Help with Scripts to create Share folder per User and create permissions for it

[zooroo44]

HI all i have Project to my college and i need help on some Scripts to Create 1000 User and make "share folder"

with the User name for each User of them and set the permissions for it "user only one can see/read/write this Folder and + Administrator Account

and make the user change the password at the First login

I can't write Scripts i can read it only if any one help me with a specifically Scripts to do that not a lot of things and i can't understandably

cheers

Edited June 26, 2011 by zooroo44

[zooroo44]

any help ?????

[Jose]

ntfsfix from wisesoft, google it

[3s-gtech]

NTFSfix with cacls.exe (command line) to fix ownership. Just set the root folder as the share, with permissions appropriately set. NTFS will take care of the rest.

[themightymrp]

I think you are after something like this.

 

I wrote this myself and have modified it numerous times over the years. I have added comments into the script to make reading easier.

 

This basically parses a "users.csv" file which contains surname, forename, year of entry, username. The details are contained within the script. I create the username in Excel using the Concatenate command, such as =concatenate("2011",a1,left(b1,1)) which would give 2011SmithN for example.

 

The script creates the account, sets user group and default password of "password". Enables the 'must change at first logon', creates the users home drive and shares it and sets permissions.

 

You get the idea, have a look and see what you can follow

MultiUser.vbs

[zooroo44]

i don't know what to say Thanks you all of you bros you help me so much

[themightymrp]

No worries, post back if you are having problems

[zooroo44]

I think you are after something like this.

 

I wrote this myself and have modified it numerous times over the years. I have added comments into the script to make reading easier.

 

This basically parses a "users.csv" file which contains surname, forename, year of entry, username. The details are contained within the script. I create the username in Excel using the Concatenate command, such as =concatenate("2011",a1,left(b1,1)) which would give 2011SmithN for example.

 

The script creates the account, sets user group and default password of "password". Enables the 'must change at first logon', creates the users home drive and shares it and sets permissions.

 

You get the idea, have a look and see what you can follow

i read the Script i understand a lot of it But

 

' Create H drive folder based on account name

this is what i'm looking for

 

' Use "psexec" to launch the NET SHARE command on the server in order to

' create a share with Everyone group having Full Control (like Win2000/2003)

i need to make every one has full control on his Folder only

 

'Use xcacls to set NTFS permissions on the H drive folder

i don't know how to use xcacls To set the permissions

 

 

 

 

Year of entry (or the word staff)

 

can i replace staff with another word like First Third ete..

 

Create the User account in the correct OU

if i replace this line with my data As this

Set objOU = GetObject("LDAP://OU=" & strYearEntry & ",OU=First year,dc=HICISschool,dc=local")

this make the users in Ou called "Firstyear" in the Domain called"HICISschool.local"

objUser.Put "profilePath", "\\gateway2\staffpro$\profiles\" & strUserName

 

this "profilePath" in the Server Called gateway2 so if my server call Web1

it willbe like that ?

 

objUser.Put "profilePath", "\\web2\staffpro$\profiles\" & strUserName

 

' Provide message to user to remind about printer credits

 

we didn't have printer rights for the Srudents can remove this part to

"objTextFile.Close"

and about the permissions

i need to make every one has full control on his Folder only

 

thanks for your time and help

[themightymrp]

OK lets tackle these questions.

 

The psexec.exe tool allows me to run command line commands as though I were on the server directly. For example if I type "psexec server1 makedir c:\folder" it would create a folder called 'folder' in the root of the C: drive on the server, not my local PC. I can upload this file if you need it, I can't remember where I got it now? Somewhere on Microsoft.com

 

Secondly, you want to allow the user to have full control over their folder but no-one else right? It's up to you how secure you want things. I usually have the share set to have 'EVERYONE' with full control but then tie down the security by using NTFS permissions. To do this, the command is:

 

net share [i]sharename[/i]=[i]PathToFolder[/i] /GRANT:Everyone,FULL /Unlimited

 

Which would look something like this when filled in:

 

net share Phil=e:\userfolders\Phil /GRANT:EVERYONE,FULL /UNLIMITED

 

The /Unlimited sets how many concurrent connections can be made to the share. To modify this so that only the specific user has full control (remember domain admins may like to be included?), using the syntax from my script it would be:

 

Set objShell = Createobject("WScript.Shell")
strShare1 = "net share "
strShare2 = "=e:\userfolders\"
strShare3 = " /GRANT:"
strShare4 = ",FULL /Unlimited"
objShell.Run "cmd"
objShell.SendKeys strShare1 & strUserName & strShare2 & strUserName & strShare3 & strUsername & strShare4
objShell.SendKeys "{ENTER}"

 

Note how I have had to build the command line up using variables as I am calling bacth file commands from a VBscript. It's a little more awkward and to be honest, there is probably a neater way of doing it. But for me this works just fine so why change it?

 

 

Next thing, xcacls. You can use the /? at the command prompt to get more detail out of this but a general line might look like this:

 

xcacls [i]path to userfolder[/i] /T /E /C /G [i]username[/i]:F

 

To explain, /T changes the permissions on the folder and any subdirectories/files.

/E is to edit the permissions instead of replacing them. You may want to leave this switch out?

/C is to continue on errors. Theres nothing worse than halfway through a script which takes an hour to run (creating 1000 users) a bloody error comes up and cancels the script! This makes it just continue.

/G Grants permissions to whichever user or group you want. :F is full control, :C is Change and :R is read and execute

 

Yes you can replace 'staff' with 'first year' or 'third year' or whatever else you want. It's just the name of the OU containing the users. Proof read all your script to make sure things are in the right place!

 

Yes you can change the server to Web1 instead of Gateway2, thats just the name of our server. Its a poor choice of name as people get confused with Default Gateway in IP settings!

 

Finally, the bit about print credits is just a reminder for me as we use software called PCounter to allocate a certain amount of prints per user per month.

 

Any more help just ask

[zooroo44]

thanks for your fast answer i trying to modify the script and i will keep you poster with the news

[alunmjones]

this is something i want to do aswell, was going to write my own, is it ok if i use yours as a basis for mine? dont want to spend the day on it like last year

[zooroo44]

Set UserObj = GetObject("WinNT://"& domain &"/" & strUserName & "")

If err.number = 0 Then

 

i'm on 2008 sever why do you use winNT connect method not The Ldap sorry i'm not very good with scripting and understand that Ldap is the connect method for ADSI so is it valid to use Ldap in exchange for WinNT or WINNT connect method is supported in 2008

[zooroo44]

now i nearly edited the script fully to support my domain "thanks for that" but i run to a few syntax problem @ sub routines for closing boxes and script validation

i hope u can help revise the script and tell me what went wrong ......:eek:

MultiUser.vbs

Edited June 27, 2011 by zooroo44

[themightymrp]

this is something i want to do aswell, was going to write my own, is it ok if i use yours as a basis for mine? dont want to spend the day on it like last year

 

Use it as you like, there's no royalty on it

[themightymrp]

Set UserObj = GetObject("WinNT://"& domain &"/" & strUserName & "")

If err.number = 0 Then

 

i'm on 2008 sever why do you use winNT connect method not The Ldap sorry i'm not very good with scripting and understand that Ldap is the connect method for ADSI so is it valid to use Ldap in exchange for WinNT or WINNT connect method is supported in 2008

 

I used the WinNT method because when I originally wrote the script we were on Windows 2000 Server. We are now on 2008 but the script still works so I never changed it. I don't see why you couldnt use ldap. I will look at your script and get back to you.

[themightymrp]

OK, here is a modified version of your script.

 

Look through it, I have added 'EDIT -- notes through for where I've changed things. Most of the problems were down to an extra speechmarks in one line.

 

A point of note, is your network domain hicis.local OR hicis.com?? You are inconsistent in the script so these need to be checked and altered correctly. I have also changed a few bits that are specific to our network that you don't need.

 

Double check your group names and OU structure as it may not match ours.

 

Also, are you using a good editor for this? Such as Dreamweaver or Notepad+ ? These tools colour code the script and make it much easier to spot errors. For example, the extra speechmarks was a quick spot as everything below it was green in stead of a mix of colours.

 

Have a look and see if you can follow it

EditedMultiUser.vbs

[themightymrp]

@zooroo44 how are you getting on?

[zooroo44]

 

The Script is working and tell me that so fare so good but in the AD

 

 

 

this is the only user created

and in File Share "Web" there is no folder Created in "C:\e\student"

 

 

i Attach the file i use

and thanks for help

users FINAL.rar

Edited June 28, 2011 by zooroo44

[zooroo44]

Now i Made the necessary adjustments on the servers and made the hidden shares and all set but i get permission error while the script running i checked the Active directory btw the way i use test VMS to run the script on and i made the share's on C drive , the user is created and added to group but it stops on line 136 "the line that creates the folders" i removed the read only form the folder and i checked i m running the script with admin credit

So i need you to check with me again on the creating and sharing part of the script.

[zooroo44]

i try some thing else and this is the result

 

and this is copy of the Script after all thing

it Create First user jojo.dem and make the Share folder on "Web" but stop like you see in there

 

thanks for your time

[themightymrp]

Any chance you can post your lastest version of the script on here? Mediafire is blocked at our school by the LEA Just click the 'Go Advance' button at thye bottom right and you can add attachments.

 

Cheers

 

Oh and well done for getting this far!

[zooroo44]

This is the Script

3333333333333..vbs

[themightymrp]

OK, I have made a couple of small changes.

 

At lines 156 and 157 you are adding share permissions for EVERYONE with Full Control and ADMINISTRATORS with Full Control. Only the EVERYONE part is needed in this instance as the Administrators are part of the EVERYONE group. I have removed the extra bits.

 

Secondly, on lines 99 and 114 you have the word 'profilf$' - should this say 'profile$' ? I didn't change it in case it was on purpose.

 

The rest of the script looks right. The error message at the end of your video is to do with trying to find another line in the CSV file. Do you have a blank line in the file anywhere? If not, try it with 2 test accounts in the CSV instead of just 1. My early versions of the script had a problem with having an odd number of people but worked fine with even numbers. The problem may have resurfaced here?

 

If you have any other problems with permissions then it is likely to be the permissions on the drive f$ as opposed to a problem in the script. Just check it.

 

One last thing, are your OU's set up the same as mine? I have once called 'Network Users' and within that I have a 'Students' and 'Staff' OU. Within the students OU is a seperate one for each year group. You may need to make some alterations to match your exact setup. Also, there is still a mention in the script of the security group 'staffsnap'. You WON'T have this, it is unique to our system as we used to have something called a SNAP Server.

 

Cheers

3333333333333..vbs

[zooroo44]

Hello man I can't say how much you help me

Finally the Script is Worked there were a same name in all users "jojo" when I change it to deferent names

The Script work like magic :D

BUT :(

Fist of all the Users is not in the Domain I don't know why and this is Account like in photo A

and when I try to log in with any user after I complete his information it can't access the Profile folder

I don't know why

this is the Share folder look's like in The "Web" server and Can I make the Script make a map Drive to

the share folder for the Users I will make 1000 user it can't be I will Put the Map drive manual and I need to

set the permission on the Share folder to the User who own the folder and Admin only

sorry your time I appreciate it so much

Thanks a lot

I attach The final Ver of The Script and the Users file

 

VIS2.vbs

 

Thanks a lot

[themightymrp]

Ah, this is an easy fix

 

Looking at your screenshots you have got the profile path and the homedrive path pointing to 2 shares at once!

 

You have for the profile path:

 

\\web\f$\profile$\username

 

You are referencing the f$ share AND the profile$ share which you cant do. I have edited the script to reflect this. It should now create a profile path of:

 

\\web\profile$\username.

 

In a similar way, the homedrive path you have is:

 

\\web\f$\student\first\username$

 

Now I have edited your script it will make it:

 

\\web\username$

 

Once the homedrive path is correct it will automatically map your homedrive for you without any further changes

 

Note, if you are running the script with a username you have tested with previously, you must first make sure the account has been deleted and also make sure the profile folder and the home share folder are deleted!! Otherwise it will cause an error if the folders already exist.

 

Cheers

EditedVIS2.vbs