DSMOD Group adds

[MikeK]

I am trying to add/remove users to/from a group using DSMOD Group.
I've been able to pipe a user samid name to disbable an account by
using DSQUERY User -samid and piping it to DSMOD User.

I'm having trouble adding/removing a user piping the samid to DSMOD
Group.

I'd appreciate any help in parsing this. The MS examples (that I can
find) with group adds don't address this. If I'm posting to the wrong
newsgroup, what is a more appropriate group to post this.

Thank you very much

---Mike

 

[Joe Richards [MVP]]

You will probably want to show the command you are trying. And the resulting
error if any.

joe

 

[MikeK]

This is the code that fails:

dsquery User -samid logonname | dsmod Group
"CN=Groupname,CN=Builtin,DC=Domainname,DC=Com" -addmbr
"CN=logonname,CN=Users,DC=Spozinch,DC=Com"

The error I get says it can't find user. Thanks

---Mike

 

[Laura A. Robinson]

circa Sat, 04 Dec 2004 21:38:02 GMT, in
microsoft.public.win2000.active_directory, MikeK
([email protected]) said,

This is the code that fails:

dsquery User -samid logonname | dsmod Group
"CN=Groupname,CN=Builtin,DC=Domainname,DC=Com" -addmbr
"CN=logonname,CN=Users,DC=Spozinch,DC=Com"

The error I get says it can't find user. Thanks

What is the line "CN=<logonname>,CN=Users,DC=Spozinch,DC=com"
supposed to do? By piping the results of the dsquery, you are
providing the DN of the user to add to the group.

Try this instead:

dsquery user -samid <logonname>|dsmod group "CN=
<groupname>,CN=Builtin,DC=<domainprefix>,DC=<domainsuffix>

For example, if I have a user whose logon name is jblow and I want to
add jblow to the Account Operators group in domain.dom, this does it:

dsquery user -samid jblow|dsmod group "CN=Account
Operators,CN=Builtin,DC=domain,DC=dom"

HTH,

Laura

 

[MikeK]

Sorry I pasted the third line by mistake.

If I use:

dsmod group "CN=HighSec,CN=Builtin,DC=Spozinch,DC=Com" -addmbr
"CN=ROSS JONES,CN=Users,DC=Spozinch,DC=Com"

it succeeds. This of course has the UPN full name, Ross Jones.

When I try the code you suggest

Dsquery User -samid ross | dsmod group
"CN=HighSec,CN=Builtin,DC=Spozinch,DC=Com" -addmbr

it fails with the errors: Dsmod failed: you must specify at least one
parameter to modify. Dsquery failed: the parameter is incorrect.:
Incorrect object type specified.

I've used:
dsquery -samid ross | dsuser user -disabled yes

and that succeeds. I mention this only to suggest that I'm using
valid params but I must be parsing them incorrectly.

 

[Laura A. Robinson]

circa Mon, 06 Dec 2004 01:22:50 GMT, in
microsoft.public.win2000.active_directory, MikeK
([email protected]) said,

Sorry I pasted the third line by mistake.

If I use:

dsmod group "CN=HighSec,CN=Builtin,DC=Spozinch,DC=Com" -addmbr
"CN=ROSS JONES,CN=Users,DC=Spozinch,DC=Com"

it succeeds. This of course has the UPN full name, Ross Jones.

When I try the code you suggest

Dsquery User -samid ross | dsmod group
"CN=HighSec,CN=Builtin,DC=Spozinch,DC=Com" -addmbr

it fails with the errors: Dsmod failed: you must specify at least one
parameter to modify. Dsquery failed: the parameter is incorrect.:
Incorrect object type specified.

I've used:
dsquery -samid ross | dsuser user -disabled yes

and that succeeds. I mention this only to suggest that I'm using
valid params but I must be parsing them incorrectly.

Okay, what happens if you just type "dsquery user -samid ross"
(without the quotes, of course)?

Laura

 

[MikeK]

dsquery User -samid ross

fails error: "The parameter is incorrect. Incorrect object type
specfied."

However:

dsquery User -samid ross | dsget User -disabled -fn -ln

succeeds, giving me the disabled status along with first and last
name. I think dsquery has to be coupled (piped) to another command in
order to work.

 

[Jerold Schulman]

dsquery User -samid ross
should not fail.
It should return the quoted distinguishedName of Ross.

dsquery User -samid ross

fails error: "The parameter is incorrect. Incorrect object type
specfied."

However:

dsquery User -samid ross | dsget User -disabled -fn -ln

succeeds, giving me the disabled status along with first and last
name. I think dsquery has to be coupled (piped) to another command in
order to work.

Jerold Schulman
Windows Server MVP
JSI, Inc.
http://www.jsiinc.com

 

[MikeK]

Thank you.
I know the DSQUERY doesn't fail, What I need to know is how to pipe
the result from DSQUERY to DSMOD Group to add a member.

I was trying to show that I was successful making other changes. The
sad history if the thread is below.

 

[Laura A. Robinson]

circa Mon, 06 Dec 2004 03:57:41 GMT, in
microsoft.public.win2000.active_directory, MikeK
([email protected]) said,

succeeds, giving me the disabled status along with first and last
name. I think dsquery has to be coupled (piped) to another command in
order to work.

Nope; it works fine for me without piping, which is why I asked.

Laura

 

[Laura A. Robinson]

circa Mon, 06 Dec 2004 14:31:00 GMT, in
microsoft.public.win2000.active_directory, MikeK
([email protected]) said,

Thank you.
I know the DSQUERY doesn't fail,

But it does- Jerold is right- you should get a DN as a result of a
straight dsquery user command.

What I need to know is how to pipe
the result from DSQUERY to DSMOD Group to add a member.

Until we figure out why your dsquery isn't working (and it isn't),
that's not really likely to be possible.

I was trying to show that I was successful making other changes. The
sad history if the thread is below.

Understood, but see the other replies- you *should* get a DN when you
run dsquery user -samid ross. Something is wrong here. What happens
if you try it with a different account?

Laura

 

[MikeK]

You were right. I changed the user and it worked perfectly. I'm
embarrassed that I didn't think of it.

I really appreciate everyone's help and that you people stuck by me on
this rather simple question.

---Mike