[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1312
  • Last Modified:

Is there a way to dump group members in a Universal Group

I am looking to get all the members of a universal group. The current script below prompts for a group name and dumps members, but on Universal groups it ignores members outside of my domain and does not list them.

I would like to be able to dump all members of the group regardless of domain.

Can anyone offer a script that does so? Thanks!


Option Explicit
Dim Group, count
Dim GroupName
Dim GroupDomain
Dim Member
Dim txt
Dim oFileSys, strCurrDir, strDefaultNamingContext, oRoot, objUser
 
Set oFileSys = WScript.CreateObject("Scripting.FileSystemObject")
strCurrDir = oFileSys.GetAbsolutePathName(".")
 
' ******************************************
' Edit This for your Environment!
' ******************************************
 
GroupDomain = "domain.com"
 
' ******************************************
 
 
' Find our default naming context...
Set oRoot = GetObject("LDAP://rootDSE")
strDefaultNamingContext = oRoot.get("defaultNamingContext")
Set oRoot = Nothing
 
GroupName = InputBox ("Group Name to list Members: ", "Enter Group Name")
If GroupName = "" Then
    MsgBox("Must enter a group name!")
    WScript.quit(1)
End If
 
Set oFileSys = CreateObject ("Scripting.FileSystemObject")
Set txt = oFileSys.OpenTextFile (strCurrDir & "\" & GroupName & " members.txt", 8, True)
 
Set Group = GetObject("WinNT://" & GroupDomain & "/" & GroupName & ",group")
 
count = 0
 
For Each Member in Group.Members
 
    WScript.Echo "Finding Username " & Member.Name
    
    On Error Resume next
    Err.Clear()
    Set objUser = GetObject(getLdapUN(Member.Name))
    If Err<>0 Then
        WScript.Echo "Error getting information for: " & Member.Name
        txt.WriteLine Member.Name & vbtab & "Error - No Rights" & vbtab & "Error - No Rights"
        
    Else
        
        WScript.Echo "Description: " & objUser.description
        WScript.Echo "Office: " & objUser.physicalDeliveryOfficeName
    
        txt.WriteLine Member.Name & vbtab & objUser.description & vbtab & objUser.physicalDeliveryOfficeName
    
    End if
    
    count = count + 1
 
Next
 
WScript.Echo vbcrlf
WScript.Echo "A total of " & count & " accounts are members of the " & GroupName & " group."
WScript.Echo vbcrlf
WScript.Echo "Text file " & strCurrDir & "\" & GroupName & " members.txt" & " contains the list of users in this group."
 
 
' *************************************************
' Functions and Subroutines
' *************************************************
 
Function getLdapUN(strUN)
Dim oConnect, Command, strLdapQuery, Rs
 
getLdapUN = False
 
Set oConnect = CreateObject("ADODB.Connection")
Set Command = CreateObject("ADODB.Command")
 
 
'--- search for object in AD ---
strldapquery = "<LDAP://" & strDefaultNamingContext & ">;" & _
"(&(objectCategory=person)(objectClass=user)(sAMAccountName=" & _
strUN & "));ADsPath,cn;subtree"
 
oConnect.Provider = "ADsDSOObject"
oConnect.Open "Active Directory Provider"
 
Set Command.ActiveConnection = oConnect
 
Command.CommandText = strldapquery 'strSQL
 
Set Rs = Command.Execute 'Execute the query
 
'WScript.Echo "Records: " & Rs.RecordCount
 
If Rs.RecordCount > 0 Then
    getLdapUN = rs("AdsPath")
End If
 
Set oConnect = Nothing
Set Command = Nothing
 
End Function

Open in new window

0
lotharpenguin
Asked:
lotharpenguin
  • 4
1 Solution
 
lotharpenguinAuthor Commented:
I am still looking into this and I cannot find a decent way to do this. Of course I am quite horrible at programming so that doesn't help
0
 
Netman66Commented:
You can do this with the Support Tools natively.

Get all Universal groups:

dsquery * "dc=domain,dc=com" -limit 0 -scope subtree -filter "(&(objectCategory=group)(groupType=-2147483640))"

You can Pipe that to this command for the membership:

dsget group -members

The whole command would be something like:

dsquery * "dc=domain,dc=com" -limit 0 -scope subtree -filter "(&(objectCategory=group)(groupType=-2147483640))" | dsget group -members



0
 
lotharpenguinAuthor Commented:
OMG..How did I miss that. Time to try this in the morning.
0
 
lotharpenguinAuthor Commented:
DSquery was certainly the right answer.
0
 
lotharpenguinAuthor Commented:
I'll add that dsquery was in fact what I needed to use but here is the full command to get the info form a specific group and not just all groups.




dsquery * "DC=domain,DC=com" -limit 0 -scope subtree -filter "(&(objectCategory=group)(groupType=-2147483640))" | dsget group "CN=groupname,OU=ouname,DC=domain,DC=com" -members > members.txt

Open in new window

0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now