How to search ADUC for users that are not in a Group

The company I work for setup web groups to manage who can be on the internet at what time. The groups
Web_Tier 1 -Internet all the time
Web_Tier 2  Internet after lunch
Web_Tier 3  Internet after hours.
Here is where the problem is, if the member is not in one of these groups they get access to the internet all the time. I need a way to search Active Directory Users and Computers for users that are not I'm any of the groups. If that search is not possible, then if I can just search for users not in web_tier 3. that search  would work because 80% of the users are in web_tier3.
Any help would be greatly appreciated
Who is Participating?
Mike KlineCommented:
You can use adfind by MVP Joe Richards for this
So for example to sarch for users not in web_tier 3
adfind -default -f "&(objectcategory=person)(objectclass=user)(!memberof=DN of web_tier 3)" samaccountname
so for that I'm only returing the samaccountname but you can return other attributes if you want.
If you want to find the DN of web_tier 3 really fast use
adfind -sc g:"web_tier 3" dn
so if you want to find who is not a member of any of the groups you can use
adfind -default -f "&(objectcategory=person)(objectclass=user)(!memberof=DN of web_tier 3)(!memberof=DN of Web_tier2)(!memberof=DN of web_tier1)" samaccountname
So some things to remember here,  the ! (not operator) is not really recommended and not efficient.  If you are just running this query a few times it won't hurt performance.  If you were running this on an application and it was hitting your AD a lot then that is not good.
If this is in an app you could turn on field engineering logging to help track the queries more on that here
You will need a script to do this. The easiest way is to run the following script to see who is not in a certain group, in your case you would run this script against the web_tier3 group.

Other scripts that you may find useful can be found here:

There are many ways to do what you are asking, but using these ready made scripts should fit the bill.

dh061Author Commented:
Mike, thankyou very much for your help you saved me a lot of work. Is there anyway to make it put the inputs on a spread sheet?
Mike KlineCommented:
Do you want to output those to a spreadsheet?
that you can do by
adfind -default -f "&(objectcategory=person)(objectclass=user)(!memberof=DN of web_tier 3)" samaccountname -csv > c:\notmember.csv
dh061Author Commented:
Thanks again Mike, your simply the best!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.