How to search ADUC for users that are not in a Group

The company I work for setup web groups to manage who can be on the internet at what time. The groups
Web_Tier 1 -Internet all the time
Web_Tier 2  Internet after lunch
Web_Tier 3  Internet after hours.
Here is where the problem is, if the member is not in one of these groups they get access to the internet all the time. I need a way to search Active Directory Users and Computers for users that are not I'm any of the groups. If that search is not possible, then if I can just search for users not in web_tier 3. that search  would work because 80% of the users are in web_tier3.
Any help would be greatly appreciated
LVL 1
dh061Asked:
Who is Participating?
 
Mike KlineCommented:
You can use adfind by MVP Joe Richards for this
http://www.joeware.net/freetools/tools/adfind/index.htm
So for example to sarch for users not in web_tier 3
adfind -default -f "&(objectcategory=person)(objectclass=user)(!memberof=DN of web_tier 3)" samaccountname
so for that I'm only returing the samaccountname but you can return other attributes if you want.
If you want to find the DN of web_tier 3 really fast use
adfind -sc g:"web_tier 3" dn
so if you want to find who is not a member of any of the groups you can use
adfind -default -f "&(objectcategory=person)(objectclass=user)(!memberof=DN of web_tier 3)(!memberof=DN of Web_tier2)(!memberof=DN of web_tier1)" samaccountname
So some things to remember here,  the ! (not operator) is not really recommended and not efficient.  If you are just running this query a few times it won't hurt performance.  If you were running this on an application and it was hitting your AD a lot then that is not good.
If this is in an app you could turn on field engineering logging to help track the queries more on that here  
http://adisfun.blogspot.com/2009/04/lessons-learned-from-eric-fleischman.html
 
Thanks
Mike
0
 
valiconCommented:
You will need a script to do this. The easiest way is to run the following script to see who is not in a certain group, in your case you would run this script against the web_tier3 group.

http://www.microsoft.com/technet/scriptcenter/scripts/ad/groups/default.mspx?mfr=true

Other scripts that you may find useful can be found here:

http://www.microsoft.com/technet/scriptcenter/scripts/ad/groups/default.mspx?mfr=true

There are many ways to do what you are asking, but using these ready made scripts should fit the bill.

0
 
dh061Author Commented:
Mike, thankyou very much for your help you saved me a lot of work. Is there anyway to make it put the inputs on a spread sheet?
0
 
Mike KlineCommented:
Do you want to output those to a spreadsheet?
that you can do by
adfind -default -f "&(objectcategory=person)(objectclass=user)(!memberof=DN of web_tier 3)" samaccountname -csv > c:\notmember.csv
 
Thanks
Mike
0
 
dh061Author Commented:
Thanks again Mike, your simply the best!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.