' The following code creates a global security group.
' ---------------------------------------------------------------
' From the book "Active Directory Cookbook" by Robbie Allen
' ISBN: 0-596-00466-4
' ---------------------------------------------------------------
' ------ SCRIPT CONFIGURATION ------
strGroupParentDN = "<GroupParentDN>"  ' e.g. ou=Groups,dc=rallencorp,dc=com
strGroupName     = "<GroupName>"      ' e.g. ExecAdminsSales
strGroupDescr    = "<GroupDesc>"      ' e.g. Executive Admins for Sales group
' ------ END CONFIGURATION ---------
' Constants taken from ADS_GROUP_TYPE_ENUM
' This was in the book:
' Const ADS_GROUP_TYPE_DOMAIN_LOCAL_GROUP = 1
' When it should be this:
Const ADS_GROUP_TYPE_DOMAIN_LOCAL_GROUP = 4
Const ADS_GROUP_TYPE_GLOBAL_GROUP       = 2
Const ADS_GROUP_TYPE_LOCAL_GROUP        = 4
Const ADS_GROUP_TYPE_SECURITY_ENABLED   = -2147483648
Const ADS_GROUP_TYPE_UNIVERSAL_GROUP    = 8
set objOU = GetObject("LDAP://" & strGroupParentDN)
' This was in the book:
'   set objGroup = objDomain.Create("group","cn=" & strGroupName)
' When it should be this:
set objGroup = objOU.Create("group","cn=" & strGroupName)
objGroup.Put "groupType", ADS_GROUP_TYPE_GLOBAL_GROUP _
                         Or ADS_GROUP_TYPE_SECURITY_ENABLED
' The book example didn't set the samAccountName attribute
' but it really should
objGroup.Put "samAccountName", strGroupName
' This was in the book:
'   objOU.Put "description", strGroupDescr
'   objOU.SetInfo
' When it should be this:
objGroup.Put "description", strGroupDescr
objGroup.SetInfo