There are many scenarios where there is a need to add a computer to an AD-group during deployment, for instance to enable the computer to use a wireless network or adding the computer to a application group. I created this little script which can be run for instance from a task sequence in SCCM, which will do the task.
It will add the computer on which the script is executed on to all AD-groups specified in the command line, “wscript.exe adgroups.vbs adgroup1 adgroup2”.
I normally run it using the “run command line” using a service account with the appropriate permissions needed, below is a screenshot on how such a step could look like.
And the script used is posted below, check the script after copying for unwanted line-feeds or you can download it here:
Here is how to implement it:
- Download the script from the link above
- Save it as adgroup.vbs in a directory that can be used as package source files in ConfigMgr
- Create a package without a program and use the newly created folder as source folder
- Distribute the Package to your DP’s
- In the Task Seqeunce after the “Setup Windows and Configuration Manager” step add a “Run Command Line step” (The reason for adding somewhere in the TS after that step is that the script uses the computer account of the computer it is run on the find it in the AD)
- Configure the Run Command line to execute the script using the following command line: “Wscript.exe adgroup.vbs” after the script name add the AD groups names that the computer should be added to, you can enter as many groups as you like. Example “Wscript.exe adgroup.vbs APP_Adobe_reader APP_Java_runtime”.
- Use a account to run the script under that has permissions to manage the group memberships.
- then you are ready to test it.
The script can be found here as well:
Const ADS_PROPERTY_APPEND = 3
Set WshShell = WScript.CreateObject("WScript.Shell")
'----Get Computer DN------
Set objADSysInfo = CreateObject("ADSystemInfo")
ComputerDN = objADSysInfo.ComputerName
strcomputerdn = "LDAP://" & computerDN
Set objADSysInfo = Nothing
Set oRoot = GetObject("LDAP://rootDSE")
strDomainPath = oRoot.Get("defaultNamingContext")
Set oConnection = CreateObject("ADODB.Connection")
oConnection.Provider = "ADsDSOObject"
oConnection.Open "Active Directory Provider"
Set args = WScript.Arguments
For i = 0 To Args.Count - 1
addgroup Args.Item( i )
'----Get Group DN------
Set oRs = oConnection.Execute("SELECT adspath FROM 'LDAP://" & strDomainPath & "'" & "WHERE objectCategory='group' AND " & "Name='" & GroupName & "'")
If Not oRs.EOF Then
strAdsPath = oRs("adspath")
Set objGroup = GetObject (stradspath)
Set objComputer = GetObject (strComputerDN)
If (objGroup.IsMember(objComputer.AdsPath) = False) Then
objGroup.PutEx ADS_PROPERTY_APPEND, "member", Array(computerdn)