1

I have a GPO in place that runs login / logoff scripts successfully for most users to update user descriptions to their computer names. This works for all users except for one, the error the user receives is

Line:14

Char:1

Error: Access is denied

Code: 80070005

Source: Active directory.

Line 14 of the script contains: objUser.SetInfo

The GPO permissions allow for "Read" for Authenticated users.

The error itself appears to be a generic permission issue, but the user getting the error should still be an "authenticated user" by being able to log on to Active Directory (correct me if I'm wrong). The only thing out of the ordinary with the user in question is that he is a member of up to 6 groups, with Domain Users being the primary Group. Looking for guidance in troubleshooting this.

The script in question:

Option Explicit
Const ADS_PROPERTY_UPDATE = 2 
Dim objSysInfo, objUser, objNetwork, strComputer, strDescription

Set objSysInfo = CreateObject("ADSystemInfo")
Set objUser = GetObject("LDAP://" & objSysInfo.UserName)

Set objNetwork = CreateObject("Wscript.Network")
strComputer = objNetwork.ComputerName

strDescription = "Logged on " & strComputer & " on " & Date

objUser.Put "description", strDescription
objUser.SetInfo
2
  • 2
    Well, sounds like the user doesn't have access to objUser.SetInfo. The rest of the script might help, but the obvious next step would be verifying that the user in question has access to the object and action in question. What's the script doing, trying to set an attribute on the user object? Make sure the user has modify rights to its own attributes, or at least the one(s) at bar. Jan 5, 2015 at 21:38
  • I put the script here: pastebin.com/DrvHdMEY
    – user262447
    Jan 5, 2015 at 21:50

1 Answer 1

0

Unless what I'm working on at the moment for $dayjob has completely clouded my vision or judgement, your script tries to set the Active Directory user object's description to the computer the user logged onto (and date they did so).

By default, normal users do not have permissions to edit or set the description field on on their AD user object. So, double check the permissions on this AD user object, and check that the user has modify permissions on the description attribute. I'll lay odds that this user doesn't, even if all your other users do have the permissions to perform this on their AD user object.

Taking (one of) my users, and ADSIedit as an example, I'd have to go into the Properties, then the Advanced Security Settings for the user object in question, and check that the Write Description permission is allowed to either SELF or one of the groups that user is a member of.

enter image description here

(I used ADSIedit for the purposes of having a meaningful screenshot, but honestly, for the number of permissions entries on most AD user objects, if doing this check for real, I'd definitely dump the ACL on the object to a text file or command line and check through that. Quicker, and much less carpal tunnel that way.)

1
  • This was very helpful, the ADSLedit tool allowed me to find that the user in question was not inheriting the needed permission from a parent object. Thank you.
    – user262447
    Jan 7, 2015 at 16:06

You must log in to answer this question.