Windows Forum

Ask something
Discussion Locked

Command line utility for user secuirty?

0 helpful
10 replies

by mlsnead 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Is there a command line utility out there that will let us add a user to another users security page? What we need to do give NT4.0 domain users access to specific windows 2k active directory users. It can be done through the GUI but it we have 600+ users to do this for. Specifically, we are trying to give NT4.0 domain accounts access to their Exchange 2000 mailboxes and the only way to do it is to make an AD user, disable it, and give the NT 4.0 account access to that users.

Thanks.

10 replies

by cportman

I have to ask - why in the world you are you doing this. If you have the Win2k domain setup with user accounts - why aren't the people authenticating to the 2000 domain. Just set up trust relationship with nt4 domain.

by kahana

you can export a list of all your user names.
there is a good tool for this called exporter.exe freeware from hynea site.
then open in excel and add in the first coloumn the cacls command (built in nt or win2k) then save as a tab delimited file asa batch.
another better option is use windows scripting host with a vb script that uses adsl programming. it will take longer but once you learn to use it you can save hours on administrive tasks.

by mlsnead

While this is a good idea, the cacls program is only for modifting ACLs on files, not users. We need to give users access to other user accounts, not files. Visual Basic scripting would be nice but since none of here can write/read VB this is not a solution either.

Thanks.

by kahana

you can export a list of all your user names.
there is a good tool for this called exporter.exe freeware from hynea site.
then open in excel and add in the first coloumn the cacls command (built in nt or win2k) then save as a tab delimited file asa batch.
another better option is use windows scripting host with a vb script that uses adsl programming. it will take longer but once you learn to use it you can save hours on administrive tasks.

by rkelly

In a simple answer NO. You could create a trust between the domains and use the GUI to change the user properties on each account.

To be able to do what you want to do breaks the whole concept of single user sign on, universal resource access. What you should do is CLONE your NT 4 user accounts into your Windows 2000 domain. Maintain passwords etc between the domains then all your SIDs (the unique IDs that actually maintain ACLs) would be duplicated, this allowing your NT 4 users to logon toone domain and your Exchange 2K server to be in a seperate domain.

by rkelly

Shoudl have said that to CLONE the accounts you use the ADMT from Microsoft.

This discussion is closed to new replies.