Deleting Specified Computer Accounts

Microsoft® Windows® 2000 Scripting Guide

« Previous | Next »   

If all you need to do is delete a single computer account, it is probably faster and easier to delete it by using Active Directory Users and Computers. Creating a script to delete a single computer account is probably more trouble than it is worth; scripts are far more useful when they are used to delete multiple computer accounts based on specified criteria.

For example, your organization might have made the decision to require all computers to use the Windows 2000 operating system. To help ensure compliance with this new requirement, you might give departments a specific period of time in which to complete the upgrade. At the end of that time period, you might then delete the accounts for any computer not running Windows 2000. Deleting these accounts will help prevent users from using an unauthorized operating system to gain access to network resources.

You can delete specified computer accounts by writing a script that:

1. Searches Active Directory for all computer accounts meeting specified criteria. For example, you can search for all computers running Windows 2000 or Windows NT 4.0.
2. Returns a recordset consisting of all the computer accounts meeting the criteria.
3. Individually bind to and delete each account in the recordset.

Scripting Steps

Listing 9.4 contains a script that deletes specified computer accounts from Active Directory. To carry out this task, the script must perform the following steps:

1. Create a constant named ADS_SCOPE_SUBTREE and set the value to 2.

   This constant is used to specify a search that begins in the Active Directory root and then proceeds to search all the child containers as well.

2. Create an instance of the Active Directory connection object (ADODB.Connection).
3. Create an instance of the Active Directory command object (ADODB.Command).

   The command object allows you to issue queries and other database commands through the Active Directory connection.

4. Set the Provider property of the connection object to the Active Directory provider (ADsDSOObject), the OLE database provider for ADSI.
5. Set the active connection to the Active Directory connection.
6. Set the command text for the Active Directory command object to the Structured Query Language (SQL) query that retrieves the specified computer accounts from fabrikam.com.

   In this script, the SQL query is "SELECT distinguishedName, operatingSystemVersion FROM 'LDAP://DC=fabrikam,DC=com' WHERE objectClass='computer' AND operatingSystemversion = '4.0'".

7. Specify values for page size, time-out, search scope, and caching.

   Although this step is optional, it can improve the performance of your script in a domain with thousands of computers.

8. Execute the SQL query.

   This query returns a recordset consisting of all the computer accounts for all computers currently running the Windows NT 4.0 operating system.

9. When the set of computers is returned, use the MoveFirst method to move to the first computer in the recordset.
10. For each computer in the recordset, set the value of the variable strComputer to the distinguished name for the computer account.
11. Use a second GetObject call to bind to the computer account. You must individually bind to each account because items in an ActiveX Data Object (ADO) recordset are read-only.
12. After binding to the individual computer account, use the DeleteObject method to delete the account from Active Directory.

Listing 9.4   Deleting Specified Computer Accounts

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 

Const ADS_SCOPE_SUBTREE = 2 Set objConnection = CreateObject("ADODB.Connection") Set objCommand =   CreateObject("ADODB.Command") objConnection.Provider = "ADsDSOObject" objConnection.Open "Active Directory Provider" Set objCommand.ActiveConnection = objConnection objCommand.CommandText = _     "SELECT distinguishedName, operatingSystemVersion FROM " _         & "'LDAP://DC=fabrikam,DC=com' WHERE objectClass='computer' " _             & "AND operatingSystemVersion = '4.0'" objCommand.Properties("Page Size") = 1000 objCommand.Properties("Timeout") = 30 objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE objCommand.Properties("Cache Results") = False Set objRecordSet = objCommand.Execute objRecordSet.MoveFirst Do Until objRecordSet.EOF     strComputer = objRecordSet.Fields("distinguishedName").Value     Set objComputer = GetObject("LDAP://" & strComputer & "")     objComputer.DeleteObject (0)     objRecordSet.MoveNext Loop

---

 Send us your feedback

« Previous | Next »