• State Verified Answer
  • Replies 6 replies
  • Answers 1 answer
  • Subscribers 15 subscribers
  • Views 5748 views
  • Users 0 members are here
Options
Related

InTrust script to enumerate laptop or desktop computers by AD Site.

chris fors
over 4 years ago
In our AD forest they have put all desktop and laptop computers from all AD sites in the same OU. All the desktop computer names begin with "D" and all the laptop computer names begin with "L".
I would like to be able to build separate InTrust sites for gathering jobs for the laptop and desktop computers by site. 
As an end result would like to have InTrust Sites organized -
   AD Site A Desktops
   AD Site A Laptops
   AD Site B Desktops
   AD Site B Laptops
   ... and so on
I would like to do this by InTrust enumeration script, perhaps filtering the computer names in the OU examining all the ones that begin with D or L and then filtering the results by site from the command "nltest /server:<computername> /dsgetsite".  Unclear how to do this most efficiently/reliably in an InTrust script.  And there might be a more eloquent way.
Thinking perhaps somebody has already travelled this path and can provide tips or even a script.
Parents
  • 0 over 4 years ago

    Hi Chris,

    The most elegant solution is described here, citation: "computer/site information is not stored in AD. BUT, there is nothing stopping you from putting it there". It  requires some effort on distributing a startup script to all computers in your environment. The whole solution including InTrust part might be the following:

    $obj = new-object -com ADSystemInfo
    $type = $obj.gettype()
    $adsite = $type.InvokeMember("sitename","GetProperty",$null,$obj,$null)
    if($adsite -eq $null){$adsite = "UNKNOWN"}
    $root = [ADSI]"LDAP://DC=Contoso,DC=com"
    $search = [adsisearcher]$root
    $name = $ENV:COMPUTERNAME
    $Search.Filter = "(&(SamAccountName=$name$))"
    $computer = $Search.FindOne() | foreach{$cproperties=$_.GetDirectoryEntry()}
    $adsiteinad = $cproperties.extensionattribute8
    if($adsiteinad -eq $adsite){}else{
     $cproperties.extensionattribute8 = [string]$adsite
     $cproperties.SetInfo()
    }

    1. Change DC=Contoso,DC=com to your domain or add some code to detect current domain.
    2. Distribute a script using GPO or Ops Manager or other way to run on all computers on start-up or on schedule.
    3. Create a site in InTrust Manager, use script "Enumeration Script: LDAP query" as site object.
    4. In the script properties set:
      1. Attribute Name = dnsHostName
      2. Bind String = LDAP://DC=Contoso,DC=com ( change to your domain)
      3. Filter = (&(objectCategory=computer)(extensionattribute8=Default-First-Site-Name)(name=D*)) (Default-First-Site-Name = change to your Site, D* for Desktops, L* for Laptops)
      4. Need Deep Search = 1
      5. Search Scope = 2
    5. Check if the site works.
    6. Create a number of similar sites for each AD Site, D and L.

    What do you think if it can be implemented in your environment?

Reply
  • 0 over 4 years ago

    Hi Chris,

    The most elegant solution is described here, citation: "computer/site information is not stored in AD. BUT, there is nothing stopping you from putting it there". It  requires some effort on distributing a startup script to all computers in your environment. The whole solution including InTrust part might be the following:

    $obj = new-object -com ADSystemInfo
    $type = $obj.gettype()
    $adsite = $type.InvokeMember("sitename","GetProperty",$null,$obj,$null)
    if($adsite -eq $null){$adsite = "UNKNOWN"}
    $root = [ADSI]"LDAP://DC=Contoso,DC=com"
    $search = [adsisearcher]$root
    $name = $ENV:COMPUTERNAME
    $Search.Filter = "(&(SamAccountName=$name$))"
    $computer = $Search.FindOne() | foreach{$cproperties=$_.GetDirectoryEntry()}
    $adsiteinad = $cproperties.extensionattribute8
    if($adsiteinad -eq $adsite){}else{
     $cproperties.extensionattribute8 = [string]$adsite
     $cproperties.SetInfo()
    }

    1. Change DC=Contoso,DC=com to your domain or add some code to detect current domain.
    2. Distribute a script using GPO or Ops Manager or other way to run on all computers on start-up or on schedule.
    3. Create a site in InTrust Manager, use script "Enumeration Script: LDAP query" as site object.
    4. In the script properties set:
      1. Attribute Name = dnsHostName
      2. Bind String = LDAP://DC=Contoso,DC=com ( change to your domain)
      3. Filter = (&(objectCategory=computer)(extensionattribute8=Default-First-Site-Name)(name=D*)) (Default-First-Site-Name = change to your Site, D* for Desktops, L* for Laptops)
      4. Need Deep Search = 1
      5. Search Scope = 2
    5. Check if the site works.
    6. Create a number of similar sites for each AD Site, D and L.

    What do you think if it can be implemented in your environment?

Children
No Data