Is there a way to dump group members in a Universal Group

Posted on 2008-11-19
Last Modified: 2012-05-05
I am looking to get all the members of a universal group. The current script below prompts for a group name and dumps members, but on Universal groups it ignores members outside of my domain and does not list them.

I would like to be able to dump all members of the group regardless of domain.

Can anyone offer a script that does so? Thanks!

Option Explicit

Dim Group, count

Dim GroupName

Dim GroupDomain

Dim Member

Dim txt

Dim oFileSys, strCurrDir, strDefaultNamingContext, oRoot, objUser

Set oFileSys = WScript.CreateObject("Scripting.FileSystemObject")

strCurrDir = oFileSys.GetAbsolutePathName(".")

' ******************************************

' Edit This for your Environment!

' ******************************************

GroupDomain = ""

' ******************************************

' Find our default naming context...

Set oRoot = GetObject("LDAP://rootDSE")

strDefaultNamingContext = oRoot.get("defaultNamingContext")

Set oRoot = Nothing

GroupName = InputBox ("Group Name to list Members: ", "Enter Group Name")

If GroupName = "" Then

    MsgBox("Must enter a group name!")


End If

Set oFileSys = CreateObject ("Scripting.FileSystemObject")

Set txt = oFileSys.OpenTextFile (strCurrDir & "\" & GroupName & " members.txt", 8, True)

Set Group = GetObject("WinNT://" & GroupDomain & "/" & GroupName & ",group")

count = 0

For Each Member in Group.Members

    WScript.Echo "Finding Username " & Member.Name


    On Error Resume next


    Set objUser = GetObject(getLdapUN(Member.Name))

    If Err<>0 Then

        WScript.Echo "Error getting information for: " & Member.Name

        txt.WriteLine Member.Name & vbtab & "Error - No Rights" & vbtab & "Error - No Rights"




        WScript.Echo "Description: " & objUser.description

        WScript.Echo "Office: " & objUser.physicalDeliveryOfficeName


        txt.WriteLine Member.Name & vbtab & objUser.description & vbtab & objUser.physicalDeliveryOfficeName


    End if


    count = count + 1


WScript.Echo vbcrlf

WScript.Echo "A total of " & count & " accounts are members of the " & GroupName & " group."

WScript.Echo vbcrlf

WScript.Echo "Text file " & strCurrDir & "\" & GroupName & " members.txt" & " contains the list of users in this group."

' *************************************************

' Functions and Subroutines

' *************************************************

Function getLdapUN(strUN)

Dim oConnect, Command, strLdapQuery, Rs

getLdapUN = False

Set oConnect = CreateObject("ADODB.Connection")

Set Command = CreateObject("ADODB.Command")

'--- search for object in AD ---

strldapquery = "<LDAP://" & strDefaultNamingContext & ">;" & _

"(&(objectCategory=person)(objectClass=user)(sAMAccountName=" & _

strUN & "));ADsPath,cn;subtree"

oConnect.Provider = "ADsDSOObject"

oConnect.Open "Active Directory Provider"

Set Command.ActiveConnection = oConnect

Command.CommandText = strldapquery 'strSQL

Set Rs = Command.Execute 'Execute the query

'WScript.Echo "Records: " & Rs.RecordCount

If Rs.RecordCount > 0 Then

    getLdapUN = rs("AdsPath")

End If

Set oConnect = Nothing

Set Command = Nothing

End Function

Open in new window

Question by:lotharpenguin

    Author Comment

    I am still looking into this and I cannot find a decent way to do this. Of course I am quite horrible at programming so that doesn't help
    LVL 51

    Accepted Solution

    You can do this with the Support Tools natively.

    Get all Universal groups:

    dsquery * "dc=domain,dc=com" -limit 0 -scope subtree -filter "(&(objectCategory=group)(groupType=-2147483640))"

    You can Pipe that to this command for the membership:

    dsget group -members

    The whole command would be something like:

    dsquery * "dc=domain,dc=com" -limit 0 -scope subtree -filter "(&(objectCategory=group)(groupType=-2147483640))" | dsget group -members


    Author Comment

    OMG..How did I miss that. Time to try this in the morning.

    Author Closing Comment

    DSquery was certainly the right answer.

    Author Comment

    I'll add that dsquery was in fact what I needed to use but here is the full command to get the info form a specific group and not just all groups.

    dsquery * "DC=domain,DC=com" -limit 0 -scope subtree -filter "(&(objectCategory=group)(groupType=-2147483640))" | dsget group "CN=groupname,OU=ouname,DC=domain,DC=com" -members > members.txt

    Open in new window


    Featured Post

    Highfive Gives IT Their Time Back

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    Join & Write a Comment

    The saying goes a bad carpenter blames his tools. In the Directory Services world a bad system administrator, well, even with the best tools they’re probably not going to become an all star.  However for the system admin who is willing to spend a li…
    Mapping Drives using Group policy preferences Are you still using old scripts to map your network drives if so this article will show you how to get away for old scripts and move toward Group Policy Preference for mapping them. First things f…
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
    This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    23 Experts available now in Live!

    Get 1:1 Help Now