After some discussion on how to do this, here is a small script to programmatically change the Dial-In status of a user in Active Directory (this is the 'Remote Access Permission' on the 'Dial-In' tab from AD Users & Computers). You would of course enumerate a group or have some other list of users in order to make mass changes. Also, despite earlier problems I have had, OLE is now my friend!
#!win32-perl
use strict;
$|++;
use Win32::OLE;
# Change Dial-In Status for a user
# 20030308 - JDS
# Version: 0.2a
# The DC for the LDAP string
my $ldapdc = "DC=nmh,DC=nmhschool,DC=org";
# OU of the user(s) you want to change
my $ou = "IT";
# User name you want to change - likely will be enumerated from a grou
+p
my $user = "JShearer";
# The Dial-In Status - either True or False depending on whether you w
+ant to Allow or Deny
my $status = 'TRUE';
my $oContainer = Win32::OLE->GetObject("LDAP://CN=$user,OU=$ou,$ldapdc
+");
$oContainer->{msNPAllowDialin} = $status;
$oContainer->SetInfo();
