Автор: mptv
Дата сообщения: 13.07.2009 08:37
Добрый день!
помогите отредактировать строки в скрипте, под свою организацию. Необходимо выполнить скрипт с правами в исходной организации. В теле скрипта внести изменения в части пути к службе каталогов.
подскажите в какую часть скрипта внести изменения?
[more=Скрипт]Option Explicit
Dim strFilePath, objFSO, objFile, objConnection, objCommand
Dim strDNSDomain, strFilter, strQuery, objRecordSet
Dim strUserDN, objUser, strTrustedDomain
Dim intTotal, intNotChange
' Specify the log file. This file will be created if it does not
' exist. Otherwise, the program will append to the file.
strFilePath = "c:\Scripts\Exchange\ChangeUsers.log"
' Open the log file for write access. Append to this file.
Set objFSO = CreateObject("Scripting.FileSystemObject")
On Error Resume Next
Set objFile = objFSO.OpenTextFile(strFilePath, 8, True, 0)
If Err.Number <> 0 Then
On Error GoTo 0
objFile.WriteLine "File " & strFilePath & " cannot be opened"
Set objFSO = Nothing
Wscript.Quit
End If
On Error GoTo 0
' Use ADO to search the domain
Set objConnection = CreateObject("ADODB.Connection")
Set objCommand = CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOOBject"
objConnection.Open "Active Directory Provider"
Set objCommand.ActiveConnection = objConnection
' Filter to retrieve all users objects.
strFilter = "(objectCategory=user)"
strDNSDomain = "<LDAP://OU=test,DC=Ad2000,DC=ru>;"
strTrustedDomain= "AD2003"
' Retrieve Distinguished Name and date password last set.
strQuery = strDNSDomain & strFilter _
& ";distinguishedName,pwdLastSet;subtree"
objCommand.CommandText = strQuery
objCommand.Properties("Page Size") = 100
objCommand.Properties("Timeout") = 30
objCommand.Properties("Cache Results") = False
' Write information to log file.
objFile.WriteLine "Start: " & Now
objFile.WriteLine "Base of search: " & strDNSDomain
objFile.WriteLine "Log File: " & strFilePath
objFile.WriteLine "----------------------------------------------"
' Initialize totals.
intTotal = 0
intNotChange = 0
' Enumerate all Users and determine which are inactive.
Set objRecordSet = objCommand.Execute
Do Until objRecordSet.EOF
strUserDN = objRecordSet.Fields("distinguishedName")
intTotal = intTotal + 1
If Add_ACE_Mailbox (strUserDN) Then
Add_ACE_ADUser (strUserDN)
End If
objRecordSet.MoveNext
Loop
' Write totals to log file.
objFile.WriteLine "Finished: " & Now
objFile.WriteLine "Total User objects found: " & intTotal
objFile.WriteLine "No change User objects found: " & intNotChange
objFile.WriteLine "----------------------------------------------"
' Clean up.
objFile.Close
objConnection.Close
Set objFile = Nothing
Set objFSO = Nothing
Set objConnection = Nothing
Set objCommand = Nothing
Set objRecordSet = Nothing
Set objUser = Nothing
Wscript.Echo "Script complete"
'//////////////////////////////////////////////////////////////////////////////////
'// Function: Add Read & Send As permissions to the new User object
'//
'// Purpose: This code will add a (trusted) external user account to the ACE
'// list with Read & Send As permission
'//
'// Input: strUser = the User object that needs to have its ACL changed
'//
'// Returns: True if the ACE addition was succesful.
'/////////////////////////////////////////////////////////////////////////////////
Function Add_ACE_ADUser(strADUser)
On Error Resume Next
Dim oUser
Dim oSecurityDescriptor
Dim dacl
Dim ace
Dim strExternalAccount
Add_ACE_ADUser = False
Set oUser = GetObject ("LDAP://" & strADUser)
Set oSecurityDescriptor = oUser.Get("ntSecurityDescriptor")
Err.Clear
' Get user NTName and set ExternalAccountName
strExternalAccount= oUser.sAMAccountName
strExternalAccount= strTrustedDomain + "\" + strExternalAccount
' Extract the Discretionary Access Control List (DACL) using the IADsSecurityDescriptor.
' Interface.
Set dacl = oSecurityDescriptor.DiscretionaryAcl
Set ace = CreateObject("AccessControlEntry")
' Template: AddAce(TrusteeName, gAccessMask, gAceType, gAceFlags, gFlags, gObjectType, gInheritedObjectType)
AddAce dacl,strExternalAccount,&H20014,0,0,1,0,0 '&H20014 -> gives Read permissions
AddAce dacl,strExternalAccount,&H100,5,0,1,"{AB721A54-1E2F-11D0-9819-00AA0040529B}",0 '&H100 & the string -> enables the Send As permissions
' Add the modified DACL to the security descriptor.
oSecurityDescriptor.DiscretionaryAcl = dacl
' Save new SD onto the user.
oUser.Put "ntSecurityDescriptor",Array(oSecurityDescriptor)
' Commit changes from the property cache to the information store.
On Error Resume Next
oUser.SetInfo
If Err.Number <> 0 Then
objFile.WriteLine "ERR: Failed to give the 'Read' & 'Send As' permissions to the account: " & Err.Description & "(" & Err.Number & ")."
If Err.Number = -2147023559 Then
objFile.WriteLine "ERR: The External account " & strExternalAccount & " probably doesn't exist."
End If
Add_ACE_ADUser = False
Exit Function
End If
Add_ACE_ADUser = True
objFile.WriteLine "Done AD set for " & strADUser
'Clean up
Set oUser = nothing
Set oSecurityDescriptor = nothing
End Function
'//////////////////////////////////////////////////////////////////////////////////
'// Function: Adds Read, Full mailbox access & Associate Extenal Account
'// permissions to the new User object
'//
'// Purpose: This code will add a (trusted) external user account to the ACE
'// list with Read, Full mailbox access & Associate Extenal Account
'// permission
'//
'// Input: strUser = the User object that needs to have its ACL changed
'//
'// Returns: True if the ACE addition was succesful.
'/////////////////////////////////////////////////////////////////////////////////
Function Add_ACE_Mailbox(strADUser)
On Error Resume Next
Dim oUser
Dim oSecurityDescriptor
Dim dacl
Dim ace
Dim strExternalAccount
Add_ACE_Mailbox = False
Set oUser = GetObject ("LDAP://" & strADUser)
' Get the Mailbox security descriptor (SD).
On Error Resume Next
Set oSecurityDescriptor = oUser.MailboxRights
If Err.Number <> 0 Then
On Error GoTo 0
objFile.WriteLine "ERR: Cannot get MailboxRights the account: " & strADUser
Add_ACE_Mailbox= False
Exit Function
End If
' Get user NTName and set ExternalAccountName
strExternalAccount= oUser.sAMAccountName
strExternalAccount= strTrustedDomain + "\" + strExternalAccount
' Extract the Discretionary Access Control List (DACL) using the IADsSecurityDescriptor.
' Interface.
Set dacl = oSecurityDescriptor.DiscretionaryAcl
Set ace = CreateObject("AccessControlEntry")
'Since you can't add the Associated External Account if another user already got it
' Template: AddAce(TrusteeName, gAccessMask, gAceType, gAceFlags, gFlags, gObjectType, gInheritedObjectType)
AddAce dacl,strExternalAccount,131079,0,2,0,0,0
' Add the modified DACL to the security descriptor.
oSecurityDescriptor.DiscretionaryAcl = dacl
' Save new SD onto the user.
oUser.MailboxRights = oSecurityDescriptor
' Commit changes from the property cache to the information store.
On Error Resume Next
oUser.SetInfo
If Err.Number <> 0 Then
objFile.WriteLine "ERR: Failed to give the 'Read', 'Full Mailbox Access' and 'Associate External Account' permissions to the account: " & Err.Description & "(" & Err.number & ")."
If Err.Number = -2147023559 Then
objFile.WriteLine "ERR: The External account " & strExternalAccount & " probably doesn't exist."
End If
Add_ACE_Mailbox= False
Exit Function
Else
objFile.WriteLine "Done MB set for " & strADUser
End If
Add_ACE_Mailbox= True
'Clean up
Set oUser = nothing
Set oSecurityDescriptor = Nothing
End Function
'//////////////////////////////////////////////////////////////////////////////////
'// Function: Changes the ACL of an object
'//
'// Purpose: This code actually changes the ACL list of the object.
'//
'// Input: dacl = The domain controller on which the user
'// object will be created.
'//
'// TrusteeName = The (external) account to give permissions to.
'//
'// gAccessMask = The access mask value
'//
'// gAceType = The acetype flag value
'//
'// gAceFlags = The aceflags flag value
'//
'// gFlags = The flags flag value
'//
'// gObjectType = The objecttype value
'//
'// gInheritedObjectType = The inherited value
'//
'// Returns: The ACL Object.
'/////////////////////////////////////////////////////////////////////////////////
Function AddAce(dacl, TrusteeName, gAccessMask, gAceType, gAceFlags, gFlags, gObjectType, gInheritedObjectType)
Dim Ace1
' Create a new ACE object.
Set Ace1 = CreateObject("AccessControlEntry")
Ace1.AccessMask = gAccessMask
Ace1.AceType = gAceType
Ace1.AceFlags = gAceFlags
Ace1.Flags = gFlags
Ace1.Trustee = TrusteeName
'See whether ObjectType must be set
If CStr(gObjectType) <> "0" Then
Ace1.ObjectType = gObjectType
End If
'See whether InheritedObjectType must be set.
If CStr(gInheritedObjectType) <> "0" Then
Ace1.InheritedObjectType = gInheritedObjectType
End If
dacl.AddAce Ace1
' Clean up
Set Ace1 = Nothing
End Function
[/more]
Главное — результат в железе. 
