Block moving users' roaming profiles

[Norwich]

Hi,

Currently, all user profiles are set in the user manager to user directories on the PDC. Similarly, they each have a private 'P:' drive mapped to a share on the PDC.

Eg:

on the profiles tab:
####################################################

User Profile Path: \\servername\users\j.doe\profile

Home Directory:

Connect P: \\servername\users\j.doe

###################################################

I'm planning to replace the PDC - see previous post - but in case it doesn't work properly, is the a method to alter all users profile and home directory mappings to reference a different server en masse?

Also, could this be done without alteration to the client's PCs (100 w2k boxes)?

Thanks

 

[browolf]

You could use a windows scripting host script to alter the user details.

You could do this before taking "bob" offline.

copy the user areas to another server using scopy (scopy copies permissions as well)

export the registry key with all the shares in and import this on the other server.

write a wsh script to alter the details in user manager.

All this would make the job take longer but at least all your userareas would be safe.

===============
Security Forums

http://www.security-forums.com

 

[Norwich]

Thanks,

Do you know a good online reference for WSH? or where the appropriate registry key's may be?

 

[browolf]

the shares are at hklm\system\currentcontrolset\services\lanman\server

For wsh i learnt by using the chm compiled help files. one for vbscript and one for wsh

vbscript:

http://msdn.microsoft.com/scripting/vbscript/download/vbsdoc.exe

wsh

http://home.no.net/gfjakobs/kurs/WSH.CHM

I have a script for creating users. i will paste some of it to help you.

'create the user
set UsrObj = DomObj.create("user", username)
UsrObj.fullname = name
UsrObj.description = "year starting 2002"
UsrObj.LoginScript = "ntpupils.bat"
UsrObj.HomeDirectory = userarea
UsrObj.setinfo
'set password
call UsrObj.setpassword(password)

'get flags
flagset = UsrObj.Get("UserFlags&quot
'user cannot change password
UsrObj.Put "UserFlags", flagset OR &H00040
'password never expires
UsrObj.Put "UserFlags", flagset OR &H10000
'set homedirectory drive
UsrObj.Put "HomeDirDrive", "z"
set UsrObj = nothing

'add user to group
Set objGroup = GetObject("WinNT://academic/2002&quot
objGroup.Add "WinNT://academic/" & Username & ""
set objgroup = nothing


'verify username
Set DomObj = GetObject("WinNT://academic&quot
'check for conflicts
for each obj in DomObj
if lcase(obj.name) = lcase(username) then
'user exists
set logfso = CreateObject("Scripting.FIleSystemObject&quot
set tslog = logfspenTextFile("userdone.csv", ForAppending)
tslog.writeline username & "," & password & "," & name & "," & uform
tslog.close
set logfso = nothing
end if
next
set DomObj = nothing

accessing user info is thru a thing called ADSI. I used this website as reference to make my script dont be put off by the fact it talks about win2k, its the same for winnt

Learning ADSI - Part 2: Editing Users and Administering Groups

http://www.15seconds.com/issue/011127.htm

===============
Security Forums

http://www.security-forums.com

 

[Norwich]

Many thanks