Re: New Users --> specific group
On Thu, 21 Aug 2008 14:00:30 -0700, Starbuck
<Starbuck@BogusDomain.com> wrote:
>On Thu, 21 Aug 2008 16:17:09 -0400, "Greg Stigers"
><gregstigers+msnews@spamcop.net> wrote:
>
>>I think you mean OU, not group. You can specify the OU when creating a user
>>with dsadd:
>>dsadd user "cn=gstigers, ou=BigCoUsers, dc=BigCo, dc=com"
>>That is just a UserDN. There are quite a few other arguments you will want
>>and need to provide when creating a new user. See "dsadd user" at
>>http://technet.microsoft.com/en-us/library/cc731279.aspx.
>>
>>You can also use CSVDE or LDIFDE.
>>______
>>Greg Stigers, MCSE
>>remember to vote for the answers you like
>>
>
>No, I do mean groups.
>
>If I create a new user account, they are automatically added to the
>"Domain Users" group by simply hitting the Add button.
>
>But I also want them added to *another* group at the same time.
>Without having to manually add them.
>
>
>*$
>
>aa#2290
Maybe I should back up here and explain myself. My issue
is actually more LDAP related and it sounds like you are
brushed up on the subject. My apologies if this is a bit long.
If you look at this article here:
http://support.microsoft.com/kb/275523
"When you view Active Directory with a Lightweight Directory Access
Protocol (LDAP) utility such as Ldp.exe, the Members attribute is not
populated with the Primary group."
Further:
"The memberof attribute of the user object is not populated with the
group name. This can cause problems if programs do not query Active
Directory for the PrimaryGroupID attribute, and only for the Members
attribute of the group. "
Now for reasons which have not been explained to me, our programmers
are unable (or perhaps unwilling) to query the PrimaryGroupID. They
expect to query the Members Attribute and determine if the user is
an employee or not.
So, my thought was to create a NEW group, call it something like
"All Employees" and then add all employees to the group. (Basically,
a copy of "domain users".) The advantage here is that this new group
would appear in the members attribute when querying LDAP, so long
as it isn't the primary group.
But we've got a couple junior admins here who are going to forget to
add new employees to the "All employees" group at the time the account
is created. And its kind of a pain to have to remember...
So wouldn't it be nice if I could create a new user account and have
this new user automatically added to the "All employees" group at the
time of creation?
I hope this is a little more clear to you.
And thanks very much for your input.
*$
aa#2290