[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

How to search ADUC for users that are not in a Group

Posted on 2009-05-02
5
Medium Priority
?
474 Views
Last Modified: 2012-08-14
The company I work for setup web groups to manage who can be on the internet at what time. The groups
Web_Tier 1 -Internet all the time
Web_Tier 2  Internet after lunch
Web_Tier 3  Internet after hours.
Here is where the problem is, if the member is not in one of these groups they get access to the internet all the time. I need a way to search Active Directory Users and Computers for users that are not I'm any of the groups. If that search is not possible, then if I can just search for users not in web_tier 3. that search  would work because 80% of the users are in web_tier3.
Any help would be greatly appreciated
0
Comment
Question by:dh061
  • 2
  • 2
5 Comments
 
LVL 12

Expert Comment

by:valicon
ID: 24286135
You will need a script to do this. The easiest way is to run the following script to see who is not in a certain group, in your case you would run this script against the web_tier3 group.

http://www.microsoft.com/technet/scriptcenter/scripts/ad/groups/default.mspx?mfr=true

Other scripts that you may find useful can be found here:

http://www.microsoft.com/technet/scriptcenter/scripts/ad/groups/default.mspx?mfr=true

There are many ways to do what you are asking, but using these ready made scripts should fit the bill.

0
 
LVL 57

Accepted Solution

by:
Mike Kline earned 1000 total points
ID: 24286430
You can use adfind by MVP Joe Richards for this
http://www.joeware.net/freetools/tools/adfind/index.htm
So for example to sarch for users not in web_tier 3
adfind -default -f "&(objectcategory=person)(objectclass=user)(!memberof=DN of web_tier 3)" samaccountname
so for that I'm only returing the samaccountname but you can return other attributes if you want.
If you want to find the DN of web_tier 3 really fast use
adfind -sc g:"web_tier 3" dn
so if you want to find who is not a member of any of the groups you can use
adfind -default -f "&(objectcategory=person)(objectclass=user)(!memberof=DN of web_tier 3)(!memberof=DN of Web_tier2)(!memberof=DN of web_tier1)" samaccountname
So some things to remember here,  the ! (not operator) is not really recommended and not efficient.  If you are just running this query a few times it won't hurt performance.  If you were running this on an application and it was hitting your AD a lot then that is not good.
If this is in an app you could turn on field engineering logging to help track the queries more on that here  
http://adisfun.blogspot.com/2009/04/lessons-learned-from-eric-fleischman.html
 
Thanks
Mike
0
 
LVL 1

Author Closing Comment

by:dh061
ID: 31577165
Mike, thankyou very much for your help you saved me a lot of work. Is there anyway to make it put the inputs on a spread sheet?
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 24287729
Do you want to output those to a spreadsheet?
that you can do by
adfind -default -f "&(objectcategory=person)(objectclass=user)(!memberof=DN of web_tier 3)" samaccountname -csv > c:\notmember.csv
 
Thanks
Mike
0
 
LVL 1

Author Comment

by:dh061
ID: 24288639
Thanks again Mike, your simply the best!
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Here's a look at newsworthy articles and community happenings during the last month.
Wouldn't it be nice if objects in Active Directory automatically moved into the correct Organizational Units? This is what AutoAD aims to do and as a plus, it automatically creates Sites, Subnets, and Organizational Units.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question