Tutorial for Creating a Group Account with VBScript
Controlling which type of group you create is difficult. My advice is start by creating a computer object and then progress to my simple group example. Only attempt this script if you have at least a passing knowledge of VBScript. The heart of the difficult is this, whilst there is only one type of computer or user object, there are 6 types of groups. Furthermore, no other common Active Directory object needs the CONST ADS_GROUP_TYPE statement to control its construction.
Topics for Creating a Group Account with a VBScript
Whenever you consider groups, pay close attention to the Group scope and Group types and Scope, for example there are 3 scopes and 2 types of group, which makes a total of 6 different combinations.
The default of Global Security is relatively easy to script, but if you wish to create a Universal Distribution groups then you have to master the ADS_GROUP_TYPE constant. No other object requires this CONST statement, which is one reason why creating groups is so tricky.
We are not going to get far creating groups without mastering the CONST hexadecimal values that define groups:
ADS_GROUP_TYPE_GLOBAL_GROUP = &H2
Note 1: Do not worry about the apparent inconsistency that Active Directory Users and Computers refers to Global as a Group scope but VBScript refers to it as a ‘TYPE as in; TYPE_GLOBAL_GROUP.
Note 2: The H in &H2 tells VBScript that this is a hex number. Just for interest, below are the decimal equivalent values. Admire, but on no account use the decimal numbers, they will not work. My point is that VBScript is fussy about CONST. I mean really fussy, to take another example, spaces are not allowed, either (&H 8) or (& H8) will raise a syntax error. It must be precisely (&H8) with no spaces.
ADS_GROUP_TYPE_DOMAIN_LOCAL_GROUP = 0x00000004
When we analyzed groups, we discovered that they have two properties, type and scope. This is why creating groups is more difficult than scripting computers or OUs. There is a knack to combining both properties, it is eccentric, but the statement needs the word ‘Or’. Surprisingly nothing else works. Forget ‘and’, say no to ampersand, I repeat, just type, ‘or’ between the two halves.
objGroup.Put "groupType", _
As you may know, the first _ (Underscore) tells VBScript to interpret both lines as a single command. The CONST names have zillions of underscores which may be confusing, but that’s just the way VBScript defines them. (Remember I did advise starting with a simple script such as creating a computer)
Import users from a spreadsheet. Just provide a list of the users with their fields in the top row, and save as .csv file. Then launch this FREE utility and match your fields with AD’s attributes, click and import the users.
Optionally, you can provide the name of the OU where the new accounts will be born. Download your FREE bulk import tool.
If you need more comprehensive software, download a free trial of SAM (Server & Application Monitor)
While this script creates a Universal Security group, you could amend the CONST ADS statement to create a Security Distribution group. The reason I chose this particular combination of Universal and Security was that I wanted a different group from my simple create group script. This is what we are aiming for, see Newport Bosses in the diagram below:
I recommend that you logon at a domain controller. If you are a long way from the server, Remote Desktop would be a suitable alternative. If that is not possible, you could get these scripts to work from an XP machine as a non-administrator. However, why introduce extra complications? Especially at the beginning, you want easy success, with fewest obstacles.
Instructions for Creating Group Accounts in Active Directory
Sample Script to Create a Universal Security Group
Const ADS_GROUP_TYPE_UNIVERSAL_GROUP = &h8
‘ Make sure the OU referenced by strOU exists
‘ Bind to Active Directory
‘ Create new Group
‘ Here is where you set the group Type and Scope
Wscript.Echo "Created " & strNewGroup
‘ End of Sample Universal Group VBScript
Note 1: I divided the example script into 5 Sections. At the top is the usual header section with extra statements to declare the CONST values.
Note 2: As with most of my sample scripts, check that your strOU variable matches the reality of your domain. Decide on the name of your group, mine was ‘Newport Bosses’.
Note 3: In the middle is a short section that binds to Active Directory.
Note 4: objOU.Create("Group",strNewGroupLong) is where the group is created.
Note 5: The key part of the script is objGroup.Put "groupType", here is where we assign the group characteristics, in this case Universal and Security.
Note 6: Curiously, there is no specific command to create a Distribution Group, as opposed to a security group. What you must do is rely on the fact that distribution is the default, so if you declare only a scope, then it will automatically create that group as a distribution group. Example of (global) distribution group:
To master creating Active Directory groups, find out all you can about how the CONST ADS defines the 6 possible types of group. My advice is to practice creating a simpler object such as computer or contact, then move on to scripting groups. It is also worth ‘walking through’, how you create a group in Active Directory Users and Computers.
If you like this page then please share it with your friends
See more VBScript examples: