ADSI: Renaming AD group

My team mate threw me a difficult question today.

“Do you have a script to rename AD groups?”

Hmmm… most of the time, I only need to rename 1 or 2 group names, so I would just use ADUC to perform it. But can I do it using a script?

So I set out searching for scripts to rename an AD group. Guess what? It cannot be found. The closest search one can get to is to rename user accounts, but that’s a start. I als found an article from MS on how to rename objects, which is definitely useful also.

• Moving and Renaming User Accounts.
• Moving and Renaming Objects

So here is the script:

OldGroupName = “OldGroupName”

NewGroupName =”NewGroupName”

Set objConnection = CreateObject(“ADODB.Connection”)
objConnection.Open “Provider=ADsDSOObject;”

Set objCommand = CreateObject(“ADODB.Command”)
objCommand.ActiveConnection = objConnection

objCommand.CommandText = “;(&(objectCategory=Group)(cn=” & OldGroupName & “));ADsPath;subtree”

Set objRecordSet = objCommand.Execute

Do While Not objRecordSet.EOF

strADsPath = objRecordSet.Fields(“ADsPath”)

‘this next part is to grab the container which the group belongs to, if anyone know which method I can I used to determine an object’s container, let me know. Thanks!”

if InStr(strADsPath, “,OU”) > 0 then

strCont = Mid(strADsPath,InStr(strADsPath, “,OU”)+1)

elseif InStr(strADsPath, “,CN”) > 0 then

strCont = Mid(strADsPath,InStr(strADsPath, “,CN”)+1)

end if

Set oCont = GetObject(“LDAP://” & strCont)
Set oNewGroup = oCont.MoveHere(strADsPath, “cn=” & NewGroupName)

‘You need to do this as the above does not change the pre-Windows name.

oNewGroup.SAMAccountName = NewGroupName
oNewGroup.SetInfo

objRecordSet.MoveNext

Wscript.echo “Old Name is ” & OldGroupName
Wscript.echo “New Name is ” & oNewGroup.AdsPath

Loop
objConnection.Close

Okay, now the next script is to find out how I can rename local group names on a computer.

Renaming AD names to lower case

It should be common knowledge that AD (or Windows technology) does not differentiate cases in names (including folders and files names). This means that “HappyGoLucky” is the same as “happygolucky” in Windows.

However, UNIX names are case sensitive, even folder and files names are case sensitive. This makes sense as it does make coding easier and “a” and “A” a represented different in ASCII. Of course, a persistent issue will be psychological distance. For example, “HappyGoLucky” looks very similar to “HappyGoLuCky”, but the system will refuse to accept it as an existing name. Of course, such incidents can be avoided.

Now when these 2 systems start to talk to each other, you may situations when the UNIX system will not recognise your Windows user name (e.g. TanBeeSoon), because it needs to be “tanbeesoon” instead.

If we go into AD Users and Computers (ADUC) and attempt to rename that name to all lower case, you will be frustrated because Windows thinks that they are the same and your changes will not be made. The trick then is to rename the original name to something else, e.g TanBeeSoon1, wait for replication to complete, then rename it to the original name with all lower case, “tanbeesoon”. If you don’t wait for replication (or the GCs to be updated) to complete, you will get an error saying that the name already exists.