Member Avatar for Sandman4040

Hi,

I'm using this script to copy 'Member Of..' permissions from one user to another.

Problem I have is that we have 5 domain controllers, what I find is when I delete ALL the groups from user2 (from their own domain controller) and then run the script, what I get is all the groups from user1 plus groups from user2 in the list again, what I'm thinking is that the groups are being copied from another domain controller. Ho do I sort it, do I have to remove user2's groups from ALL the domain controller prior to running this script?

Set NewUser=
Set UserLikeMe=
 
FOR /f "Tokens=*" %%a in ('dsquery user -samid %2') DO Set Newuser=%%a
 
IF NOT DEFINED NewUser (
    ECHO Could not find %2 in AD
    GOTO :EOF
)
 
ECHO New user found %NewUser%
 
FOR /f "Tokens=*" %%a in ('dsquery user -samid %1') DO Set UserLikeMe=%%a
IF NOT DEFINED UserLikeMe (
    ECHO Could not find %1 in AD
    GOTO :EOF
)
 
ECHO Copying groups from user %1 to user %2.
ECHO ===============================================================================>>CopyADGroupmembership.log
ECHO Copying groups from user %1 to user %2.>>CopyADGroupmembership.log
FOR /f "Tokens=*" %%a in ('dsget user %UserLikeMe% -memberof') do (
    dsmod GROUP %%a -addmbr %NewUser% | find /i "dsmod succeeded:"
    IF ERRORLEVEL 1 ECHO Copy not add group %%a to user %NewUser%>>CopyADGroupmembership.log
)
ECHO ===============================================================================>>CopyADGroupmembership.log
Edited by Sandman4040
  • 2 Contributors
  • 3 Replies
  • 188 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by JorgeM

Recommended Answers

All 3 Replies

Member Avatar for JorgeM

If your domain controllers are healthy, you only need to take action once. All DCs in active directory are considered masters so replication would handle the changes.

Member Avatar for Sandman4040

Thanks for the reply, I'll have to check on Monday again.

Member Avatar for JorgeM

When you make a change to one user, it takes a certain amount time (intrasife vs intersite) to replicate changes. You also have this script issue which you described debut we don't know what it actually does.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.