VBScript Create Group
Groups are probably the most difficult object to control with VBScript. Fortunately, this script will create a Global Security group easily and without having to use the tricky construction involving CONST ADS_GROUP_TYPE.
Topics for Creating a Group Account with a VBScript
- Our Mission and Goal
- Example – A lucky way to Create a Group
- VBScript Tutorial – Learning Points
- AD Permissions Analyzer
- Summary for Creating Groups
Whenever you configure groups, pay close attention to the Group scope and also the Group type, for example there are 3 scopes and 2 types of group. When you create a new group, one combination has to be the default; that combination is Global (scope) with Security (type). Therefore, if wish to create a different group, for example, a Universal Distribution groups then you need more scripting commands, in particular CONST ADS_GROUP_TYPE.
On this page, we get lucky and create a Global Security group. I say lucky, because we using a simple VBScript that parallels creating a group with Active Directory Users and Computers, where we accept only the default choices. However, if your mission were to create a Universal Distribution group, then your luck would run out, this script would not work.
For any type of group apart from the default of Global Security you need to master ADS CONST…. values.
Why is this example ‘lucky’? Because you do not have to add ADS CONST… statements, the script just accepts the defaults which produces a Global scope and Security type of group.
Prerequisites for your Group VBScript
I recommend that you are logon as administrator, preferably at a domain controller. Alternatively, try Remote Desktop. If all else fails, you can try these script on an XP machine as a non-administrator, but why introduce extra complications? Let us start with some easy successes.
Instructions for Creating a Group Account in Active Directory
- You should run this VBScript on a Windows Active Directory domain.
- Copy and paste the example script below into notepad or a VBScript editor.
- Decide whether to change the value for strGroup.
- Save the file with a .vbs extension, for example: SimpleGroup .vbs.
- Double click SimpleGroup .vbs and check the strOU for your new group.
Sample Script – A Lucky Way to Create a Group
‘ Sample VBScript to create a Global Security Group
‘ Author Guy Thomas https://computerperformance.co.uk/
‘ Version 2.4 – May 2010
Dim strOU, strGroup, strDNSDomain
Dim objOU, objGroup, objUser
‘ Check – Make sure you have the OU referenced by strOU
strOU = "OU=Newport,"
strNewGp = "Coal Porters1"
strNewGpLong = "CN=" & strNewGp
Set objRootDSE = GetObject("LDAP://RootDSE")
strDNSDomain = objRootDSE.Get("DefaultNamingContext")
‘ Create new Group
Set objOU = GetObject("LDAP://" & strOU & strDNSDomain )
Set objGroup = objOU.Create("Group",strNewGpLong)
objGroup.Put "sAMAccountName", strNewGp
‘ End of Simple Group VBScript.
Import users from a spreadsheet. Just provide a list of the users with their fields in the top row, and save as .csv file. Then launch this FREE utility and match your fields with AD’s attributes, click and import the users.
Optionally, you can provide the name of the OU where the new accounts will be born. Download your FREE bulk import tool.
If you need more comprehensive software, download a free trial of SAM (Server & Application Monitor)
Note 1: The first 10 lines explain the purpose of the script and declare the variables. Either create an OU called Newport, or else change the strOU reference in the script.
Note 2: Keep your eye on the commas and CN= syntax. The simple, but clever command, which allows the script to work with any domain is: GetObject("LDAP://rootDSE"). Crucially, this statement binds WSH / VBScript to Active directory. The next line appends the Newport OU, as that is where our example script creates the strGroup.
Note 3: The heart of this script is: Set objGroup = objOU.Create("Group",strNewGpLong). Once the ‘Group’ object is born, then its sAMAccountName is added on the next line.
If you just want to create a Global Security scope and type of group, then it’s your luck day, this simple method will do the job. This page just seeks to remind you or get you started with the basics of creating any object in Active Directory. However, if you want to understand and then control the type of groups that you create, then study the CONST ADS_GROUP_TYPE statements.
If you like this page then please share it with your friends