Recipe 6.15 Changing a User's Primary Group

6.15.1 Problem

You want to change the primary group of a user.

6.15.2 Solution Using a graphical user interface
  1. Open the Active Directory Users and Computers snap-in.

  2. In the left pane, right-click on the domain and select Find.

  3. Select the appropriate domain beside In.

  4. Type the name of the user beside Name and click Find Now.

  5. In the Search Results, double-click on the user.

  6. Click the Member Of tab.

  7. Click on the name of the group you want to set as the primary group.

  8. Click the Set Primary Group button.

  9. Click OK. Using VBScript
' This code first checks to see if the user's primary group is already
' set to the specified group.  If not it will a) add the user to the group
' if not already a member and b) set the primary group id to the group.
strUserDN  = "<UserDN>"    ' e.g. cn=rallen,ou=Sales,dc=rallencorp,dc=com
strGroupDN = "<GroupDN>"   ' e.g. cn=SalesGroup,ou=Sales,dc=rallencorp,dc=com
' ------ END CONFIGURATION ---------


set objUser = GetObject("LDAP://" & strUserDN )

set objGroup = GetObject("LDAP://" & strGroupDN )
objGroup.GetInfoEx Array("primaryGroupToken"), 0
if objGroup.Get("primaryGroupToken") = objUser.Get("primaryGroupID") then
   WScript.Echo "Primary group for user already set to " & strGroupDN
end if

intAddMember = 1
for each strMemberDN in objUser.GetEx("memberOf")
   if LCase(strMemberDN) = LCase(strGroupDN) then
      intAddMember = 0
      Exit for
   end if

if intAddMember > 0 then
   objGroup.PutEx ADS_PROPERTY_APPEND, "member", Array(strUserDN)
   WScript.Echo "Added " & strUserDN & " as member of " & strGroupDN
end if 

objUser.Put "primaryGroupID", objGroup.Get("primaryGroupToken")
WScript.Echo "Changed primary group id of " & strUserDN & _
             " to " & objGroup.Get("primaryGroupToken")

6.15.3 Discussion

The primary group is a holdover from Windows NT that was used to support Macintosh and POSIX clients, but it is not used actively in Active Directory. That said, you might have some legacy applications that depend on the primary group, and therefore, you may have to change some users' primary group.

Changing the primary group is not difficult, but it is not straightforward either. The primary group is stored on user objects in the primaryGroupID attribute, which contains the RID of the primary group. You can obtain this value by querying the primaryGroupToken attribute on the target group object. Before you can set the primaryGroupID on the user object, you have to first make sure the user is a member of the group. If you try to set the primaryGroupID for a group in which the user is not a member, you will get an error.

The default primaryGroupID is set to 513 (Domain Users) for all users.

6.15.4 See Also

Recipe 7.8 for determining the group name given a group ID, MS KB 297951 (HOWTO: Use the PrimaryGroupID Attribute to Find the Primary Group for a User), MS KB 321360 (How to Use Native ADSI Components to Find the Primary Group), and MS KB 243330 (Well Known Security Identifiers in Windows 2000)

    Chapter 3. Domain Controllers, Global Catalogs, and FSMOs
    Chapter 6. Users
    Appendix A. Tool List