strUser = objADSysInfo.UserName\n<\/PRE>\nAs you probably know, the DN provides us with the \u201caddress\u201d to the user\u2019s actual Active Directory user account; that\u2019s because the DN looks something like this:<\/P>
CN=Ken Myer,OU=Europe,DC=fabrikam,DC=com\n<\/PRE>\nIf we want to bind to that user account (and we do; that\u2019s the only way to determine which groups the user belongs to) all we have to do is take the value of strUser, tack LDAP:\/\/<\/B> to the front of it, and then pass that<\/I> value (which just happens to be the user\u2019s ADsPath) to the Get-Object<\/B> method. In other words, we just have to execute the following line of code:<\/P>Set objUser = GetObject(“LDAP:\/\/” & strUser)\n<\/PRE>\nAs you might also know, each Active Directory user account includes an attribute named memberOf<\/B>; as the name implies, this attribute contains a list of all the groups that the user belongs to. That means that our next task is to cycle through that list of groups and determine whether the user is a member of a particular group (and, if he or she is, then determine whether or not the user is a manager). How are we going to do that? Well, for starters, we\u2019re going to set up a For Each loop that walks us through each of the groups included in the memberOf attribute:<\/P>For Each strGroup in objUser.memberOf\n<\/PRE>\nEach group that the user belongs to is stored in the memberOf attribute by the group\u2019s DN. (And yes, groups also have DNs; for that matter, pretty much everything<\/I> in Active Directory has a DN.) Because DN\u2019s are no fun to work with, our next step is to use this line of code to bind directly to the group account in Active Directory:<\/P>Set objGroup = GetObject(“LDAP:\/\/” & strGroup)\n<\/PRE>\nWhy do we bind to the group account? Well, as you know, what we\u2019re doing here is looping through all the groups that the user belongs to, doing our best to determine if the user is a member of a specified group (in this case, the Finance Department group). If we wanted to, we could do this by determining if any of the user\u2019s groups are equal to a specified DN:<\/P>
If strGroup = “CN=Finance Department,OU=Finance,OU=North America,DC=fabrikam,dc=com” Then\n<\/PRE>\nThat works, but it\u2019s a bit cumbersome, to say the least. Therefore, to make things a bit easier on ourselves, we bind to the group account and retrieve the value of the CN<\/B> attribute. In turn, that allows us to write an If-Then statement that looks like this:<\/P>If objGroup.CN = “Finance Department” Then\n<\/PRE>\nThat\u2019s a little easier for human beings (or even Scripting Guys, for that matter) to deal with.<\/P>\n
\n<\/THEAD>\n\n\n| \n Note<\/B>. Another benefit to binding to the group account? When you sit down to write the script, there\u2019s a good chance that you\u2019ll already know the CN of the group (Finance Department). There\u2019s probably far less chance that you\u2019ve memorized the DNs for all your Active Directory groups. (And, if you have<\/I> memorized the DNs for all your Active Directory groups, well, does the phrase \u201cget a life\u201d mean anything to you?)<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n<\/DIV>\n So what if the first group in the collection doesn\u2019t<\/I> have a CN equal to Finance Department<\/I>? That\u2019s fine; in that case we simply return to the top of the loop and try again with the next group. If it turns out that none of the groups has a CN equal to Finance Department<\/I>, well, that\u2019s also fine: that just means that user isn\u2019t a member of the Finance Department group. In that case the script simply terminates, and no drives get mapped.<\/P>\n Ah, but suppose one of the groups does<\/I> have a CN equal to Finance Department<\/I>. In that case we execute the following two lines of code:<\/P>strTitle = objUser.Title\nIf strTitle = “Manager” Then\n<\/PRE>\nIn line 1, we\u2019re simply grabbing the value of the user\u2019s Title<\/B> attribute and then storing it in a variable named strTitle; in line 2, we\u2019re then checking to see if that title happens to be equal to Manager<\/I>.<\/P>\n And what if the user is<\/I> a manager? Well, in that case he or she will get drive X mapped to \\\\atl-fs-001\\pubic\\managers:<\/P>Set objNetwork = CreateObject(“Wscript.Network”)\nobjNetwork.MapNetworkDrive “X:”, “\\\\atl-fs-001\\public\\managers”\n<\/PRE>\nAnd if the user is a member of the Finance Department group but isn\u2019t<\/I> a manager? Then he or she gets a drive mapped to \\\\atl-fs-001\\public\\users instead:<\/P>Set objNetwork = CreateObject(“Wscript.Network”)\nobjNetwork.MapNetworkDrive “X:”, “\\\\atl-fs-001\\public\\users”\n<\/PRE>\nEither way, drive X gets mapped. And then we call the Exit For<\/B> statement to exit the loop and bring the script to an end.<\/P>\n It probably goes without saying that this particular script only checks for membership in a single group (Finance Department) and then checks to see if the user is (or isn\u2019t) a manager. However, you could easily modify the script to check for membership in other groups, or to check for other job titles. Just copy, paste, and tweak various portions of the script as needed. For example, this modified code checks to see if the user is a member of the Finance Department group or<\/I> a member of the Human Resources Department group:<\/P>If objGroup.CN = “Finance Department” Then\n strTitle = objUser.Title\n If strTitle = “Manager” Then\n Set objNetwork = CreateObject(“Wscript.Network”)\n objNetwork.MapNetworkDrive “X:”, “\\\\atl-fs-001\\public\\managers”\n Else\n Set objNetwork = CreateObject(“Wscript.Network”)\n objNetwork.MapNetworkDrive “X:”, “\\\\atl-fs-001\\public\\users”\n End If\n Exit For<\/p>\nElseIf objGroup.CN = “Human Resources Department” Then<\/p>\n strTitle = objUser.Title\n If strTitle = “Manager” Then\n Set objNetwork = CreateObject(“Wscript.Network”)\n objNetwork.MapNetworkDrive “X:”, “\\\\atl-fs-001\\public\\hrmanagers”\n Else\n Set objNetwork = CreateObject(“Wscript.Network”)\n objNetwork.MapNetworkDrive “X:”, “\\\\atl-fs-001\\public\\hrusers”\n End If\n Exit For<\/p>\n End If\n<\/PRE>\n You know, that\u2019s a good question: what happens if a user is a member of both<\/I> groups? Well, in that case, the user will get a drive mapping based on whichever group gets encountered first. (That is, whichever group shows up first in the For Each loop.) If that\u2019s a problem (that is, if you\u2019re a member of group A and a member of group B and you want group A to always take precedence), you could modify the script to keep track of all the targeted groups that the user belongs to, then write some code to pick the \u201cbest\u201d group out of that collection. But that\u2019s something we\u2019ll have to tackle on another day.<\/P>\n Tomorrow? We\u2019ll see. <\/P>\n Before we go, however, we\u2019d like to point out that, according to published reports, Beyonc\u00e9 makes approximately $18-20 million every year. Which is good news: that means that the system works. For one thing, the Scripting Guys have the moral high ground: we truly do write our own scripts, and we don\u2019t make silly TV commercials. For another, we also make way more money each year than Beyonc\u00e9 does.<\/P>\n Well, before taxes, anyway.<\/P><\/p>\n","protected":false},"excerpt":{"rendered":" Hey, Scripting Guy! I need to map a drive based on a user\u2019s membership in a particular Active Directory group. However, I have a twist as well: I need to map a different drive depending on whether or not the user is a manager. In other words, I need to map a drive based on […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,44,3,185,12,20,5],"class_list":["post-63443","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-groups","tag-scripting-guy","tag-shared-folders-and-mapped-drives","tag-storage","tag-user-accounts","tag-vbscript"],"acf":[],"blog_post_summary":" Hey, Scripting Guy! I need to map a drive based on a user\u2019s membership in a particular Active Directory group. However, I have a twist as well: I need to map a different drive depending on whether or not the user is a manager. In other words, I need to map a drive based on […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/63443","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=63443"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/63443\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=63443"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=63443"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=63443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} |
![\"Hey,](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/q-for-powertip.jpg\" "\\"Hey,")
<\/H2>\n![\"Spacer\"](\"https:\/\/devblogs.microsoft.com\/scripting\/wp-content\/uploads\/sites\/29\/2019\/05\/spacer.gif\")
![\"Hey,](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/a-for-powertip.jpg\" "\\"Hey,")
![\"Script](\"http:\/\/img.microsoft.com\/library\/media\/1033\/technet\/images\/scriptcenter\/ad.jpg\" "\\"Script")
<\/A> \n