Tuesday, May 31, 2011

Modify Log On To (userWorkstations) User Properties–PowerShell Script

This PowerShell script can be used to update or modify the Log On To (userWorkstations) attribute in Active Directory. 

Input – Input.csv.  This file contains user name and workstation information in the following format:

image

Script:

image

Download:  This script can be downloaded from the following locations. 

www.sivarajan.com

TechNet Gallery

Updated Script 07/24/2011The updated script supports multiple values and it won’t overwrite the existing value. 

image

Output

image

You can download the updated script from - http://www.sivarajan.com/scripts/LogOnTo(userWorkstations)-Updated.txt


More scripts - http://portal.sivarajan.com/search?q=script+powershell&max-results=20

25 comments:

http://sivarajan.com/forum/viewthread.php?tid=13

Is there a way to allow the user myuser1 to logon to both houlab01 and houlab02? I have attempted, but it seems that this script overwrites the attribute each time.

Tim,

Thanks for the feedback. I have updated script to support multiple values. Please use the updated version.

-Santhosh

hi i am not able to run the script can u please explain in details.

Really helpful! had to update over 300 user accounts with new information, thanks a lot for sharing.

This comment has been removed by the author.

Hi Shamsheer, you need to provide a csv file named input.csv located in c:\scripts (it's important that the file contains the Username,Computername header). You only have to specify the user account and the workstation to be added, the script allows you to preserve the existing configuration. Hope it helps!

pd. Be sure to edit line 16 with your domain information.

Thanks SpiderMind. Thanks for the feedback!

Shamsheer,
What details are you looking for? Are you getting any error message? If so, please post the error message here.

ccrudo2009@gmail.com
list all the users who have logon to the computer name and allowed

This script works nice, but im trying to clear old log on to values and then add new set of values from .csv file, but i cant get it to work.

iv tried using the original script by modifying line 21 something like this:
....
If (($user.get("userWorkstations")) -ne $null)
{$user.psbase.invokeSet("userWorkstations",$null)}
....
like if the value is not null then it would owerwrite it with null value?? or just '' instead of null, but it wont clear the value.

This is a fantastic script, thank you! I do have one question though, is it possible to point the script at an OU rather than using a csv to get the user names and computer names?
For example, the users reside in an OU called Exams, and the computers are in the OU's ComputerRoom1, ComputerRoom2 etc.
Can this script be modified to do this or is it just not possible in powershell?

Thanks Santhosh Sivarajan. How can be like you :DDD

Hi Sivarajan,

Thanks for the script.it worked but what if we need to add multiple computers for a user. For example

User1 should be allowed to PC1,pc2, pc3
user2 should be allowed to pc4,pc5,pc6.

Can this script be modified to do this or is it just not possible in powershell?

Hi Sivarajan,

Thanks for the script.it worked but what if we need to add multiple computers for a user. For example

User1 should be allowed to PC1,pc2, pc3
user2 should be allowed to pc4,pc5,pc6.

Can this script be modified to do this or is it just not possible in powershell?

Hi Santhosh Sivarajan,
Thanks for nice article.

My Question is that,
we d like to run this script for all AD users except the users whose Logon To Worstation selected "Full Computer".
How can we do this?
Thanks in advance.

Is there a way just to specify a user ID and list all of the computers it is allowed to logonto?

Marcus,

You just need the current values from userWorkstations?

Kadir,
What do you mean by "Full Computer"?

How can we take out 3 computers that are in these fields and set it back to All Computers?

Script has run successfully user profiles updated however the AD objects did not update. Script ran as admin user

$UserN = $_.UserName
$ComputerN = $_.ComputerName
$ObjFilter = "(&(objectCategory=person)(objectCategory=User)(samaccountname=$UserN))"
$objSearch = New-Object System.DirectoryServices.DirectorySearcher
$objSearch.PageSize = 15000
$objSearch.Filter = $ObjFilter
$objSearch.SearchRoot = "LDAP://DC=net,DC=JohnLewis,DC=co,DC=uk"
$AllObj = $objSearch.findOne()
$user = [ADSI] $AllObj.path
$ErrorActionPreference = "silentlycontinue"
If (($user.get("userWorkstations")) -ne $null)
{$ComputerN = $user.get("userWorkstations")+","+ $ComputerN}
Write-host -NoNewLine "Updating $UserN Properties ..."
$user.psbase.invokeSet("userWorkstations",$ComputerN)
Write-host "Done!"
$user.setinfo()
}

About what Karimulla Sheik asked (to add multiple computers for a user), this looks to work but only if there is already at least one computer added:

Import-Module ActiveDirectory
Import-CSV C:\temp3\pclist2aa.csv | % {
$UserN = $_.SamAccountName
$ComputerN1 = $_.LogonWorkstations1
$ComputerN2 = $_.LogonWorkstations2
$ComputerN3 = $_.LogonWorkstations3
$ObjFilter = "(&(objectCategory=person)(objectCategory=User)(samaccountname=$UserN))"
$objSearch = New-Object System.DirectoryServices.DirectorySearcher
$objSearch.PageSize = 15000
$objSearch.Filter = $ObjFilter
$objSearch.SearchRoot = "LDAP://dc=test,dc=company,dc=com"
$AllObj = $objSearch.findOne()
$user = [ADSI] $AllObj.path
$ErrorActionPreference = "silentlycontinue"
If (($user.get("userWorkstations")) -ne $null)
{$ComputerN = $user.get("userWorkstations")+","+ $ComputerN1 +","+ $ComputerN2 +","+ $ComputerN3}
Write-host -NoNewLine "Updating $UserN Properties ..."
$user.psbase.invokeSet("userWorkstations",$ComputerN)
Write-host "Done!"
$user.setinfo()
}

My csv looks like this:
SamAccountName,LogonWorkstations1,LogonWorkstations2,LogonWorkstations3
user1,computer1,computer2,computer3
user2,computer4,computer5,computer6

Do you have any ideas about what needs to be changed to get it to update when "log on to" doesn't have anything added?

Thanks,
Adrian

Santhosh,
This works good for adding, but I need to remove LogonWorkstations. On several Users I am at the 64 limit but I can't give them all. As I retired computers there isn't a good way to remove them from the list expect for manually. Any ideas?

Post a Comment

Popular Posts

Share

Twitter Delicious Facebook Digg Stumbleupon Favorites More