When you lose both directory mirrors, it's difficult to save AD. At first we tried demoting the damaged domain controller, reinstalling AD and forcing replication of its database. Trouble was, we hadn't documented which controller was providing which Windows 2000 Server operations master role. We had to seize and transfer missing roles and remove the damaged controller from the domain so replication could begin. We then experienced more problems, including excruciatingly slow replication, so we decided to scrap the recovery process and rebuild AD from scratch.

Code Box 1 click to enlarge

First came the task of rebuilding the domain by entering and testing the technology department's users and groups. AD users and groups have properties including names, passwords, profiles, workstations and group membership that have to be entered, copied or created, depending on the installation's requirements. At Gulf Coast Community College, we use a combination of profiles and workstations for a user to control the desktop until sign-off. In Classroom 209, for instance, Student 209 has a profile that dictates he is allowed to use workstations located only in that classroom. Some users are assigned certain applications, and there are administrative users as well. After we had to manually re-enter all the college's 200 users identified in AD, we decided to automate the user and group-building process.

The Command-Line Syntax click to enlarge

We checked out several scripts on the Internet for building AD users and groups. Most didn't include all the properties we needed or didn't work as advertised. After further research, we decided to use the WSH (Windows Scripting Host), the Visual Basic Scripting engine and the ADSI (Active Directory Scripting Interface) for creating our homegrown script.

Code Box 1 shows a script we developed at Gulf Coast Community College that is largely self-explanatory, with the exception of a few elements. The CSV (comma-separated value) file is called "export.txt," though it's in CSV format. The 15 or so scripting commands that set the "user-cannot-change-password property" are complicated by the involvement of an ACE (Access Control Entry) security mechanism, which requires you get permission to make any changes to an entry. So before the script can set the property, it first must deal with the ACE.

The script also lets the user belong to as many as five groups. There are separate commands to join each group instead of a single loop. And the script allows up to three logon workstations. For users who log on to a single classroom, we use many more workstations. Note that the two commands shown before the Wend command--Set Group = nothing and Set adsUser = Nothing--effectively reset the group and user before the next loop iteration.