http://qs321.pair.com?node_id=241750
Category: Win32 Stuff
Author/Contact Info John Shearer (jds@jkshearer.com)
Description: After some discussion on how to do this, here is a small script to programmatically change the Dial-In status of a user in Active Directory (this is the 'Remote Access Permission' on the 'Dial-In' tab from AD Users & Computers). You would of course enumerate a group or have some other list of users in order to make mass changes. Also, despite earlier problems I have had, OLE is now my friend!
#!win32-perl 
use strict;
$|++;

use Win32::OLE;

# Change Dial-In Status for a user
# 20030308 - JDS
# Version:  0.2a

# The DC for the LDAP string
my $ldapdc = "DC=nmh,DC=nmhschool,DC=org";

# OU of the user(s) you want to change
my $ou = "IT";

# User name you want to change - likely will be enumerated from a grou
+p
my $user = "JShearer";

# The Dial-In Status - either True or False depending on whether you w
+ant to Allow or Deny
my $status = 'TRUE';

my $oContainer = Win32::OLE->GetObject("LDAP://CN=$user,OU=$ou,$ldapdc
+");
$oContainer->{msNPAllowDialin} = $status;
$oContainer->SetInfo();