Solved

Query AD to find out who's a server admin

Posted on 2009-07-14
4
455 Views
Last Modified: 2013-12-24
I'm reaching here, but, I need to know if anyone knows of a good way to query the directory in my organization to get a report detailing who has local admin rights on all of our servers.  We have about 400 Servers.  So, going through them one by one is not really an option for me.  Any ideas would be great.

Specifically, I'd like the report to have local admins and users in the Administrators group.  
0
Comment
Question by:dandmantra
4 Comments
 
LVL 23

Expert Comment

by:rhandels
ID: 24853980
Hey,

I don't reallyt have an anwers for you, i do know how we fixed this issue when we needed to know who was local admin. A collegue of mine (who is very good with VB) created a script that read out all administrators groups off all specifeied servers using an Excel sheet. Imho this is the only way of doing this, writing a script to pull out that info.
Only problem is I am very bad at programming stuff, but maybe someone either in the Excel or vbscripting topic can help you with this (or a programmer here :))
0
 
LVL 38

Accepted Solution

by:
Shift-3 earned 500 total points
ID: 24853999
Paste the script below into a text file with a .vbs extension.  Customize the arrContainers array on line 3 with the distinguished names of all OUs to recursively search under.  Running the script will query each server and write the results to a comma-delimited text file.


Const ADS_SCOPE_SUBTREE = 2
 

arrContainers = Array("ou=file servers,dc=yourdomain,dc=local","ou=print servers,dc=yourdomain,dc=local")

strReport = "report.csv"
 

On Error Resume Next

    

Set objFSO = CreateObject("Scripting.FileSystemObject")

Set objReport = objFSO.CreateTextFile(strReport, True)
 

objReport.WriteLine "Computer,Online,Member of Administrators Group"
 

Set objConnection = CreateObject("ADODB.Connection")

Set objCommand = CreateObject("ADODB.Command")

objConnection.Provider = "ADsDSOObject"

objConnection.Open "Active Directory Provider"
 

For Each strContainer in arrContainers

    Set objCommand.ActiveConnection = objConnection

    objCommand.CommandText = _

        "Select Name From 'LDAP://" & strContainer & _

        "' Where objectCategory='computer'"  

    objCommand.Properties("Page Size") = 1000

    objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE 

    Set objRecordSet = objCommand.Execute

    objRecordSet.MoveFirst
 

    Do Until objRecordSet.EOF

        strComputer = objRecordSet.Fields("Name").Value

        

        If PingCheck(strComputer, 1, 500) Then

            Set objGroup = GetObject("WinNT://" & strComputer & "/Administrators")
 

            For Each objMember In objGroup.Members

                objReport.WriteLine strComputer & ",True," & objMember.Name

            Next

        Else

            objReport.WriteLine strComputer & ",False"

        End If

        

        objRecordSet.MoveNext

    Loop

Next
 

objReport.Close
 

Function PingCheck(strTarget, strPings, intPause)

    Const ForReading = 1

    

    Set objShell = CreateObject("WScript.Shell")

    strTempDir = objShell.ExpandEnvironmentStrings("%temp%")
 

    strTempFile = strTempDir & "\script-" & strTarget & ".txt"
 

    Set objFSO = CreateObject("Scripting.FileSystemObject")

    

    objShell.Run "%comspec% /c ping -n " & strPings & " -w 100 " & _

        strTarget & ">" & strTempFile, 0, True

        

    WScript.Sleep intPause

    

    objShell.Run "%comspec% /c ping -n " & strPings & " -w 100 " & _

        strTarget & ">>" & strTempFile, 0, True

    

    Set objTempFile = objFSO.OpenTextFile(strTempFile, ForReading)

    strOutput = objTempFile.ReadAll

    objTempFile.Close

    objFSO.DeleteFile strTempFile, True
 

    If InStr(strOutput, "bytes=32") > 0 Then

        PingCheck = True

    Else

        PingCheck = False

    End If

End Function

Open in new window

0
 
LVL 4

Expert Comment

by:Zaphod1620
ID: 24854065
Are these servers all on the same domain? If so, you can use a freeware application called Bulk AD Users from Wisesoft: http://www.wisesoft.co.uk/software/bulkadusers/default.aspx

You can get listings of people via OU or Groups. You would have to search the Administrators, Domain Admins, etc, but in just a few clicks you can have what you want. It will also import and export to .csv and Excel. It is useful for other things; you can use it to modify any property of a large group of AD objects.

-Z
0
 
LVL 7

Author Closing Comment

by:dandmantra
ID: 31603465
This script kicks azz.  thanks.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Suggested Solutions

Entering a date in Microsoft Access can be tricky. A typo can cause month and day to be shuffled, entering the day only causes an error, as does entering, say, day 31 in June. This article shows how an inputmask supported by code can help the user a…
This article explains all about SQL Server Piecemeal Restore with examples in step by step manner.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now