Welcome to Powergui.org - an open source community for Windows Powershell

PowerGUI.org PowerGUI.org and blogs

Forums » Active Directory and PowerShell

Thread: Setting user logon hours

This question is answered. Helpful answers available: 2. Answered answers available: 1.


Permlink Replies: 20 - Pages: 2 [ 1 2 | Next ] - Last Post: Aug 26, 2010 2:58 PM by: Theo22
jmedd

Posts: 81
Registered: 4/3/08
Setting user logon hours
Posted: Dec 1, 2008 3:46 AM
 
  Click to reply to this thread Reply

I'm using the example in the post here http://jonoble.spaces.live.com/blog/cns!CC73D8744F0894A5!643.entry to copy the logonhours from a template account (nologonhours) which is denied logon at all times to a standard user account (blopez), i.e.

# Get template user logon hours
$userLogonHoursEnabled = Get-QADUser nologonhours -IncludedProperties logonhours | Select LogonHours
$logonHours = $userLogonHoursEnabled.logonHours
# Set logon hours on user
Get-QADUser blopez | Set-QADUser -ObjectAttributes @{logonHours = $logonHours}

but it fails with:

Set-QADUser : The server is unwilling to process the request. (Exception from HRESULT: 0x80072035)

$userLogonHoursEnabled.logonhours returns:

000000000000000000000000000000000000000000

so that bit appears to be working OK, but setting that property onto a different account will not.



Andrey Moiseev (Quest)

Posts: 415
Registered: 9/4/07
Re: Setting user logon hours
Posted: Dec 1, 2008 4:07 AM   in response to: jmedd
 
  Click to reply to this thread Reply

Try this variant:

# Get template user logon hours
$userLogonHoursEnabled = Get-QADUser nologonhours -IncludedProperties logonhours
$logonHours = $userLogonHoursEnabled["logonHours"]
# Set logon hours on user
Get-QADUser blopez | Set-QADUser -ObjectAttributes @{logonHours = $logonHours}

LogonHours attribute has OctetString syntax. Therefore it's stored in AD as array of bytes. Get-QAD* cmdlets convert attribute values to user-friendly form by default. To get raw attribute value you have to use either method above either -DontConvertValuesToUserFriendlyReperesentation switch.




jmedd

Posts: 81
Registered: 4/3/08
Re: Setting user logon hours
Posted: Dec 1, 2008 4:22 AM   in response to: Andrey Moiseev ...
 
  Click to reply to this thread Reply

Thanks for the reply. I tried running your variant, but got:

Set-QADUser : Unspecified error
At C:\Scripts\EmployeeNumber\DisableUser3.ps1:5 char:33
+ Get-QADUser blopez | Set-QADUser  <<<< -ObjectAttributes @{logonHours = $logonHours}




Shay Levy


Posts: 1,919
Registered: 1/31/08
Re: Setting user logon hours
Posted: Dec 1, 2008 4:40 AM   in response to: jmedd
 
  Click to reply to this thread Reply

Try with the array comma operator:

$template = Get-QADUser nologonhours -IncludedProperties logonhours
$logonHours=$template.DirectoryEntry.logonHours
Set-QADUser blopez  -oa @{logonHours = ,$logonHours}


Message was edited by: Shay Levy

Shay Levy [MVP]
http://blogs.microsoft.co.il/blogs/ScriptFanatic
PowerShell Toolbar
Andrey Moiseev (Quest)

Posts: 415
Registered: 9/4/07
Re: Setting user logon hours
Posted: Dec 1, 2008 4:47 AM   in response to: Andrey Moiseev ...
 
  Click to reply to this thread Reply

Then, you need to use ADSI:

# Get template user logon hours
$userLogonHoursEnabled = Get-QADUser nologonhours -IncludedProperties logonhours
$logonHours = $userLogonHoursEnabled["logonHours"]
# Set logon hours on user
$user = Get-QADUser blopez
$dirEntry = $user.DirectoryEntry.PSBase
$dirEntry.Properties["logonHours"].Value = $logonHours
$dirEntry.CommitChanges()

# Verify
Get-QADUser blopez -ip logonHours | ft logonHours




jmedd

Posts: 81
Registered: 4/3/08
Re: Setting user logon hours
Posted: Dec 1, 2008 5:02 AM   in response to: Andrey Moiseev ...
 
  Click to reply to this thread Reply

Thanks Shay and Andrey.

Shay's post generated a similar error so I tried Andrey's using ADSI example and that works.

Thanks so much for the help from both you guys.


Shay Levy


Posts: 1,919
Registered: 1/31/08
Re: Setting user logon hours
Posted: Dec 1, 2008 5:11 AM   in response to: jmedd
 
  Click to reply to this thread Reply

It worked for me (my post) with QAD 1.1.2.761 and PS CTP2.

Message was edited by: Shay Levy

Shay Levy [MVP]
http://blogs.microsoft.co.il/blogs/ScriptFanatic
PowerShell Toolbar
jmedd

Posts: 81
Registered: 4/3/08
Re: Setting user logon hours
Posted: Dec 1, 2008 5:55 AM   in response to: Shay Levy
 
  Click to reply to this thread Reply

OK, I have QAD 1.1.2.761 and PS V1 so maybe that explains it.

Thanks



aleksandar

Posts: 31
Registered: 3/10/07
Re: Setting user logon hours
Posted: Dec 1, 2008 5:56 AM   in response to: Shay Levy
 
  Click to reply to this thread Reply

This modification of Shay's code has worked for me:

$template = Get-QADUser nologonhours -IncludedProperties logonhours
[array]$logonHours=$template.DirectoryEntry.logonHours
Set-QADUser blopez  -oa @{logonHours = $logonHours}

-aleksandar
http://powershellers.blogspot.com



jmedd

Posts: 81
Registered: 4/3/08
Re: Setting user logon hours
Posted: Dec 1, 2008 6:13 AM   in response to: aleksandar
 
  Click to reply to this thread Reply

Nice! Worked with my V1 version.

Thank you



jonoble


Posts: 9
Registered: 12/2/08
Re: Setting user logon hours
Posted: Dec 2, 2008 1:46 AM   in response to: jmedd
 
  Click to reply to this thread Reply

Hey guys. I'd written that post based on a previous version of the AD cmdlets. It was working fine in production for a while, and I didn't notice it had stopped working until somebody recently pointed out a related error on literally thousands of user accounts! I hadn't got round to looking at fixing it yet, so thanks for this!

I'll update the original blog post, referring people here.


Theo22

Posts: 24
Registered: 4/30/08
Re: Setting user logon hours
Posted: Aug 19, 2010 10:46 PM   in response to: jmedd
 
  Click to reply to this thread Reply

Can I get a little help on this please?  I'm trying to use this script to disable a list of users logonHours.  I want to get the list from a text file.  If I run the commands below one by one on my PS cmd line, it works fine but when I try to iterate over the names from the text file I get this error:
Cannot index into a null array.
At D:\scripts\DisableUserLogonHours.ps1:22 char:22
+ $dirEntry.Properties[ <<<< "logonHours"].Value = $logonHours
    + CategoryInfo          : InvalidOperation: (logonHours:String) [], RuntimeException
    + FullyQualifiedErrorId : NullArray
 
You cannot call a method on a null-valued expression.
At D:\scripts\DisableUserLogonHours.ps1:23 char:24
+ $dirEntry.CommitChanges <<<< ()
    + CategoryInfo          : InvalidOperation: (CommitChanges:String) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull


Here is the script:
$userLogonHoursDisabled = Get-QADUser test-Betty10 -IncludedProperties logonhours
$logonHours = $userLogonHoursDisabled["logonHours"]


#Specify the path to the input file that contains the list of users
$UserList  = Get-Content D:\scripts\DisableLogonHours.txt

#Iterate through the list of Users in the file and disable all logon hours
foreach ($user in $UserList) {
$disableUserHours = Get-QADUser $user
$dirEntry = $user.DirectoryEntry.PSBase
$dirEntry.Properties["logonHours"].Value = $logonHours
$dirEntry.CommitChanges()
}


The script keeps failing on this line:
$dirEntry.Properties["logonHours"].Value = $logonHours

If I don't read the name in from a text file and manually put it in, no problem.  I'm a novice at this and don't understand the error message.  Can somebody help?  Shay? By the way, I could not get Shay's script to work in my shell which is why I am using this one.

Thank you,
-Theo




Shay Levy


Posts: 1,919
Registered: 1/31/08
Re: Setting user logon hours
Posted: Aug 20, 2010 6:13 AM   in response to: Theo22
 
  Click to reply to this thread Reply

Not tested, try it on a test user:

get-qaduser user1 | set-qaduser -objectattributes @{logonHours='FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF'} #all hours allowed



Shay Levy [MVP]
http://blogs.microsoft.co.il/blogs/ScriptFanatic
PowerShell Toolbar
Theo22

Posts: 24
Registered: 4/30/08
Re: Setting user logon hours
Posted: Aug 20, 2010 7:20 AM   in response to: Shay Levy
 
  Click to reply to this thread Reply

Tried it and it didn't work.  Here is my error:
Set-QADUser : The server is unwilling to process the request.
At line:1 char:39
+ get-qaduser test-betty10 | set-qaduser <<<<  -objectattributes @{logonHours='FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FF'} #all hours allowed
    + CategoryInfo          : NotSpecified: (:) [Set-QADUser], DirectoryServicesCOMException
    + FullyQualifiedErrorId : System.DirectoryServices.DirectoryServicesCOMException,Quest.ActiveRoles.ArsPowerShellSn
   apIn.Powershell.Cmdlets.SetUserCmdlet

Why does my script fail reading the username from a text file and work correctly when I enter each line in the script one by one in my shell?  I've got a list of about 50 users that I need to do this for.

What does the error mean?
Set-QADUser : The server is unwilling to process the request.
At line:1 char:39
+ get-qaduser test-betty10 | set-qaduser <<<<  -objectattributes @...

What did my script error mean?
+ $dirEntry.Properties[ <<<< "logonHours"].Value = $logonHours
    + CategoryInfo          : InvalidOperation: (logonHours:String) [], RuntimeException
    + FullyQualifiedErrorId : NullArray
 
You cannot call a method on a null-valued expression.
At D:\scripts\DisableUserLogonHours.ps1:23 char:24
+ $dirEntry.CommitChanges <<<< ()
    + CategoryInfo          : InvalidOperation: (CommitChanges:String) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull

What is the help command to show me what me this means?
-objectattributes @{
Or this?
Get-QADUser -ip | ft

Thank you




Shay Levy


Posts: 1,919
Registered: 1/31/08
Re: Setting user logon hours
Posted: Aug 20, 2010 7:24 AM   in response to: Theo22
 
  Click to reply to this thread Reply

I can't test it at home, maybe with this:


get-qaduser user1 | set-qaduser -objectattributes @{logonHours='\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF'}


Gget help on the ObjectAttributes parameter:

help New-QADObject -Parameter ObjectAttributes


Shay Levy [MVP]
http://blogs.microsoft.co.il/blogs/ScriptFanatic
PowerShell Toolbar
Legend
MVP: 2501 + pts
Guru: 2001 - 2500 pts
Expert: 751 - 2000 pts
Enthusiast: 31 - 750 pts
Novice: 0 - 30 pts
Moderators
Helpful answer (5 pts)
Answered (10 pts)

Point your RSS reader here for a feed of the latest messages in all forums