Thank you to the Monks who helped me through the problem of using Perl to change the settings of the Dial-In permission in an AD domain. I have run into another issue: Setting to Allow or Deny access is easy. How do you change the setting to be "Control access by policy"? I have done quite a bit of research on the subject and have found references to query for this setting, but none that show how change to it. It is a boolean value, which should be 'Yes/No', 'True/False', '1,0', etc. But there is a third setting: Undefined! (Which appears to be what is necessary.) Here is my current code snippet and my question: You would use 'True/Flase' to allow or deny access in this script. How would you make the change to control access by policy (set msNPAllowDialin to undefined)?

#!win32-perl 
use strict;
$|++;

use Win32::OLE;

# Change Dial-In Status for a user
# 20030308 - JDS
# Version:  0.2b

# The DC for the LDAP string
my $ldapdc = "DC=domain,DC=org";

# OU of the user(s) you want to change
my $ou = "IT";

# User name you want to change 
my $user = "JShearer";

# The Dial-In Status - either True or False depending on whether you w
+ant to Allow or Deny
my $status = 'TRUE';

my $oContainer = Win32::OLE->GetObject("LDAP://CN=$user,OU=$ou,$ldapdc
+");
print Win32::OLE->LastError();

$oContainer->{msNPAllowDialin} = $status;
$oContainer->SetInfo();
[download]