#! /usr/bin/perl -w use strict; #∗ #∗ basic local user account creation routine for NT/2000 #∗ use Win32::Lanman; # for account creation use Win32::Perms; # to set the permissions on the home directory

our $homeNTdirs = "\\\\nicksboxv\\home"; # home directory root dir

10

# returns false if successful, true and an error message if there is a # problem. Rather un-Perl like, more like C.

sub CreateNTAccount  CreateNTAccount

{ my ( $account, $password, $fuℓℓname, $group ) = @ ;

# create this account on the local machine # (i.e. empty first parameter) my $resuℓt

= Win32::Lanman::NetUserAdd(  20

                         "",

{

'name' => $account, 'password' => $password,

                          'home_dir' => "$homeNTdirs\\$account",

'full_name' => $fuℓℓname, acct expires => 2∗∗32 − 1; } );

return Win32::Lanman::GetLastError() unless $resuℓt;  30

my @info; # add to appropriate LOCAL group (first get the SID of the account) die "SID lookup error: ".Win32::Lanman::GetLastError()."\n" unless

Win32::Lanman::LsaLookupNames( "", [ $account ], \@info ); $resuℓt = Win32::Lanman::NetLocalGroupAddMember( "", $group,

${$info[0]}{sid} );

return Win32::Lanman::GetLastError() unless $resuℓt;

# create home directory  40

mkdir "$homeNTdirs\\$account", 0777 or return "Unable to make homedir:$!";

# now set the ACL and owner of the directory my $acℓ = new Win32::Perms( "$homeNTdirs\\$account" ); $acℓ−>Owner( $account );

# we give the user full control of the directory and all of the # files that will be created within it (hence the two separate calls)

$acℓ−>Allow( $account, FULL, DIRECTORY |CONTAINER INHERIT ACE );

$acℓ−>Allow( $account, FULL,  50

FILE|OBJECT INHERIT ACE|INHERIT ONLY ACE);

$resuℓt = $acℓ−>Set(); $acℓ−>Close();

return $resuℓt ? "" : $resuℓt; }

#∗ #∗ basic account deletion routine for NT/2000

#∗  60

use Win32::Lanman; # for account deletion use File::Path; # for recursive directory deletion

sub DeleteNTAccount  DeleteNTAccount

{ my ( $account, $server, $record ) = @ ; my @info; # remove user from LOCAL groups only. If we wanted to also

# remove from global groups we could remove the word “Local” from  70

# the two Win32::Lanman::NetUser∗ calls ∗e.g. NetUserGetGroups) die "SID lookup error: ".Win32::Lanman::GetLastError()."\n" unless

( Win32::Lanman::LsaLookupNames( "", [ $account ], \@info ) ); my @groups; Win32::Lanman::NetUserGetLocalGroups( $server, $account, '', \@groups ); foreach my $group ( @groups ) {

   print "Removing user from local group ".$group−>{name}."...";

print( Win32::Lanman::NetLocalGroupDelMember( "",

$group−>{name},  80
${$info[0]}{sid} )

         ? "succeeded\n" : "FAILED\n"

); }

# delete this account on the local machine # (i.e. empty first parameter) my $resuℓt = Win32::Lanman::NetUserDel( "", $account );

return Win32::Lanman::GetLastError() if $resuℓt;  90

# delete the home directory and its contents

$resuℓt = rmtree( "$homeNTdirs\\$account", 0, 1 );

# rmtree returns the number of items deleted, # so if we deleted more than 0,it is likely that we succeeded

return $resuℓt; }

my $resuℓt  100

   = CreateNTAccount( "test", "testpasswd", "The Test User", "testgroop" );

unless ( $resuℓt ) {

   print "good, it worked\n";

} else {

   print "Cannot create test account: $result";

}