Environment variables GPP

[mrbios]

Is it possible to create an environment variable using group policy preferences for either display name from active directly, or more ideally, first and last name from within active directory?

 

I'm after a way of pulling the first name and last name from active directory for use as a variable in a folder path, and I'd ideally like to be able to do all this within group policy rather than making custom VB scripts.

[themightymrp]

Don't know if it will let you do this in the environment variables of GPP but this line will get you the display name:

 

for /f "tokens=2*" %%a in ('net user "%Username%" /domain ^| find /i "Full Name"') do set DisplayName=%%b

[mrbios]

What would i change on that line if i wanted %'SN'% and %'givenName'% from AD in the format of Surname, Lastname?

[themightymrp]

Tbh I'm not sure, this line just searches the output of net user %username% /domain for the Full Name line. You can probably get creative and add an expression which splits the output using the space as the divider? Still not sure this would even work in a GPP - have you tried it?

[mrbios]

Yea it wouldn't work in the environment variables section, unless I'm doing something wrong of course.

 

Frustrating really as i wanted to try and keep everything out of a script but it looks like that might be my only option

[mrbios]

Found this:

Set objShell = CreateObject("WScript.Shell")
Set objUserEnv = objShell.Environment("USER")
Set objADSysInfo = CreateObject("ADSystemInfo")
Set objUser = GetObject("LDAP://" & objADSysInfo.UserName)
' This will create the variable %first.last% for the first.lastname
objUserEnv("first.last") = objUser.sn & ", " & objUser.givenName

 

Ran that on my machine fine, and found i could do "echo %last%, %first%" and it'd give me exactly what i want, now i've tried adding that as a user logon script along with a folder creation GPP to create a folder where the path variable contains "%last%, %first%" but it just names the folder "%last%, %first%" and running the echo on the machine shows "echo , " which is strange.

 

Frustrating as i feel like i'm so nearly there

 

EDITED for what i've changed the code to.

 

I get the feeling i need that script to run as an admin on logon

Edited October 8, 2012 by mrbios

[ChrisMiles]

I found this quite interesting so I looked into it and ended up writing this program. I've attached it here for you to use.

 

You can run it on logon script or from group policy to map Active Directory attributes to environment variables.

 

You must run it under the user's context as it uses the current context to get the attributes and uses user environment variables.

 

 

You can run it like this:

 

adtoenv.exe FORENAME=givenName SURNAME=sn

 

Will work with any AD attribute really, although some values are not human readable.

 

Edit: Requires .NET Framework 4 Client Profile, source available on request.

 

Edit 2: Bear in mind while testing, that command prompts don't pick up external changes to env variables until they are closed and reopened, got caught by this when debugging.

ADtoEnv.zip

Edited October 8, 2012 by ChrisMiles

[mrbios]

That's awesome, thanks Chris!

 

Sadly though i can't get it working Everything i do from vbs script to your program draws a blank. When doing an echo for the variables as the logged on user it gives me nothing, and when logging on it's just using the variable names to name the folder rather than the actual variable

[ChrisMiles]

Calling the application from VBscript isn't going to work, as I edited above, command prompts and applications don't pick up changes to environment variables until they are restarted. Since you said you didn't want to use a script, i didn't envisage using the application in that way.

 

You need to run the program independently to set the variables.

 

Can you clarify what you are trying to do? When and how are you trying to use a folder path with environment variables?

[themightymrp]

So how do you run this program independantly without sticking it into a logon script? Just tried running it from the Run command and managed to pull givenName into a %FORENAME% variable

[mrbios]

Calling the application from VBscript isn't going to work, as I edited above, command prompts and applications don't pick up changes to environment variables until they are restarted. Since you said you didn't want to use a script, i didn't envisage using the application in that way.

 

You need to run the program independently to set the variables.

 

Can you clarify what you are trying to do? When and how are you trying to use a folder path with environment variables?

 

I've just made a .bat file to run your program whilst logged on as a typical locked down user and that works fine and the variables work, problem is it won't work for me on logon.

 

The aim here is to have the variables created before the group policy folder creation GPP runs so that it creates a folder on the network for each user in a specific place called "SURNAME, FORENAME"

 

EDIT: oh the vbscript part i was on about was the script i was using prior to testing your program by the way

[ChrisMiles]

So how do you run this program independantly without sticking it into a logon script? Just tried running it from the Run command and managed to pull givenName into a %FORENAME% variable

 

Run it from a dedicated login script, but how you manage the execution order, I'm not too sure.

[ChrisMiles]

I've just made a .bat file to run your program whilst logged on as a typical locked down user and that works fine and the variables work, problem is it won't work for me on logon.

 

The aim here is to have the variables created before the group policy folder creation GPP runs so that it creates a folder on the network for each user in a specific place called "SURNAME, FORENAME"

 

EDIT: oh the vbscript part i was on about was the script i was using prior to testing your program by the way

 

Thats not going to work, im pretty sure login scripts run after all the stuff. Let me think about it...

[mrbios]

Thats not going to work, im pretty sure login scripts run after all the stuff. Let me think about it...

 

I guess my only other option would be to have the bat file i run your ADtoENV program in also create the folders / call up another bat file to create the folders?

[ChrisMiles]

Ok Plan B....

 

This application will read attributes from the current user context...

 

Use it like this to create your folder...

 

for /f %a in ('GetADAttributes.exe givenName') do for /f %b in ('GetADAttributes.exe sn') do mkdir "C:\%b, %a"

GetADAttributes.zip

[mrbios]

Fails to run for some reason, is the syntax correct there?

 

EDIT: it doesn't like the %a

 

EDIT2: ok works fine if i run it manually but doesn't run from a script, this is frustrating.

 

EDIT3: when running it in a command prompt window manually it runs like this:

C:\>for /f %a in ('C:\GetADAttributes.exe givenName') do for /f %b in ('C:\GetADAttributes.exe sn') do mkdir "C:\%b, %a"

C:\>for /F %b in ('C:\GetADAttributes.exe sn') do mkdir "C:\%b, FIRSTNAME"

C:\>mkdir "C:\LASTNAME, FIRSTNAME"

 

the first line is the line i execute, the next two are something it's doing on its own.

Edited October 8, 2012 by mrbios

[ChrisMiles]

Fails to run for some reason, is the syntax correct there?

 

EDIT: it doesn't like the %a

 

EDIT2: ok works fine if i run it manually but doesn't run from a script, this is frustrating.

 

EDIT3: when running it in a command prompt window manually it runs like this:

C:\>for /f %a in ('C:\GetADAttributes.exe givenName') do for /f %b in ('C:\GetADAttributes.exe sn') do mkdir "C:\%b, %a"

C:\>for /F %b in ('C:\GetADAttributes.exe sn') do mkdir "C:\%b, FIRSTNAME"

C:\>mkdir "C:\LASTNAME, FIRSTNAME"

 

the first line is the line i execute, the next two are something it's doing on its own.

 

If i copy and past that into a command prompt exactly as is it work fine, creating a folder in my C drive called "Miles, Chris".

[mrbios]

If i copy and past that into a command prompt exactly as is it work fine, creating a folder in my C drive called "Miles, Chris".

 

That's precisely what i get though, copying it into a command prompt works fine. Try sticking it in a .bat file and it won't as the batch file only runs the first line and forgets about the second two that are manually created in an open command prompt.

[ChrisMiles]

Fails to run for some reason, is the syntax correct there?

 

EDIT: it doesn't like the %a

 

EDIT2: ok works fine if i run it manually but doesn't run from a script, this is frustrating.

 

EDIT3: when running it in a command prompt window manually it runs like this:

C:\>for /f %a in ('C:\GetADAttributes.exe givenName') do for /f %b in ('C:\GetADAttributes.exe sn') do mkdir "C:\%b, %a"

C:\>for /F %b in ('C:\GetADAttributes.exe sn') do mkdir "C:\%b, FIRSTNAME"

C:\>mkdir "C:\LASTNAME, FIRSTNAME"

 

the first line is the line i execute, the next two are something it's doing on its own.

 

Does it create a folder at all? Can you paste your script exactly as is?

[ChrisMiles]

OK it doesnt work for me in a batch file either.... let me look at it.

[ChrisMiles]

OK stupid problem, in a batch file you have to escape the variables like this:

 

for /f %%a in ('GetADAttributes.exe givenName') do for /f %%b in ('GetADAttributes.exe sn') do mkdir "C:\%%b, %%a"

[mrbios]

OK stupid problem, in a batch file you have to escape the variables like this:

 

for /f %%a in ('GetADAttributes.exe givenName') do for /f %%b in ('GetADAttributes.exe sn') do mkdir "C:\%%b, %%a"

 

*FACEPALM* sorry it's been a long day, works now haha

 

Thanks for all your help Chris, you've been fantastic, next on my agenda i need to make some sort of system for moving all files from location 1 to location 2 and renaming them all to include XXXX_ at the beginning of each file name ............ but that's a job for tomorrow lol

 

EDIT: oh..i'd forgotten about the fun part that is the login scripts, even though we have something working when run from the desktop, i now need to get it working when run on logon, which currently it doesn't appear to EDIT AGAIN: didn't appear to because i was being stupid, works fine now

Edited October 8, 2012 by mrbios

[sonofsanta]

FWIW, you can run programs at logon without using a script by GPO: user config > policies > admin templates > system > logon > run these programs at user logon. Has the advantage of launching the program once the desktop is shown, so doesn't slow logon times down; I actually use it to run a VBS, still, but one that takes ten seconds and hangs logon at "preparing your desktop" if it's run as a logon script.