Drive Mapping Problem 2

[Electro121]

Hi All,

I've created a basic script that tries to map a drive based on group membership as well as a user home drive mapping. The script runs fine under my account (domain admin acount) but not so well under regular domain user account. I don't think the problem is specifically with the script but thought someone may have an idea here...

I've put my account and the test user account into a test OU and applied a group policy to run the script. Again, the script runs under both my account and the test user account. Only my account does all the mappings and the test user does not. The test user only maps the home drive mapping and not the group drive mapping. The user is in the correct group as specified in the script. I suspect it to be a permissions issue somewhere but can't seem to track it down. As soon as I put my test user in the domain admin group all the mappings work fine.

My active directory has authenticated users set to read all objects. I've also tried granting authenticated users full permissions on the AD tree but still no luck.

HELP!!!

Darryl

The script as follows:

'==========================================================================
'
' NAME: LogonScript.vbs
'
' AUTHOR: Darryl Brambilla
' DATE : 6/13/2005
'
' COMMENT:
'
'
'==========================================================================

On Error Resume Next

'==========================
'Setup Variables to be used
'==========================

Dim WSHShell, objSysInfo, objNetwork, objUser, objGroup


'=================================
'Synchronizes the time with Server
'=================================

Set WSHShell = CreateObject("WScript.Shell")
WSHShell.Run "NET TIME \\server1 /set /y"


'===================================
'Map Drive based on group membership
'===================================

Set objSysInfo = CreateObject("ADSystemInfo")
Set objNetwork = CreateObject("Wscript.Network")

strUserPath = "LDAP://" & objSysInfo.UserName
Set objUser = GetObject(strUserPath)

For Each strGroup in objUser.MemberOf
strGroupPath = "LDAP://" & strGroup
Set objGroup = GetObject(strGroupPath)
strGroupName = objGroup.CN

Select Case strGroupName
Case "Group1"
objNetwork.MapNetworkDrive "X:", "\\server1\groupshare1"

Case "All-Users"
objNetwork.MapNetworkDrive "P:", "\\Server2\public"

End Select
Next

'==============
'Map User Drive
'==============
strHomeServer="\\Server3\"
strUserName = objNetwork.UserName
strUserNameFull = strUserName & "$"
objNetwork.MapNetworkDrive "u:", strHomeServer & strUserNameFull

'=======================
'Clean Up Memory We Used
'=======================

set WSHShell = Nothing
set objSysInfo = Nothing
set objNetwork = Nothing
set objUser = Nothing
set objGroup = Nothing

'===============
'Quit the Script
'===============

wscript.quit

 

[aco636]

I'm no expert, but I would suggest adding a bit of error checking or remove the "On Error Resume Next" just for a test and find out where it falls over.

I know when I ref AD I have my domain in LDAP statement.

Sorry I cant be of more help. Too hot to concentrate
Regards ACO

 

[Electro121]

Hi ACO,

Thanks anyways however like I said there is no error really asthe script does process. The script works if they belong to the domain admins group but a regular domain user account just does not work. The map drive section is not processed.

I'm really stuck here...

Darryl

 

[Electro121]

Hi ACO,

I tried removing the On Error Resume Next like you indicated.

When I am logged in as the user that has "domain admin" privleges the script runs fine with no errors. When I am logged in with the user with "Domain Users" permissions I get an error. The error is:

Error: Object not a collection
Code: 800A01C3
Source: Microsoft VBScript runtime error

The line it is referring to is this line in my script:

For Each strGroup in objUser.MemberOf

From what I have read on the net it appears that this error is some form of Syntax error? However, I am trying to understand how the syntax is wrong when it works for a user with Domain Admins and not this user with Domain User access? Strange!

Thanks,

Darryl

 

[AntiEarnie]

Silly question but does security have List Folder Contents allowed? Also not sure if this is an issue with you or not but I had problems working with AD on my servers because of a delay in the AD settings getting pushed out. From time to time it appeared to take several minutes for the changes to propigate. Made troubleshooting, erratic...

 

[Electro121]

Hey AE,

Thanks for the reply - yep, list contents are allowed. ANd yes, replication can cause some serious issues when you are trying to fix the problem NOW

I think I'm getting close...just can't quite see the end of the tunnel yet...someone turn on the light!



Thanks!

Darryl

 

[keybrdcowboy]

Here's the script I use for this. Might be a little different, but check it out....

Option Explicit 
Dim WSHNetwork, FSO, strUserName, strUserDomain, ObjGroupDict, EnvVar, strVarUserName


Set WSHNetwork = WScript.CreateObject("WScript.Network")
Set EnvVar = WScript.CreateObject("WScript.Shell")
Set FSO = CreateObject("Scripting.FileSystemObject")
strVarUserName = EnvVar.ExpandEnvironmentStrings("%username%")


' Wait until the user is really logged in...

strUserName = ""
While strUserName = ""
WScript.Sleep 100 
strUserName = WSHNetwork.UserName
Wend
strUserDomain = WSHNetwork.UserDomain

' Map all common drives for everyone
If FSO.DriveExists("S:") Then
  WSHNetwork.RemoveNetworkDrive "s:"
  WSHNetwork.MapNetworkDrive "s:", "\\myserver\shared"
Else 
  WSHNetwork.MapNetworkDrive "s:", "\\myserver\shared"
End If

If FSO.DriveExists("X:") Then
  WSHNetwork.RemoveNetworkDrive "x:"
  WSHNetwork.MapNetworkDrive "x:", "\\myserver\projects"
Else 
  WSHNetwork.MapNetworkDrive "x:", "\\myserver\projects"
End If

If FSO.DriveExists("Y:") Then
  WSHNetwork.RemoveNetworkDrive "y:"
  WSHNetwork.MapNetworkDrive "y:", "\\myserver\admin"
Else 
  WSHNetwork.MapNetworkDrive "y:", "\\myserver\admin"
End If

If FSO.DriveExists("Z:") Then
  WSHNetwork.RemoveNetworkDrive "z:"
End If

' Read the user's account "Member Of" tab info across the network
' once into a dictionary object. 

Set ObjGroupDict = CreateMemberOfObject(strUserDomain, strUserName)

If MemberOf(ObjGroupDict, "pki users") Then
  WSHNetwork.MapNetworkDrive "z:", "\\myserver\" & strVarUserName & "$"
Else
  WSHNetwork.MapNetworkDrive "z:", "\\myserver\" & strVarUserName & "$" 
End If

If MemberOf(ObjGroupDict, "pki users") Then
  If FSO.DriveExists("V:") Then
    WSHNetwork.RemoveNetworkDrive "v:"
    WSHNetwork.MapNetworkDrive "v:", "\\myserver\ipt_groups"
  Else 
    WSHNetwork.MapNetworkDrive "v:", "\\myserver\ipt_groups"
  End If
End If  

If MemberOf(ObjGroupDict, "pki system admin") Then
  If FSO.DriveExists("n:") Then
    WSHNetwork.RemoveNetworkDrive "n:"
    WSHNetwork.MapNetworkDrive "n:", "\\myserver\techadmin$"
  Else 
    WSHNetwork.MapNetworkDrive "n:", "\\myserver\techadmin$"
  End If   
End If

If MemberOf(ObjGroupDict, "pki funding") Then
  If FSO.DriveExists("p:") Then
    WSHNetwork.RemoveNetworkDrive "p:"
    WSHNetwork.MapNetworkDrive "p:", "\\myserver\funding$"
  Else 
    WSHNetwork.MapNetworkDrive "p:", "\\myserver\funding$"
  End If 
End If

If MemberOf(ObjGroupDict, "pki funding readonly") Then  
  If FSO.DriveExists("p:") Then
    WSHNetwork.RemoveNetworkDrive "p:"
    WSHNetwork.MapNetworkDrive "p:", "\\myserver\funding$"
  Else 
    WSHNetwork.MapNetworkDrive "p:", "\\myserver\funding$"
  End If    
End If

If MemberOf(ObjGroupDict, "class_users") Then
  If FSO.DriveExists("q:") Then
    WSHNetwork.RemoveNetworkDrive "q:"
    WSHNetwork.MapNetworkDrive "q:", "\\myserver\s"
  Else 
    WSHNetwork.MapNetworkDrive "q:", "\\myserver\s"
  End If   
End If

If MemberOf(ObjGroupDict, "ccdiv") Then
  If FSO.DriveExists("w:") Then
    WSHNetwork.RemoveNetworkDrive "w:"
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\cc"
  Else 
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\cc"
  End If  
End If

If MemberOf(ObjGroupDict, "diwdiv") Then
  If FSO.DriveExists("w:") Then
    WSHNetwork.RemoveNetworkDrive "w:"
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\diw"
  Else 
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\diw"
  End If  
End If

If MemberOf(ObjGroupDict, "endiv") Then
  If FSO.DriveExists("w:") Then
    WSHNetwork.RemoveNetworkDrive "w:"
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\en"
  Else 
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\en"
  End If  
End If

If MemberOf(ObjGroupDict, "lgdiv") Then
  If FSO.DriveExists("w:") Then
    WSHNetwork.RemoveNetworkDrive "w:"
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\lg"
  Else 
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\lg"
  End If  
End If  

If MemberOf(ObjGroupDict, "madiv") Then
  If FSO.DriveExists("w:") Then
    WSHNetwork.RemoveNetworkDrive "w:"
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\ma"
  Else 
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\ma"
  End If  
End If    

If MemberOf(ObjGroupDict, "rmdiv") Then
  If FSO.DriveExists("w:") Then
    WSHNetwork.RemoveNetworkDrive "w:"
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\rm"
  Else 
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\rm"
  End If  
End If

If MemberOf(ObjGroupDict, "zidiv") Then
  If FSO.DriveExists("w:") Then
    WSHNetwork.RemoveNetworkDrive "w:"
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\zi"
  Else 
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\zi"
  End If  
End If

If MemberOf(ObjGroupDict, "zjdiv") Then
  If FSO.DriveExists("w:") Then
    WSHNetwork.RemoveNetworkDrive "w:"
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\zj"
  Else 
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\zj"
  End If  
End If      

If MemberOf(ObjGroupDict, "zxdiv") Then
  If FSO.DriveExists("w:") Then
    WSHNetwork.RemoveNetworkDrive "w:"
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\zx"
  Else 
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\zx"
  End If  
End If      

If MemberOf(ObjGroupDict, "army") Then
  If FSO.DriveExists("w:") Then
    WSHNetwork.RemoveNetworkDrive "w:"
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\army"
  Else 
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\army"
  End If  
End If      

If MemberOf(ObjGroupDict, "srio") Then
  If FSO.DriveExists("w:") Then
    WSHNetwork.RemoveNetworkDrive "w:"
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\srt"
  Else 
    WSHNetwork.MapNetworkDrive "w:", "\\myserver\srt"
  End If  
End If      



Function MemberOf(ObjDict, strKey)
  ' Given a Dictionary object containing groups to which the user
  ' is a member of and a group name, then returns True if the group
  ' is in the Dictionary else return False. 
  '
  ' Inputs:
  ' strDict - Input, Name of a Dictionary object
  ' strKey - Input, Value being searched for in
  ' the Dictionary object
  ' Sample Usage:
  '
  ' If MemberOf(ObjGroupDict, "DOMAIN ADMINS") Then
  ' wscript.echo "Is a member of Domain Admins."
  ' End If
  '
  '
  MemberOf = CBool(ObjGroupDict.Exists(strKey))
End Function

Function CreateMemberOfObject(strDomain, strUserName)
  ' Given a domain name and username, returns a Dictionary
  ' object of groups to which the user is a member of. 
  '
  ' Inputs:
  '
  ' strDomain - Input, NT Domain name
  ' strUserName - Input, NT username
  '
  Dim objUser, objGroup
  Set CreateMemberOfObject = CreateObject("Scripting.Dictionary")
  CreateMemberOfObject.CompareMode = vbTextCompare
  Set objUser = GetObject("WinNT://" & strDomain & "/" & strUserName & ",user")
  For Each objGroup In objUser.Groups
  CreateMemberOfObject.Add objGroup.Name, "-"
  Next
  Set objUser = Nothing
End Function

 

[Electro121]

Hey Keybrdcowboy,

Thanks for the script and although it's not quite what I am looking for it will help with some future development!

I did figure out my problem just a few hours ago though!!! It turns out that the testuser I created is a domain user. The user belonged to 2 groups - the Domain Users and Group1.

Group1 is a Global DISTRIBUTION group - not a Global SECURITY group. For some strange reason if the user was not a member of any other Global Security group (besides the Domain Users default) then the script would not map the drives based on the group membership!!! However, as soon as I aded the user to any other Global Security group the whole script runs like a charm!

So, the good news is I figured out the problem and the fix. The bad news is that I have no concrete explanations as to "WHY" this works this way! Does anyone else have the answer?

Thanks!

Darryl