Scheduling users from work group manager

I am curious how much control can you have in scheduling users or groups to when they can log on to a machine. I have a biology lab and I wanting to implement group policies that would allow/disallow login based on user ID or Group ID. Is anyone doing this with success. What I am thinking of doing in the future is create user based on a text file and then they will only be allowed to login if there are in a certain sections hours. I think I could group the users into section groups and apply the schedule to the group.
Thanks...

Hi RGrimmes,
Based on your description, I understand that you want to deploy printers via Workgroup Manager. Please refer to following articles and check if
can help you.
Managed Client: How to manage printer options
Managing printers via Workgroup Manager and MCX
Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this
information.
However, for Workgroup Manager software, I suggest that you should contact Apple Support or post the question in
Apple Support Communities.
Hope this helps.
Best regards,
Justin Gu
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Similar Messages

  • Command line equivalent of Work Group Manager's export feature

    Hello everyone,
    I am have a hard time upgrading from Lion Server to Mountain Lion Server, especially with Open Directory. What I wish to do, is to import the existing users and groups of an existing server running Lion Server into a new (fresh) Open Directory master created on another server that is running Mountain Lion Server.
    I have tried several options. Those that did *not* work for me include:
    Trying to make create a replica of the Lion Open Directory on the Mountain Lion Server
    Trying to backup the OD of the Lion Server using slapconfig
    What seems to work (for the moment), is to use the export feature of Work Group manager on Lion and to import the users/groups using the import feature of Mountain Lion Server app.
    My question is: is there a command line way to do the export ? Since Work Group manager seems to be kind of deprecated in ML, I assume there must be some other way (i.e., from the command line) to do the user/group import and export.
    Thanks for your help !

    Notice that the old Archive and Restore options are gone. To run a backup, run the slapconfig command along with the -backupdb option followed by a path to a folder to back the data up to: 
    sudo slapconfig -backupdb /odbackups
    To restore a database (such as from a previous version of the operating system where such an important option was actually present) use the following command (which just swaps backupdb with -restoredb) 
    sudo slapconfig -restoredb /odbackups
    /usr/sbin/ServerBackup -cmd backup -source /

  • Cannot delete users from the Central Management Console

    I cannot delete users from the Central Management Console.  I'm logged in to Enterprise as administrator but still get the following error:
    There was an error while writing data back to the server: Sorry, you do not have the right to 'Delete objects' (id - 22) for 'koberg' (id - 725415). Please contact your system or permissions administrator if you require this right.
    Thanks in advance for any help on this matter.

    Oops, my mistake, sorry. Ok, so the Administrator cannot delete user koberg.
    Check top level:
    Logon to CMC, browse to Home > Settings and select the Rights tab. These are your top level settings. Factory default will show only Administrators and Everyone. Select the Net Access "Advanced" for the Administrators group. NB: Do not select these group names links - they will jump you out of the top level! On the Advanced rights page, ensure the right to "Delete objects" is explicitly granted.
    Then set for the Users top level folder:
    In the CMC, browse to Home, and select Users. Select the "Rights" button. Again - NB: Do not select these group names links - they will jump you out of the Users top level folder! Set the Administrators group to "Full Control". Save.
    That should be all you need. However, there is a possibility the previous admin was busy setting security not only at the account level, but on groups so we need to verify the user:
    In the CMC, browse to Home, and select Users. In the User list, select koberg. In the koberg account page, select the Rights tab. If the Administrators is not set to (Inherited Rights), make it so, and when you select the "Update" button, you should see the Net Access update to "Full Control". If this is the case, you should follow these steps on each account and accomplish this.
    And if you still can't delete it, verify the groups:
    In the CMC, browse to Home, and select Users. In the User list, select koberg. In the koberg account page, select the "Member of" tab. Note all groups koberg is a member of. Then in the CMC, browse to Home, and select Groups. Select the name hyperlink for the group(s) that koberg belongs to. On the group page, select the Rights tab, and ensure the Administrators have (Inherited Rights) - Full Control on all of these, also. If not, set it.
    Finally, I know you inherited this, but let's overview some basics of simplifying your deployment administration. Follow these guidelines, and your administration life will be so much easier.
    1. The Everyone group should never have any subgroups. Ever. All accounts on the system are a member of the Everyone group. Adding subgroups to the Everyone group is redundant.
    2. For simplicity's sake, Application level access should be set on the Adminstrators Group, and the Everyone group. I know there are customers who add groups to application rights. I don't understand why users would have an account on the system if they are not allowed access to InfoView, but it's your system.
    3. From a report object perspective, the Everyone group should be set at the top level to "No Access". This will result in them having no rights on anything at all. You break this inheritance at the application level to give them access to InfoView and other apps. On folders and objects, you ADD groups, then assign (ADD) rights as desired.
    4. If you can help it, never explicitly deny a right to any user or group for any object or application. Explicitly deny overrides any other setting. If a user belongs to group A and group B, and group A is explicitly denied a right, you can explicitly grant it for group B or the user all day long, and it will still be denied. Always try to put yourself in the position of adding groups/users, and adding rights, then inheriting as far down the folder tree as you can.

  • Getting error while removinf user from AD group

    Hi,
    In AD User process definition, there is a default taks called :Remove user from Group. This task runs after another task called Organization Name Update . Whenever, an user is moved from one org to another org, his organization gets updated in AD user form and this task"Remove user from Group" runs. The work of this task is to remove the user from old groups. BUt the task is getting rejected and i see the below error in log files.
    11/07/04 00:24:17 Data AccessException:
    11/07/04 00:24:17 com.thortech.xl.orb.dataaccess.tcDataAccessException: DB_READ_FAILEDDetail: SQL: select UD_ADUSRC_GROUPNAME from UD_ADUSRC where UD_ADUSRC_KEY = Description: ORA-00936: missing expression
    SQL State: 42000Vendor Code: 936Additional Debug Info:com.thortech.xl.orb.dataaccess.tcDataAccessException
    at com.thortech.xl.dataaccess.tcDataAccessExceptionUtil.createException(Unknown Source)
    at com.thortech.xl.dataaccess.tcDataBase.createException(Unknown Source)
    at com.thortech.xl.dataaccess.tcDataBase.readPartialStatement(Unknown Source)
    at com.thortech.xl.dataobj.tcDataBase.readPartialStatement(Unknown Source)
    at com.thortech.xl.dataaccess.tcDataSet.executeQuery(Unknown Source)
    at com.thortech.xl.dataobj.tcDataSet.executeQuery(Unknown Source)
    at com.thortech.xl.dataaccess.tcDataSet.executeQuery(Unknown Source)
    at com.thortech.xl.dataobj.tcDataSet.executeQuery(Unknown Source)
    at com.thortech.xl.adapterfactory.events.tcAdpEvent.getChildTableFieldValue(Unknown Source)
    at com.thortech.xl.adapterfactory.events.tcAdpEvent.getRunTimeValue(Unknown Source)
    at com.thortech.xl.adapterfactory.events.tcAdpEvent.getRunTimeValue(Unknown Source)
    at com.thortech.xl.adapterGlue.ScheduleItemEvents.adpADREMOVEUSERFROMGROUP.implementation(adpADREMOVEUSERFROMGROUP.java:48)
    If anybody knows the solution for this then plz let me know.
    Thanks,
    Kalpana.

    I think the mappings and all would be correct. Here is what Kevin meant:
    - Let's assume the AD user account is a part of GroupA, GroupB and GroupC
    - Now on Change Organization completion if you invoke Remove user from Group then the adapter/process task has no way to know that which 3 of those groups has to be removed (or all 3 for your case)
    - Alternatively if you use API's to remove the group then this task would be invoked by the original OIM process/triggers and so the actual value would be known to adapter/process task.

  • Work Group Manager Reports and Logs

    Mac Manager maintains logs and display current activity information somewhat different that Work Group Manager. With Mac Manager we are able to quickly report for Activity Log, Disk Usage, Connected Machines, Printer Quotas, Workgroup by User, Computers, Checked Out Computers and user activity.
    How can we duplicate such a report with Work Group Manager?
    We are a school district that is 88% Macintosh and miss the reports and logs feature in Mac Manager (10.3.9).
    Hope to hear and find a solution to this challenge.
    Marco Baeza, Director of Technology

    Hello,
    Possibly some ideas here. http://www.macintouch.com/macmanager.html
    Carolyn

  • Remove user from multiple groups

    Hello everyone, first time posting here with a question and I apologize if I'm asking in the wrong location.
    To give an idea of what I'm attempting to do, I've recently been developing a vbscript that will take a nightly csv export from my student information system and either create or deactivate student accounts based upon their enrollment status.  I have
    this function working great now, another function I've been developing is to have accounts moved between OU's based upon the school building code assigned to students which I have working as well.  The problem I'm running into right now is having students
    removed from existing active directory groups when they move between OU's.  Essentially what I would like to do is have the script load the users group membership into an array and then remove any groups that end with STUDENTS, below is the code I have
    been working on to accomplish this but have literally hit a brick wall.  If it helps all my student groups for each location runs in this fashion.
    ABCD_STUDENTS
    ABCE_STUDENTS
    Any suggestions would be greatly appreciated.
    ' Student changing OU then we need to update their account to reflect appropriate group memberships.
    Set UserObj = GetObject("WinNT://server.domain.net/" & ADusrname) 'This must be hardcoded to domain controller
    strUserDN = DN
    strUserCN = objuser.cn
    'Add user to the school group if not correct
    Set objGroup = GetObject(varSchoolGroup)
    strUserDN = DN ' Bind to the user object.
    strGroupDN = varSchoolGroup ' Specify group Distinguished Name and check for membership.
    Set objADObject = GetObject("LDAP://"& strUserDN)
    objmemberOf = objadobject.GetEx("memberOf")
    If Not (funIsMember (GetObject("LDAP://" & strUserDN),varSchoolGroup)) Then
    objmemberOf = objadobject.GetEx("memberOf")
    For Each objGroup in objmemberOf
    Set objGroupDelete = GetObject ("LDAP://" & objGroup)
    If Mid(objgroup,7,8) = "STUDENTS" Then
    msgbox "test remove"
    objGroupDelete.PutEx ADS_PROPERTY_DELETE,"member",Array(strUserDN)
    objGroupDelete.setinfo
    subUpdateLogFile studentcounter & " - Removed from student group " & objgroup,student_guid,student_username,student_fullname,"removed group"
    End If
    Next
    'Add user to school group
    Set objGroup = GetObject(varSchoolGroup)
    objGroup.PutEx ADS_PROPERTY_APPEND, "member", Array(struserdn)
    objGroup.SetInfo
    subUpdateLogFile studentcounter & " - Updated school group to " & student_schoolgroup_ldap,student_guid,student_username,student_fullname,"school group"
    objUser.SetInfo
    updated = "yes"
    End If
    Any suggestions would be greatly appreciated.

    With Bill.  This can be done with AD and PowerShell in a couple of lines for reach item.
    You are taking an incorrect approach which is making this much harder than it needs to be.  Your question is also hard to understand.
    Each AD usre object obtained via ADSI will have a list of groups the account is a member of.  You use this to remove the user from the group.  How you choose this is up to you.  You can use an array or a file.  You can also =just use
    OU associated groups.  A user then is added to all or some groups associated with the OU and removed from the groups associated with the OU by just returning the OU associated group list from the OUs.
    Designing AD systems is a specialty.  Once you fully understand the features and capabilities of AD these things are usually simple and painless.  If the design is not done well they are painful and faulty.
    We can answer specific questions.  Understaning the design and capabilities of AD is mostly up to you.
    Start with a tool that is designed to work well with AD like PowerShell. VBScritp is onluy useful to those who are skilled with AD and scripting in VBSdcript.  From your script we can see you are a beginner at both.  As Bill notes...do yourself
    a favor and switch to PowerShell.
    ¯\_(ツ)_/¯

  • OSX Server 10.7 work group manager duplicating printers is OSX 10.7 MBP 15"

    Hello Everyone,
    I run the mac environment for a K-12 school. We use open directory and work group manager to manage the environment. Its always worked great up until we got our new Macbook Pros, and now our managed printers are duplicating everytime a network user logs in.
    Its crazy. 3 logins has resulted in 9 printers being pushed to the machine. Any ideas?
    OSX Server build 11g63 managing Client OSX Build 11g63b.
    Regards,
    Carl

    I think I resolved the issue by deleting the offending printers off the xserve and re-adding them 1 at a time.
    Then i opened up OD/WGM and added the printers to the managed printers list 1 at a time. I'd add one, login to the client machine 3 times to make sure it stopped replicating, and move on to the next printer.

  • Why can I not see any newly created 'Groups' in 'Work Group Manager' on the client Mac at login?

    Hi. Now, this issue has not been resolved since 10.6 Server. I have now upgraded to Mountain Lion and the issue still persists. I used to easily create Workgroups/Groups in 'WGM' and they would appear at login for those users who were part of that group. As it stands the old created groups appear ok and can be accessed selected at the point of logging in. The newly created groups don't show up at all. They all look good to go when looking at WGM. I have tried removing the Users from the groups and adding them again but there is no change. It is getting me so frustrated!
    Why is this happening? Is there a quick fix for this?
    Any help will be gratefully appreciated.

    Hi. Now thats a hard one to pin point exactly.  I guess you mean Archiving the OD and exporting users and groups etc Yes this happened when we upgraded from 10.5.8 Server to 10.6 Server.
    How do I go about fixing this in Mac OS X Server 10.8.4?  Do I have to go through all that again?  Will I lose any settings in doing so?
    Thanks in advance.

  • Bulk move users from one group to another in XI 3.1

    Hi all,
    I have a group that contains approximately 20,000 users. I now need to move around 7,500 of these users into a different group.
    How can I do this programatically in bulk as I don't want to go through and manually change the groups of 7,500 users?
    Thanks,
    Chris

    Hi Christian,
    Assuming you would need to move users from one group to another and remove them from the previous group, you could use the attached java code.
    To run the code, you would need to save it as .jsp file and paste it inside AdminTools application context.
    The pre-requisite to run this code is to create a Text file with all the 7500 user names in it. The text file should contain one user per line
    (example:
    User1
    User2
    User3
    You can get this information from query builder by running the below query
    Select top 20000 si_name from ci_systemobjects where si_kind='user'
    Initially do it for 2-3 users to text the results.
    You would need to edit the jsp and modify these three lines
    1.
                    * Assign user to a group
                   //Query for the group ID
                   boQuery = "Select SI_ID From CI_SYSTEMOBJECTS Where SI_KIND='UserGroup' And SI_Name='UserGroup name'";
    Above in SI_NAME, you would need to provide the usergroup name you want your users to be added to.
    2.
    if (boUserInfoObject.getGroups().remove(Group Id from which it has to be removed)) {
                            out.print("User removed from group successfully. ");
    Above you would need to provide the id of the group you want the users to be removed from(i.e the current group from where you want them to be moved).
    3.
    * Path to file containing User names.
    final String USER_FILE_PATH = "<Path of txt file from which list of users will be imported>";
    Above you need to specify the path of the text file which contains all the user names.
    Incase you require further assistance on SDKs, raise your concerns in the below space
    http://scn.sap.com/community/bi-platform/java-sdk
    Thanks,
    Prithvi

  • Adding Devices to Work Group Manager Issues

    When I want to add a group of computers to work group manager. Only half of them add with out issue. The other half freeze the application. One thing I noticed is the MAC addresses of the Macs that have the issue do not show up. After I manually type in the MAC addresses it works.
    This topic first appeared in the Spiceworks Community

    Yeah I have and they told me to wait til midnight california time (I am in Australia). So I did and its still not resolved and support is now closed. I am trying to get everything set up asap as we will have a massive workload.

  • Script Help - Adding Users from AD Group to Computer Object Attribute

    Environment:
    Computer Objects have the following name convention - USERNAME-INV#-PC.  An example is TEST1-54321-D.  There is a GPO in place that adds any user populated under the managedBy attribute in a computer object to the administrators group for that computer
    object.
    Scenario:
    Create "Local PC Admin" group
    When user TEST1 gets added to the "Local PC Admin" group, a powershell script that runs on an hourly scheduled task goes out and finds any computer object (that is not a server) that has TEST1 in its name.  For example, TEST1-54321-D for desktop
    and TEST1-98765-L for laptop.
    It then adds the user to the managedBy attribute of the computer object and appends the text "added as local admin on <currentdate>" to the computerobject description.
    If TEST2 is added to the group later, the script should see that TEST1 has already been added and only add TEST2 to the managedBy attribute to the appropriate computer as well as the "added as local admin on <currentdate>".
    Still thinking how this can be automated when a user is removed from the "Local PC Admin" group.
    Can somebody please find holes in this scenario or suggest a better method to approach this?

    Security nightmare?  How so?  Regular domain users cannot modify the "managedBy"  computer object attribute.
    The "Local PC Admin" group would be a ADUC security group.  The Help Desk and Network Admins would be the only ones that can either add users to the group or directly modify the "managedBy" computer object attribute.
    The Group Policy that runs against the desktops/laptops looks to see if the managedBy attribute of the computer object is populated.  If so, it adds that user as a local admin to their workstation/laptop and removes any other user/group not specified
    and given local admin rights.  This would only be done for a handful of users (those in the Local PC Admin group) that need admin access ; in other words, the attribute would only be populated for a few computer objects and not the entire organization.
     If it is not populated, it does nothing and leaves the default admins on it. 
    More info on how the GPO works here: http://fbinotto.blogspot.com/2014/01/making-user-object-set-in-managedby.html

  • Deleting user from Everyone group

    Hi,
    Has anyone done this?
    We have a business need to delete a user from the "Portal Everyone" group and am not able to do it.
    I have tried to pull up the everyone group to list the users in the said group and the "Group" iview times out and also the number of users maxes out the cache.
    Further the users in this could roughly total to 40,000+.
    Thoughts I have range from the following:
    Is there any tweak i can do the server's cache settings to handle that high a volume of users? What/where would I be doing some like that?
    Should I be doing this programatically perhaps?
    Any light on the matter would be grealty appreciated.
    Lastly is there a easier solution I am missing?
    thanx,
    ray

    Hi Ray,
    > Should I be doing this programatically perhaps?
    This maybe would be the fastest solution. Should be something about a five-liner. Use https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/javadocs/nw04/sp12/user management engine - version 4.0/com/sap/security/api/igroup.html#removeusermember(java.lang.String) and save/commit.
    Hope it helps
    Detlev
    PS: Please consider rewarding points for helpful answers on SDN. Thanks in advance!

  • Unable to remove user from SharePoint Group using PowerShell

    I am trying to remove a user from a SharePoint Group using PowerShell.
    I can see the user in the Site Collection as part of the SharePoint Group, however, when I attempt to run the script, I get an error message stating "Can not find the user with ID: 10"
    Below is the PowerShell script that I am using:
    $url = "https://sharepointdev.spfarm.spcorp.com/sites/desitecoll"
    $userName = "spfarm\sp2013_svc"
    #$userName = "spfarm\spprofileimport";
    $site = New-Object Microsoft.SharePoint.SPSite($url)
    $web = $site.OpenWeb()
    $siteGroups = $web.SiteGroups;
    Clear-Host
    $mySiteGroups = @();
    foreach($group in $siteGroups)
    Write-Host $group
    $mySiteGroups += $group;
    }#foreach
    $members = $web.SiteGroups[$mySiteGroups[0]];
    $owners = $web.SiteGroups[$mySiteGroups[1]];
    $visitors = $web.SiteGroups[$mySiteGroups[2]];
    #Remove the user from the specified SharePoint Group
    $spUser = Get-SPUser -Identity $userName -Web $url
    Write-Host $spUser.ID
    Remove-SPUser -Identity $spUser -Web $url -Group $owners
    $web.Update();
    $web.Dispose();
    Write-Host "User " $userName "removed from " $owners
    Please advise.

    I had to update the code to the following because Get-SPUser was not working properly:
    $url = "https://sharepointdev.spfarm.spcorp.com/sites/desitecoll"
    $userName = "spfarm\spprofileimport";
    $site = New-Object Microsoft.SharePoint.SPSite($url)
    $web = $site.OpenWeb()
    $siteGroups = $web.Groups;
    Clear-Host
    $mySiteGroups = @();
    foreach($group in $siteGroups)
    Write-Host $group
    $mySiteGroups += $group;
    }#foreach
    $members = $web.Groups[$mySiteGroups[0]];
    $owners = $web.Groups[$mySiteGroups[1]];
    $visitors = $web.Groups[$mySiteGroups[2]];
    #Convert the user name to an SPUser account
    $spUser = $web.Site.RootWeb.EnsureUser($userName);
    Write-Host $spUser.ID
    Remove-SPUser -Identity $spUser -Web $url -Group $owners
    $web.Update();
    $web.Dispose();
    Write-Host "User " $userName "removed from " $owners
    Was I not using Get-SPUser correctly?

  • Pt:treelink Select Users From Specified Group

    Is there anyway to have the pt:treelink show classid="1' (users) from a specific group? I can pass a rootid="ADMIN_FOLDER_ID" and get it to only list objects in that folder id. I'm looking for something similar to pass a GroupID="X", where X is the group that I want to display users from.
    Thanks,
    Jon Yutzy

    I'm looking for something similar to this, although without specific selecting.
    I would like to popup a list of users inside a group (just to view who's in the group).
    I've seen the plumtree portal itself do this while managing security access to different portal objects. You can click the group name to see who's inside. This is exactly what i'm looking for.
    Considering this post was originally made a year and a half ago, has anything become of this?

  • Moving users from One Group to another

    Hi Guys,
    I am looking for a script which will allow me to move users from One ADGroup to another ADGroup. I have checked ther scripts which are currently present. However, none of them if fixing my issue.
    Details:
    I have Different locations and users moves from one location to another location and same thing happens as they gets moved from one Tower to another Tower (Like From TOWER A to Tower B). Also users gets promoted and most of the time they are in bulk.We also
    have 2 domains one is parent and another is child domain.
    So, I hope above information is making sense and also I Completely new to PS so after going to lot of scripts i asking for help on this. I hope I can gets this sorted out as soon as possible as my work is piling up.

    You are asking a lot of questions about AD.  Do you know how to do this in AD with D tools?
    There is no magic way to guess at what you need. I recommend that you start by learning AD and PowerShell.  There are good resources here:
    http://technet.microsoft.com/en-us/scriptcenter/dd793612.aspx
    ¯\_(ツ)_/¯

Maybe you are looking for