活动目录复制用户属性

Question

I have a script, which should copy Description value to Department . But script only seems to be working 50%.

I have OU , and there are 3 sub OU 's. The script changes only first OU users attributes, but not the other 2. Could someone check script and tell me whats wrong with it.

Script:

Option Explicit 

On Error Resume Next 
Dim objUser, objChild, objConnection, objRootDSE, objItem
Dim WshShell, objFSO, strRoot, strDNSDomain, strContainer
Dim strDescription, strsAMAccountName 
Dim strdepartmentAfter, strDirectory, strdepartmentBefore
Dim i, intLogFlag 'no log exists

i=1 
intLogFlag = 0

Set WshShell = CreateObject("WScript.Shell") 

'Set current directory to Desktop & display on page 
strDirectory = WshShell.SpecialFolders("Desktop") & "\" 
Set objRootDSE = GetObject("LDAP://RootDSE") 
strDNSDomain = objRootDSE.Get("DefaultNamingContext") 
strContainer = strContainer & strDNSDomain 
'To do a subcontainer, add it after//ou=OUName, - include comma 
Set strRoot =GetObject("LDAP://OU=Kasutajad," & strDNSDomain ) 
'Start Logging 
CreateLog() 
'**************************************************************** 
For each objChild in strRoot 
Select Case objChild.class 
Case "organizationalUnit","container" 
Call DATree 
End Select 
Next 

Sub DATree() 
OU.Filter="objectClass=user"
For each user in OU
If user.class="user" Then
    On Error Resume Next
    user.Department=user.description
    If Err.Number = 0 Then
         user.SetInfo
         WScript.Echo "Copied:" & user.description & " for " & user.name 
    Else
         On Error GoTo 0
         WScript.Echo "No IPPHONE configured for " & user.name
    End If
    On Error GoTo 0
end if
i=i+1 
next 
End Sub 

i = i -1 
Wscript.Echo "Accounts = " & i 
Wscript.Quit 

'**************************************************************** 

Sub CreateLog() 
On Error Resume Next 
Dim objFile 
Dim strFile, strText 

'Create log file 
strFile = "UserDepartmentLog_" & Month(Date()) & "_" & Day(Date()) & ".txt" 
Set objFSO = CreateObject("Scripting.FileSystemObject") 
Set objFile = objFSO.CreateTextFile(strDirectory & strFile) 
Set objFile = Nothing 
'Write headers to the log file 
strText = "User Name,Date,Description,Department Before, Department After" 
Set objFile = objFSO.OpenTextFile(strDirectory & strFile, 8, True) 
objFile.WriteLine(strText) 
intLogFlag = 1 
Set objFSO = Nothing 
Set objFile = Nothing 
End Sub 

'**************************************************************** 

'Used to append the log for each computer the script is run against 

Sub WriteLog(strdescription, strAccountName, strDeptBefore, strDeptAfter) 
On Error Resume Next 
Dim objFile, objTextFile 
Dim strFile, strText 

strFile = "UserDepartmentLog_" & Month(Date()) & "_" & Day(Date()) & ".txt" 
Set objFSO = CreateObject("Scripting.FileSystemObject") 
'Check to see if the log exists 
If intLogFlag = 1 Then 
'Write to the log 
strText = strAccountName & "," & Date() & "," & strDescription & "," & strDeptBefore &                         "," & strDeptAfter 

Set objFile = objFSO.OpenTextFile(strDirectory & strFile, 8, True) 
objFile.WriteLine(strText) 
objFile.Close 
'Reset strText for later use 
strText = "" 
Else 'If the log doesn't exist, create it 
CreateLog() 
'Reset strText for later use 
strText = "" 
End If 
Set objTextFile = Nothing 
Set objFile = Nothing 
Set objFSO = Nothing 
End Sub

Answer 1

I suggest you ditch VBScript and switch to PowerShell. All of that can be replaced with this (all on one line):

Get-ADUser -SearchBase 'OU=PowerShell Testing,DC=yourdom' -LDAPFilter '(sAMAccountName=*)' -Properties description | ForEach-Object { Set-ADUser $_ -Department $_.description }

All you need to do this is PowerShell 2.0 (preferably 3.0 though because it's much easier) and the Active Directory Module on your client .

Hopefully, the command are verbose enough to work out most of what's going on. The thing to know is that PowerShell commands tend to return objects*, rather than text. The | is a pipe, so the output objects from the first command (Get-ADUser) are sent to the second command (ForEach-Object). And $_ represents the object in the pipeline. So, inside the braces, I'm doing a Set-ADUser (Set is PowerShell's standard verb for updating) on the object in the pipeline, applying the value of the description attribute of the object in the pipeline to the -Department property. Ta da!

This is known as a PowerShell one-liner. I could've written it as a script and it might've looked like this:

$users = Get-ADUser `
    -SearchBase 'OU=PowerShell Testing,DC=yourdom' `
    -LDAPFilter '(sAMAccountName=*)' -Properties description

foreach ($user in $users)
{
    Set-ADUser $user -Department $user.description
}

The ` is PowerShell's continuation character.

I used to do a lot of VBScripting - I had scripts with 000s of lines of code. Now, I wouldn't touch it with a barge-pole, if I had a choice.