Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I change this setting from a batch file? For any given user, how can I make it so they can only log onto the computer named abc? A vbs or powershell script would be my second choice.

enter image description here

share|improve this question
VBS and Powershell really need to start being your first choice for things like this - they're designed to do this kind of work and batch files are not. – RobM Apr 10 '11 at 22:11
up vote 5 down vote accepted

You need to update the "userWorkstations" AD attribute for the users.

In VBS it would be something Like:

On Error Resume Next
Set ObjRootDSE = GetObject("LDAP://RootDSE")
strOU = "OU=SCRIPT,DC=Company,DC=local"

Set objConnection = CreateObject("ADODB.Connection")
Set objCommand =   CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objCommand.ActiveConnection = objConnection

objCommand.Properties("Page Size") = 1000
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE 
objCommand.Properties("Sort On") = "SN"

objCommand.CommandText = _
    "SELECT Name, displayName, distinguishedName FROM 'LDAP://" & strOU & " ' WHERE objectCategory='user'" 

Set objRecordSet = objCommand.Execute
Do Until objRecordSet.EOF

    usrDN = objRecordSet.Fields("distinguishedName").Value
    Set objUser = GetObject("LDAP://" & objRecordSet.Fields("distinguishedName").Value)

    Set objCnt = GetObject("LDAP://" & usrDN)
        If (Err.Number > 0) Then
            objUser.userWorkstations = "abc"
        End If 

Set objRecordSet = Nothing
Set objCommand = Nothing
Set objConnection = Nothing

This takes all users in the top level "SCRIPT" OU and modifies the userWorkstation attribute for each. Obviously you can manipulate it as needed.

Also, as Greg pointed out the attribute is not an array and to specify more than one workstation you would use:

objUser.userWorkstations = "computer1,computer2,computer3"
share|improve this answer
Good answer. You may want to point out that userWorkstations is not a typically multi-valued array like some other attributes, but a single comma-separate string. – Greg Askew Apr 10 '11 at 16:14
Correct thanks! see edits. – HostBits Apr 10 '11 at 16:22
This would be much simpler in powershell, I'll post an answer if I have a chance later today (hopefully someone else will beat me to it) – Jim B Apr 11 '11 at 15:04
+50 This worked great after I adding a constant for ADS_SCOPE_SUBTREE of 2 and not including spaces in the userWorkstations list. Thank you! – jftuga Apr 13 '11 at 18:14
Ahh yes, Looks like I pulled that out accidentally from the source script. Glad it helped! – HostBits Apr 13 '11 at 19:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.