<G> That is why ADMOD doesn't currently support a group scope type of switch along with other bitwise type ops (such as disable, etc). There are difficulties as you will see below.
I expect the fix for this is probably pretty inefficient and could be quite slow if updating a lot of objects, my guess is that it does a lookup on every object prior to updating it to get the current value, no other way to really do it, this means two calls for every update. A more efficient way would be to create a query that picks out the NT security enabled groups and changes their scope and then do it again for non NT security enabled groups. Of course you would have to use the older un-fixed version of dsmod or use admod. As an aside, I dislike the use of the word distribution groups and security groups because both could be used for either. Any group can be a distribution group, the groups are simply NT security enabled or not NT security enabled. joe -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] Sent: Thursday, September 22, 2005 8:36 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] When you change group scopes by using a combination of the Dsquery command When you change group scopes by using a combination of the Dsquery command the Dsmod command, all the group types are changed to either distribution groups or security groups on a Windows Server 2003-based computer: http://support.microsoft.com/?kbid=898063 -- Letting your vendors set your risk analysis these days? http://www.threatcode.com List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
