ygg-tg01-01 all the way through to ygg-tg01-30

 

The way I have wanted to do it is as close to RIS custom build that we can get (and similar to RM's build CC3 build).

 

Thanks for your advice,

 

GJE

[mortstar]

Exactly, this is prestaging.

 

When the machines are booting via PXE, press the PAUSE button on the keyboard. You'll see a section that shows the Machine's GUID and MAC. If the GUID is unique for each machine use this, otherwise use the MAC address preceeded by an extra 20 zeros (this is when you are pre-making the accounts in AD).

 

Basically you delete the AD accounts that you have now for ygg-tg01-01...30 and recreate them filling in your choice of unique field, before you deploy the image to these machines.

 

When you PXE boot via WDS, the WDS server matches the machines to the known accounts in AD by the unique identifier you've chosen (GUID or MAC).

 

All that needs to be done then is setup your sysprep so that it joins the domain and renames the machine automagically.

 

Here's my sysprep.ini

;SetupMgrTag

[unattended]

OemSkipEula=Yes

InstallFilesPath=C:\sysprep\i386

TargetPath=\WINDOWS

DriverSigningPolicy=Ignore

 

[GuiUnattended]

AdminPassword="*"

EncryptedAdminPassword=NO

AutoLogon=No

OEMSkipRegional=1

TimeZone=85

OemSkipWelcome=1

 

[userData]

ProductKey=*****-*****-*****-*****-*****

FullName="School"

OrgName="School"

ComputerName=%MACHINENAME%

 

[RegionalSettings]

LanguageGroup=1

SystemLocale=00000809

UserLocale=00000809

InputLocale=0809:00000809

 

[Networking]

InstallDefaultComponents=Yes

 

[identification]

JoinDomain=%MACHINEDOMAIN%

DoOldStyleDomainJoin=Yes

 

[branding]

BrandIEUsingUnattended=Yes

 

[Proxy]

Proxy_Enable=0

Use_Same_Proxy=0

 

The two part %MACHINENAME% and %MACHINEDOMAIN% are what link sysprep to the data held in AD.

 

This is specifically for our XP builds.

Edited September 9, 2009 by mortstar

[PiqueABoo]

and similar to RM's build CC3 build

 

Aww.. you miss it.

 

You can get extremely close with the Microsoft Deployment Toolkit (MDT) e.g. PXE/USB/CD boot a machine, couple of minutes later fill in the computer name, pick the OU, supply a password...

 

The problem is that MDT has a very steep learning curve (IIRC the only other person I've seen mention using it on here said the same) and there's not that much relevant information floating about on the net. I think it's lovely in a geeky sense but it's not necessarily economic i.e. you'd be lucky to save the time you spent on it.