VB script to list all memebers in Domain admin, schema admin and enterprise admin group

Hi XXDCMAST,
The script you wrote only shows domain admins, what about schema admin and enterprise admin?

Thanks

Just gotta replace the names between the " "

dsquery group -samid "schema admins" | dsget group -members -expand
dsquery group -samid "enterprise admins" | dsget group -members -expand

awesome, what about all regular user accounts? Thanks

What do you mean by regular user accounts? If by that you mean domain users that would be everybody?

That would just be dsquery user -samid *

Thats not really much help though because every persin in AD will be listed.

Regular user accounts meaning anybody except Domain admin, schema admin and enterprise admin..

Is there a way to query that?

Thanks alot!

Thats doable but very much trickier. It involves a pretty hefty LDAP filter and gets pretty ugly.

Here is an example for users who are not a member of domain admins.

(&(&(&(&(|(&(objectCategory=person)(objectSid=*)(!samAccountType:1.2.840.113556.1.4.804:=3))(&(objectCategory=person)(!objectSid=*))(&(objectCategory=group)(groupType:1.2.840.113556.1.4.804:=14))))(objectCategory=user)(!memberOf=CN=Domain Admins,CN=Users,DC=domain,DC=com))))

                                              

1:

Well I guess if you really want it here it is lol.

dsquery * -filter "(&(&(&(&(&(|(&(objectCategory=person)(objectSid=*)(!samAccountType:1.2.840.113556.1.4.804:=3))(&(objectCategory=person)(!objectSid=*))(&(objectCategory=group)(groupType:1.2.840.113556.1.4.804:=14))))(objectCategory=user)(!memberOf=CN=Domain Admins,CN=Users,DC=domain,DC=com)(!memberOf=CN=Enterprise Admins,CN=Users,DC=domain,DC=com)(!memberOf=CN=Schema Admins,CN=Users,DC=domain,DC=com)))))" -limit 0

                                              

1:

Thanks so much!
But when I excute the command, it ran into an endless loop....Please advise tahnks

The thing that makes these commands tricky is they use the distinguished names of the groups.

That is this part of the queries "CN=Schema Admins,CN=Users,DC=domain,DC=com"

You need to modify that so that it points to the distinguished names of your groups.

Hi xxdcmast:

Is there a way to only query certain OU instead of the whole domain?
I just want to run a query on Users OU under my domain...
Please advise.

Thanks

Correct, I want to run the OU only on Selected OUs...Is there a way to do taht?

Thanks

So, say if I just want to exclude one OU ,does the script go as
DSQUERY * !{ DN of the OU i want to exclude} -filter ..............?

Thank you very much!

The DN of start node is actually the ou that you do want to query.

And also just for good measure and because powerhsell is going to be the new go to tool here is a cool tool and a way of doing this much cleaner in powershell.

Quest powershell cmdlets
http://www.quest.com/powershell/activeroles-server.aspx

get-qaduser -notmemberof "domain\domain admins", "domain\enterprie admins", "domain\schema admins"

Im just learning this myself so its a good practice for me too

understood. I will just run the query multiple times for now.
One last question, when I type in my DN name, it gave me an error. I tried to query the Users OU .
DSQUERY * Users -filter ..............?


Thanks

If that is what you typed thats not the DN of your OU. Distinguished names are always in the form CN=Domain Admins,CN=Users,DC=domain,DC=com starting with the object and then traversing backwards up the AD tree until you hit your domain.com