Active directory management permissions

Our user accounts aren't, inexplicably, created within the IT team. That's a fight for another day, but right now I'm securing our Active directory, specifically against the people whose jobs it is to create our users, non of whom is anything else other than an IT part-timer. Unbelievably, they've been given full admin rights up to now, but today that stops.

So what I've done instead is to:

• save an .msc file of the AD users and computers MMC snap in.

• Create a user group called Account Managers and add these staff to it. I've granted this group Read Access to the .msc file, and provided them with the file path to it.
  

• Give the Account Managers the neccesary permissions - Read, Write and Modify - to the OU's in which our user accounts (not our System Accounts - they're somewhere else)

• Delegated control of user accounts by right-clicking on the root domain in AD Users and Computers and - well, just walking through the wizard.

• Remove our users from the Admin groups

I'm sure there's going to be some whingeing sometime soon, but that I can handle, by the old-school SysAdmin technique of hiding behind my manager. Hey, it's what he's there for. And I'll sleep just a little bit better tonight, although I know I'll wake up tomorrow and find something else that frightens me.

Welcome...let's begin

Welcome to my first venture into the blogosphere. People write for lots of different reasons, but I suppose one overarching reason is that most human of instincts: the desire to leave our mark on this earth.

Fulfillment of this instinct, of course, presupposes two things. Firstly, of course, that the contents of the author's mind are in some small way worth anything (and I'm not saying that mine are - read on) and secondly, that the author isn't a Sysadmin, in which case he or she has already chosen a path in life leading 180 degrees away from the Golden Mountain of Deep Meaningfulness, towards the valley of Pointless Futility and the permanent campsite of A Wasted Life. This is where I pitch my yurt, and I invite you in for a daily(ish) glass of the soured yak's milk that flows from the udders of the System I'm paid to manage.

So today, I'm moving user profiles from an old SAN to a new one. As this is a public institution we're not allowed to delete anything until the Prime Minister himself signs the release sheet, using a pen carved from the twisted thigh-bone of one of Snow White's short-arsed friends, dipped in the blood of a sacrificially slaughtered Dodo. There's more chance of this happening than any request for him to do so being passed up more than two levels of management without vanishing, or more likely sent back with some lame query aimed at proving nothing more than the intellectual disability of the sender. But I digress.

So I'm moving user profiles. I'm doing this on a by-OU basis in Active Directory Users and Computers. I'm navigating to the OU which I want to migrate, right-clicking and going to View, Add/Remove Columns and making sure I can see the pre-windows 2000 logon name. I'm then Right-Clicking again, going to Export List, and saving it as a CSV file. Open this file in Excel and delete everything else except the login name. I make sure this is in the second column, then I fill in the first one with md \\servername\profilesharename\ - for the destination folders for the migrated profiles. Then the file's saved as a .cmd file. Run that, and you've made your destination folders. Easy.

It's a bit more fiddly - but the same principles, to then make another command file in the same way, this time using your usernames thus:

xcopy \\originalservername\sharename\username \\destinationservername\sharename\username /E /V /C /O /H /K /Y

The /O is the most important one here, as his copies across all the ACL information. Used to be a time long ago when xcopy wouldn't do this and you had to bugger about in the resource kit. The other switches are to do with ignoring errors, recreating folder structures etc and verifying files.

So your data's across - all this assumes you're running this when no-ones on the network - I love working at two in the morning - and all you need to do now is point your users to their profiles. Select everyone in your target OU, Right-Click and hit the profile tab. Stick in \\Servername\Sharename\%username%, and you're done. Now all you have to do is wait for the morning and see what else you've broken.