Active Directory Printer and logon script Question

[lobadobadingdong]

I have an AD test lab, in it are 4 machines and a network printer.

machines are called:
adtestserver
testprintserver
testXPpc
testNT4pdc

an nt4 domain and an AD domain using 2 way transitive trusts. the share permissions to the printer include domain users from the AD domain.

currently the printserver is in the NT4 domain and the XP pc is in the AD domain (2000 native mode) as it will be when we install our AD system live. (we have many pc's that will slowly be migrated into the AD domain.

I can use the UNC path and instantly connect to the printer on the XP pc, however when I use the add new printer and select the option to browse the tree for printers I only get the domain name for the tree, no OU's are listed. I fought this for a few hours last night, I came in this morning and it worked fine. I restarted the XP pc, and now the same thing happens, I only see the domain name for the tree, no OU's are listed.

We have some 200 printers and it would be a lot simpler (for the users) to drill down the AD tree to thier Department Printers OU to install printers as needed, than for us to have to remote their pc and connect using the UNC path. (this is also a requirement from our manangent that this feature of AD be available)

Has anyone else had any issues of not being able to search the AD tree to install printers on a relatively large domain by using dedicated Printers OU's located under Department OU's? It appears that after ~ 2 hours that I can browse the AD tree fine.

As to the logon script question. We use kixtart for running our logon scripts for our current nt4 domain. Personally I love it and it has worked well for us, however our management wants us to use generic batch files when we install AD(no reason was given, and they seem to be dead set on dumping kixtart). I have extremely limited batch file writing skills and wondered if someone would mind giving me an example of a simple dos based batch file that would do the following. (taken from our kixtart script, modified for security reasons, and truncated just because it's for example purposes)

if ingroup ("Domain Users")

; All users

settime "\\PDC"

use x: "\\data\Apps"

;run "x:\program.exe"

;Copy files for specific ap printing...
if Dir("$sysroot\executable.exe") = ""
copy "\\program\execytabke.exe" $sysroot
endif

if Dir("$sysroot\file.text") = ""
copy "\\program\file.text" $sysroot
endif

; End all users

; Department shares

if ingroup ("CBO")
use s: "\\fileshare\cbo"
endif

if ingroup ("IS")
use s: "\\fileshare\IS Department"
endif

; End department shares

 

[Woodie]

Siince no one else appears to be stepping up...

Browsing for Printers in the AD:
Not much advice here. Since the printer is in the NT4 domain, does it really have a true Directory object? It may be easier to manually create the printer objects in the AD with the UNC names to the real print server/queues.

Logon Scripts:
A bit easier...
Create a logon script for each area:
example:
<All Users - Script 1>
settime "\\PDC"
net use x: \\data\Apps
"x:\Program.exe"

<Dept CBO - script 2>
net use s: \\servername\cboSharename

<Dept IS - script 3>
net use s: \\servername\IS-Sharename

Now, create 3 Group Policy Objects:
DefaultLogonScriptMay2005
CBOLogonScriptMay2005
ISLogonScriptMay2005

Attach each script (.bat file) to its respective GPO.
Now, ACL each GPO in this fashion:
DefaultLogonScriptMay2005 - Everyone READ & APPLY
CBOLogonScriptMay2005 - Everyone READ, AD-Group-CBO-Members APPLY
ISLogonScriptMay2005 - Everyone READ, AD-Group-IS-Members APPLY

No more if statements...the GPO will only apply if the user is a member of one of the groups above.

 

[lobadobadingdong]

Thanks for the fast reply woodie. The batch information is exactly what I wanted to know.

On the printer issue, sorry I forgot to mention, I did manually add the shared printer, as far as I know you have to do it that way when crossing a transitive trust between domains.

 

[Skunk]

This is the code i use through group policy to share printers. It adds the printers at logon so users never have to even look for them.

[edit] Stick that code in a text file and save with extension .vbs Add it to a logon script and apply it to group policy in each departments OU. Modify as needed of course.