User Provisioning Tool

[Guest monkeyx]

:oops:

[plexer]

Absolutely I have this on my list of things to do to create myself.

 

Willing to help where I can.

 

Ben

[craiglay]

I have been playing with this in my spare time too...

 

My aim is to be able to export a CSV file from Phoenix and directly import it into AD, setting folder permissions, profile, and highly editable. Currently I have a system whereby I can provide a single command to do add a user, create folders and set permissions. Eg. Username, Fullname, ADOU, etc.

 

I'm more than willing to share this around.

 

Craig

[Guest monkeyx]

:oops:

[Uraken]

EDS my word thats a blast from the past worked there about seven years ago in sheffield.

[Quackers]

Its so easy to already with what comes with Windows i do not see the need for such a tool.

 

simply open excel

 

In column A put the word net - drag down to put the word net in as many cells as you need

In column B put the word user - drag down to put the word user in as many cells as you need

In column C put the Username you want (i paste from NovaT)

In column D put the password you want

In column E put /add and drag down to put /add in as many cells as you need.

 

Then highlight it all, copy, open notepad, do edit paste. Save it as somthing.bat and run it on a domain controller, and bang, all users added in seconds and appear in the Users container. Now copy them to OU needed, highlight all users right click, properties, click the profile tab, tick home directory put \\servername\share\year\%username% as the profile location and Windows Server will create all the home directorys for you and set the right permissions.

 

All done in less than 5 minutes, and very easy.

[Ric_]

@Quackers: I think that the point is to have an 'idiot-proof' way of doing it. You can of course export from SIMS, etc. to a CSV and with a bit of concatenation squirt the CSV into csvde (see http://www.computerperformance.co.uk/Logon/CSVDE_LDIFDE.htm ) and create the users in the correct OU and everything.

 

Of course some clever programming could take a CSV from SIMS and do all the faffing around in the background before using csvde to create the accounts.

[MkII]

We have a member: David Wiseman, who's site wisesoft.co.uk has his spreadsheet that does this bit already (I think) called Account Management Spreadsheet.

 

I use it every year for my account creation.

[Guest monkeyx]

:oops:

[Quackers]

Then highlight it all, copy, open notepad, do edit paste. Save it as somthing.bat and run it on a domain controller, and bang, all users added in seconds and appear in the Users container. Now copy them to OU needed, highlight all users right click, properties, click the profile tab, tick home directory put \\servername\share\year\%username% as the profile location and Windows Server will create all the home directorys for you and set the right permissions.

 

All done in less than 5 minutes, and very easy.

 

Well maybe such a tool is not needed. Can you remind me how you also set the NTFS/Share permissions to give Domain Admin/User FC (ie everyone else has no permission to share, unlike default share permission!) in under 5 minutes as well. Because, if that is so easy I agree such a tool would not be required.

 

And yes I am using the word provisioning in that the end goal will be take the data straight from the MIS system. Initial support would have been for Excel. But it looks like there is no real need for such a tool from some of the feedback?

 

Create 1 share for the user's home directory's, ie homes.

 

NTFS Permissions give

 

domain users read (This Folder ONLY)

domain admins full

system full

 

Then create a folder for each year group, ie 2000, 2001, 2002 on each of these folders i give

 

group 2000 read (This folder ONLY)

domain admins full

group staff (full, read depending on what you want)

system full.

 

Now when you click User Home Directory and set the path to \\server\homes\2000\%username% a directory with the users username is automatically made and all permissions set correctly, so only that user and what every permissions are inherated are allowed in. (Just make sure the share permissions are set to allow everyone to write.

[Guest monkeyx]

:oops:

[Quackers]

(Just make sure the share permissions are set to allow everyone to write.

 

to be honest if you class that as an acceptable security policy I give up!

 

Thats the share permission, you cannot write to you home directory with read permissions on the share . The NTFS permissions stop them doing anything

[Ric_]

(Just make sure the share permissions are set to allow everyone to write.

 

to be honest if you class that as an acceptable security policy I give up!

 

You are confusing share and NTFS permissions I think. Share permissions are not very granular and there are only three options (read, read/write, no access).

 

The NTFS permissions are the important part since these can be set on individual files and directories.... you can only write to what the NTFS permissions allow... despite having read/write access to the share.

[plexer]

If you use net user /add to create users on windows 2000/2003 I think you'll find it doesn't actually create windows 2000 usernames but NT4 equivalent ones.

 

This may not cause you problems but it has for me.

 

Ben

[apeo]

I use a hta that i created for our network to do everthing for me and the script uses rmtshare, cacls and xcacls to set permissions.