Tuesday, July 12, 2011

Move Computer Objects Based on Operating System Version

This logic can be used move computer objects in Active Directory based based on their Operating System version. 

Option #1 – DS Commands

dsquery * CN=Computers,DC=santhosh,DC=lab -filter "(&(ObjectClass=computer)(objectCategory=Computer)(operatingSystemVersion=6.1))" | dsmove -newparent OU=Win7,OU=ComputerAccounts,DC=santhosh,DC=lab

The above command will move all Windows 7 computers to OU=Win7,OU=ComputerAccounts,DC=santhosh,DC=lab OU.

dsquery * CN=Computers,DC=santhosh,DC=lab -filter "(&(ObjectClass=computer)(objectCategory=Computer)(operatingSystemVersion=5.1))" | dsmove -newparent OU=WinXP,OU=ComputerAccounts,DC=santhosh,DC=lab

The above command will move all Windows XP computers to OU=WinXP,OU=ComputerAccounts,DC=santhosh,DC=lab OU.


Option #2 – Ver or systeminfo Commands

In option #1, I am verifying the OperatingSystem or OperatingSystemVersion values from Active Directory attribute.  You can also verify these values  from the actual computer objects using the following method:

http://portal.sivarajan.com/2011/03/operating-system-infobatch-file.html


Filter

You can update the filter based on OperatingSystem or OperatingSystemVersion values. Also, I have used the default computer location (CN=Computers,DC=santhosh,DC=lab) query.

image

operatingSystemVersion - http://msdn.microsoft.com/en-us/library/ms724832(v=vs.85).aspx

operatingSystem - http://msdn.microsoft.com/en-us/library/aa370556(v=vs.85).aspx


Server Object Filter

If your goal is to move all “severs”, you can modify the search using the "(&(ObjectClass=computer)(objectCategory=Computer)(operatingSystem=*server*)) filter.  This filter will verify the”server” string the operatingSystem attribute value. 


Domain Controller Filter

If you want to exclude all Domain Controllers, you can use the following userAccountControl filter (Active Directory and userAccountControl Attribute).

(&(ObjectClass=computer)(objectCategory=Computer)(!userAccountControl:1.2.840.113556.1.4.803:=8192))


Automation

You can create a batch file with these commands or create a schedule task to achieve this goal.   If you really want to automate this process, you attach this script to an event ID using Attach Task To This Event option.

http://portal.sivarajan.com/2010/04/generate-email-alert-to-event-attach.html


2 comments:

This is incorrect. The pipe passes the results before the dsmove command, and the command errors out.

This comment has been removed by the author.

Post a Comment

Popular Posts

Share

Twitter Delicious Facebook Digg Stumbleupon Favorites More