[Last Call] Learn how to a build a cloud-first strategyRegister Now

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1312
  • Last Modified:

Is there a way to dump group members in a Universal Group

I am looking to get all the members of a universal group. The current script below prompts for a group name and dumps members, but on Universal groups it ignores members outside of my domain and does not list them.

I would like to be able to dump all members of the group regardless of domain.

Can anyone offer a script that does so? Thanks!

Option Explicit
Dim Group, count
Dim GroupName
Dim GroupDomain
Dim Member
Dim txt
Dim oFileSys, strCurrDir, strDefaultNamingContext, oRoot, objUser
Set oFileSys = WScript.CreateObject("Scripting.FileSystemObject")
strCurrDir = oFileSys.GetAbsolutePathName(".")
' ******************************************
' Edit This for your Environment!
' ******************************************
GroupDomain = "domain.com"
' ******************************************
' Find our default naming context...
Set oRoot = GetObject("LDAP://rootDSE")
strDefaultNamingContext = oRoot.get("defaultNamingContext")
Set oRoot = Nothing
GroupName = InputBox ("Group Name to list Members: ", "Enter Group Name")
If GroupName = "" Then
    MsgBox("Must enter a group name!")
End If
Set oFileSys = CreateObject ("Scripting.FileSystemObject")
Set txt = oFileSys.OpenTextFile (strCurrDir & "\" & GroupName & " members.txt", 8, True)
Set Group = GetObject("WinNT://" & GroupDomain & "/" & GroupName & ",group")
count = 0
For Each Member in Group.Members
    WScript.Echo "Finding Username " & Member.Name
    On Error Resume next
    Set objUser = GetObject(getLdapUN(Member.Name))
    If Err<>0 Then
        WScript.Echo "Error getting information for: " & Member.Name
        txt.WriteLine Member.Name & vbtab & "Error - No Rights" & vbtab & "Error - No Rights"
        WScript.Echo "Description: " & objUser.description
        WScript.Echo "Office: " & objUser.physicalDeliveryOfficeName
        txt.WriteLine Member.Name & vbtab & objUser.description & vbtab & objUser.physicalDeliveryOfficeName
    End if
    count = count + 1
WScript.Echo vbcrlf
WScript.Echo "A total of " & count & " accounts are members of the " & GroupName & " group."
WScript.Echo vbcrlf
WScript.Echo "Text file " & strCurrDir & "\" & GroupName & " members.txt" & " contains the list of users in this group."
' *************************************************
' Functions and Subroutines
' *************************************************
Function getLdapUN(strUN)
Dim oConnect, Command, strLdapQuery, Rs
getLdapUN = False
Set oConnect = CreateObject("ADODB.Connection")
Set Command = CreateObject("ADODB.Command")
'--- search for object in AD ---
strldapquery = "<LDAP://" & strDefaultNamingContext & ">;" & _
"(&(objectCategory=person)(objectClass=user)(sAMAccountName=" & _
strUN & "));ADsPath,cn;subtree"
oConnect.Provider = "ADsDSOObject"
oConnect.Open "Active Directory Provider"
Set Command.ActiveConnection = oConnect
Command.CommandText = strldapquery 'strSQL
Set Rs = Command.Execute 'Execute the query
'WScript.Echo "Records: " & Rs.RecordCount
If Rs.RecordCount > 0 Then
    getLdapUN = rs("AdsPath")
End If
Set oConnect = Nothing
Set Command = Nothing
End Function

Open in new window

  • 4
1 Solution
lotharpenguinAuthor Commented:
I am still looking into this and I cannot find a decent way to do this. Of course I am quite horrible at programming so that doesn't help
You can do this with the Support Tools natively.

Get all Universal groups:

dsquery * "dc=domain,dc=com" -limit 0 -scope subtree -filter "(&(objectCategory=group)(groupType=-2147483640))"

You can Pipe that to this command for the membership:

dsget group -members

The whole command would be something like:

dsquery * "dc=domain,dc=com" -limit 0 -scope subtree -filter "(&(objectCategory=group)(groupType=-2147483640))" | dsget group -members

lotharpenguinAuthor Commented:
OMG..How did I miss that. Time to try this in the morning.
lotharpenguinAuthor Commented:
DSquery was certainly the right answer.
lotharpenguinAuthor Commented:
I'll add that dsquery was in fact what I needed to use but here is the full command to get the info form a specific group and not just all groups.

dsquery * "DC=domain,DC=com" -limit 0 -scope subtree -filter "(&(objectCategory=group)(groupType=-2147483640))" | dsget group "CN=groupname,OU=ouname,DC=domain,DC=com" -members > members.txt

Open in new window


Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now