Is there a way to dump group members in a Universal Group

I am looking to get all the members of a universal group. The current script below prompts for a group name and dumps members, but on Universal groups it ignores members outside of my domain and does not list them.

I would like to be able to dump all members of the group regardless of domain.

Can anyone offer a script that does so? Thanks!


Option Explicit
Dim Group, count
Dim GroupName
Dim GroupDomain
Dim Member
Dim txt
Dim oFileSys, strCurrDir, strDefaultNamingContext, oRoot, objUser
 
Set oFileSys = WScript.CreateObject("Scripting.FileSystemObject")
strCurrDir = oFileSys.GetAbsolutePathName(".")
 
' ******************************************
' Edit This for your Environment!
' ******************************************
 
GroupDomain = "domain.com"
 
' ******************************************
 
 
' Find our default naming context...
Set oRoot = GetObject("LDAP://rootDSE")
strDefaultNamingContext = oRoot.get("defaultNamingContext")
Set oRoot = Nothing
 
GroupName = InputBox ("Group Name to list Members: ", "Enter Group Name")
If GroupName = "" Then
    MsgBox("Must enter a group name!")
    WScript.quit(1)
End If
 
Set oFileSys = CreateObject ("Scripting.FileSystemObject")
Set txt = oFileSys.OpenTextFile (strCurrDir & "\" & GroupName & " members.txt", 8, True)
 
Set Group = GetObject("WinNT://" & GroupDomain & "/" & GroupName & ",group")
 
count = 0
 
For Each Member in Group.Members
 
    WScript.Echo "Finding Username " & Member.Name
    
    On Error Resume next
    Err.Clear()
    Set objUser = GetObject(getLdapUN(Member.Name))
    If Err<>0 Then
        WScript.Echo "Error getting information for: " & Member.Name
        txt.WriteLine Member.Name & vbtab & "Error - No Rights" & vbtab & "Error - No Rights"
        
    Else
        
        WScript.Echo "Description: " & objUser.description
        WScript.Echo "Office: " & objUser.physicalDeliveryOfficeName
    
        txt.WriteLine Member.Name & vbtab & objUser.description & vbtab & objUser.physicalDeliveryOfficeName
    
    End if
    
    count = count + 1
 
Next
 
WScript.Echo vbcrlf
WScript.Echo "A total of " & count & " accounts are members of the " & GroupName & " group."
WScript.Echo vbcrlf
WScript.Echo "Text file " & strCurrDir & "\" & GroupName & " members.txt" & " contains the list of users in this group."
 
 
' *************************************************
' Functions and Subroutines
' *************************************************
 
Function getLdapUN(strUN)
Dim oConnect, Command, strLdapQuery, Rs
 
getLdapUN = False
 
Set oConnect = CreateObject("ADODB.Connection")
Set Command = CreateObject("ADODB.Command")
 
 
'--- search for object in AD ---
strldapquery = "<LDAP://" & strDefaultNamingContext & ">;" & _
"(&(objectCategory=person)(objectClass=user)(sAMAccountName=" & _
strUN & "));ADsPath,cn;subtree"
 
oConnect.Provider = "ADsDSOObject"
oConnect.Open "Active Directory Provider"
 
Set Command.ActiveConnection = oConnect
 
Command.CommandText = strldapquery 'strSQL
 
Set Rs = Command.Execute 'Execute the query
 
'WScript.Echo "Records: " & Rs.RecordCount
 
If Rs.RecordCount > 0 Then
    getLdapUN = rs("AdsPath")
End If
 
Set oConnect = Nothing
Set Command = Nothing
 
End Function

Open in new window

lotharpenguinAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

lotharpenguinAuthor Commented:
I am still looking into this and I cannot find a decent way to do this. Of course I am quite horrible at programming so that doesn't help
0
Netman66Commented:
You can do this with the Support Tools natively.

Get all Universal groups:

dsquery * "dc=domain,dc=com" -limit 0 -scope subtree -filter "(&(objectCategory=group)(groupType=-2147483640))"

You can Pipe that to this command for the membership:

dsget group -members

The whole command would be something like:

dsquery * "dc=domain,dc=com" -limit 0 -scope subtree -filter "(&(objectCategory=group)(groupType=-2147483640))" | dsget group -members



0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
lotharpenguinAuthor Commented:
OMG..How did I miss that. Time to try this in the morning.
0
lotharpenguinAuthor Commented:
DSquery was certainly the right answer.
0
lotharpenguinAuthor Commented:
I'll add that dsquery was in fact what I needed to use but here is the full command to get the info form a specific group and not just all groups.




dsquery * "DC=domain,DC=com" -limit 0 -scope subtree -filter "(&(objectCategory=group)(groupType=-2147483640))" | dsget group "CN=groupname,OU=ouname,DC=domain,DC=com" -members > members.txt

Open in new window

0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.