利用VBS脚本自动创建计算机帐户的代码

mcse注:其实这是按照ADSI（Active Directory Services Interface:活动目录服务接口）写的程序。如果你安装了resource kit，这段代码可以用netcom这条命令进行工作，下面是netcom的一个例子:

NETDOM /Domain:MYDOMAIN /user:adminuser /password:apassword MEMBER MYCOMPUTER /ADD

复制代码代码如下:
***********************

"* Start Script

"***********************

Dim sComputerName, sUserOrGroup, sPath, computerContainer, rootDSE, lFlag

Dim secDescriptor, dACL, ACE, oComputer, sPwd

"

"* Declare constants used in defining the default location for the

"* machine account, flags to identify the object as a machine account,

"* and security flags

"Const UF_WORKSTATION_TRUST_ACCOUNT = &H1000

Const UF_ACCOUNTDISABLE = &H2

Const UF_PASSWD_NOTREQD = &H20

Const ADS_GUID_COMPUTRS_CONTAINER = "aa312825768811d1aded00c04fd8d5cd"

Const ADS_ACETYPE_ACCESS_ALLOWED = 0

Const ADS_ACEFLAG_INHERIT_ACE = 2

"

"* Set the flags on this object to identify it as a machine account

"* and determine the name. The name is used statically here, but may

"* be determined by a command line parameter or by using an InputBox

"lFlag = UF_WORKSTATION_TRUST_ACCOUNT Or UF_ACCOUNTDISABLE Or UF_PASSWD_NOTREQD

sComputerName = "TestAccount"

"

"* Establish a path to the container in the Active Directory where

"* the machine account will be created. In this example, this will

"* automatically locate a domain controller for the domain, read the

"* domain name, and bind to the default "Computers" container

"*********************************************************************

Set rootDSE = GetObject（"LDAP://RootDSE"）

sPath = "LDAP:// Set computerContainer = GetObject（sPath）

sPath = "LDAP://" & computerContainer.Get（"distinguishedName"）

Set computerContainer = GetObject（sPath）

""* Here, the computer account is created. Certain attributes must

"* have a value before calling .SetInfo to commit （write） the object

"* to the Active Directory

"Set oComputer = computerContainer.Create（"computer", "CN=" & sComputerName）

oComputer.Put "samAccountName", sComputerName + "$"

oComputer.Put "userAccountControl", lFlag

oComputer.SetInfo

"

"* Establish a default password for the machine account

"sPwd = sComputerName & "$"

sPwd = LCase（sPwd）

oComputer.SetPassword sPwd

""* Specify which user or group may activate/join this computer to the

"* domain. In this example, "MYDOMAIN" is the domain name and

"* "JoeSmith" is the account being given the permission. Note that

"* this is the downlevel naming convention used in this example.

"sUserOrGroup = "MYDOMAINjoesmith"

""* Bind to the Discretionary ACL on the newly created computer account

"* and create an Access Control Entry （ACE） that gives the specified

"* user or group full control on the machine account

"Set secDescriptor = oComputer.Get（"ntSecurityDescriptor"）

Set dACL = secDescriptor.DiscretionaryAcl

Set ACE = CreateObject（"AccessControlEntry"）

"

"* An AccessMask of "-1" grants Full Control

"

ACE.AccessMask = -1

ACE.AceType = ADS_ACETYPE_ACCESS_ALLOWED

ACE.AceFlags = ADS_ACEFLAG_INHERIT_ACE

""* Grant this control to the user or group specified earlier.

"ACE.Trustee = sUserOrGroup

"

"* Now, add this ACE to the DACL on the machine account

"dACL.AddAce ACE

secDescriptor.DiscretionaryAcl = dACL

"

"* Commit （write） the security changes to the machine account

"oComputer.Put "ntSecurityDescriptor", Array（secDescriptor）

oComputer.SetInfo

""* Once all parameters and permissions have been set, enable the

"* account.

"

oComputer.AccountDisabled = False

oComputer.SetInfo

""* Create an Access Control Entry （ACE） that gives the specified user

"* or group full control on the machine account

"wscript.echo "The command completed successfully."

"*****************

"* End Script