How to search ADUC for users that are not in a Group

Posted on 2009-05-02
Last Modified: 2012-08-14
The company I work for setup web groups to manage who can be on the internet at what time. The groups
Web_Tier 1 -Internet all the time
Web_Tier 2  Internet after lunch
Web_Tier 3  Internet after hours.
Here is where the problem is, if the member is not in one of these groups they get access to the internet all the time. I need a way to search Active Directory Users and Computers for users that are not I'm any of the groups. If that search is not possible, then if I can just search for users not in web_tier 3. that search  would work because 80% of the users are in web_tier3.
Any help would be greatly appreciated
Question by:dh061
    LVL 12

    Expert Comment

    You will need a script to do this. The easiest way is to run the following script to see who is not in a certain group, in your case you would run this script against the web_tier3 group.

    Other scripts that you may find useful can be found here:

    There are many ways to do what you are asking, but using these ready made scripts should fit the bill.

    LVL 57

    Accepted Solution

    You can use adfind by MVP Joe Richards for this
    So for example to sarch for users not in web_tier 3
    adfind -default -f "&(objectcategory=person)(objectclass=user)(!memberof=DN of web_tier 3)" samaccountname
    so for that I'm only returing the samaccountname but you can return other attributes if you want.
    If you want to find the DN of web_tier 3 really fast use
    adfind -sc g:"web_tier 3" dn
    so if you want to find who is not a member of any of the groups you can use
    adfind -default -f "&(objectcategory=person)(objectclass=user)(!memberof=DN of web_tier 3)(!memberof=DN of Web_tier2)(!memberof=DN of web_tier1)" samaccountname
    So some things to remember here,  the ! (not operator) is not really recommended and not efficient.  If you are just running this query a few times it won't hurt performance.  If you were running this on an application and it was hitting your AD a lot then that is not good.
    If this is in an app you could turn on field engineering logging to help track the queries more on that here
    LVL 1

    Author Closing Comment

    Mike, thankyou very much for your help you saved me a lot of work. Is there anyway to make it put the inputs on a spread sheet?
    LVL 57

    Expert Comment

    by:Mike Kline
    Do you want to output those to a spreadsheet?
    that you can do by
    adfind -default -f "&(objectcategory=person)(objectclass=user)(!memberof=DN of web_tier 3)" samaccountname -csv > c:\notmember.csv
    LVL 1

    Author Comment

    Thanks again Mike, your simply the best!

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
    Learn about cloud computing and its benefits for small business owners.
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
    This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

    761 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    7 Experts available now in Live!

    Get 1:1 Help Now