vbscriptblog.com » groups

Active Directory: VBscript to enumerate nested Active Directory groups from an Excel sheet

dirk adamsky — Tue, 04 Oct 2011 13:09:34 +0000

Haven’t done much scripting lately…..
The script for today is made for Ananth Kumar.
He asked me to make an extension to the “enumerate nested groups script” so that multiple nested groups can be enumerated based on an input file.
I did choose Excel for the input file so that i could reuse previous code.

Follow the next steps to run the script (no admin rights needed):

find the distinguished names of the nested groups (adsiedit.msc)
put them in an Excel sheet in the first column ans save the sheet as c:\temp\groups.xls
open your favorite text editor
copy and paste the script below into the editor (you can use the icons in the upper rights corner of the code)
save the script (for example c:\temp\enumeratenestedgroupsfromexcelsheet.vbs)
open a command prompt
go to “c:\temp”
give “cscript enumeratenestedgroupsfromexcelsheet.vbs” (without quotes) and enter

The script:

' Name : enumeratenestedgroupsfromexcelsheet.vbs
' Description : script to enumerate nested Active Directory groups from an Excel sheet
' Author : dirk adamsky - deludi bv
' Version : 1.0
' Date : 04-10-2011

Set objExcel = CreateObject("Excel.Application")
Set objWorkbook = objExcel.Workbooks.Open("C:\temp\groups.xls")
intRow = 2
Do Until objExcel.Cells(intRow,1).Value = ""
strGroupDN = objExcel.Cells(intRow, 1).Value
If strGroupDN <> "" Then
wscript.echo strGroupDN
EnumNestedgroup "LDAP://" & strGroupDN
End If
intRow = intRow + 1
Loop
objExcel.Quit
Set objWorkbook = Nothing
Set objExcel = Nothing

Function EnumNestedgroup(strGroupDN)
Set objGroup = GetObject(strGroupDN)
For Each objMember in objGroup.Members
If (LCase(objMember.Class) = "group") Then
EnumNestedgroup objMember.AdsPath
Else
Wscript.Echo objGroup.cn & " ; " & objMember.DisplayName & " ; " & objMember.Mail
End If
Next
Set objGroup = Nothing
End Function

When you have a modified version or problems/questions that you want to share please post it at the comments below.

Happy scripting.

Dirk Adamsky

VBscript: VBscript to enumerate all groups and their members from a specific Active Directory OU

dirk adamsky — Wed, 01 Jun 2011 12:43:14 +0000

Today’s script is made for Tyrone.

His question was a script that enumerates all groups and their members from a given OU.
I already had a script that enumerates the members of an OU.
I also had a script that enumerates the members of a nested group (uses recursion).
The 2 scripts combined are the solution for Tyrone.

Follow the next steps to run the script (no admin rights needed):

* open your favorite text editor
* copy and paste the script into the editor
* change the OU distinguished name (in line 7) into your OU distinguished name
* save the script (for example c:\temp\EnumerateGroupsInOu.vbs)
* open a command prompt
* go to “c:\temp”
* give “cscript EnumerateGroupsInOu.vbs” (without quotes) and enter

You can also dump the output to a file:

* give “cscript EnumerateGroupsInOu.vbs > EnumerateGroupsInOu.txt” (without quotes) and enter

To get that file into Excel:

* open Excel
* go to Menu=>Open File
* change file type to “all”
* chose EnumerateGroupsInOu.txt
* chose “;” as separator character

The script:

' Name : EnumerateGroupsInOu.vbs
' Description : script to enumerate all groups and their members from a specific Active Directory OU
' Author : dirk adamsky - deludi bv
' Version : 1.00
' Date : 01-06-2011

Set objOU = GetObject("LDAP://OU=test,DC=test,DC=org")
	For Each objMember in objOU
		If (LCase(objMember.Class) = "group") Then
			EnumNestedgroup objMember.AdsPath
		End If
	Next
Set objOU = Nothing

Function EnumNestedgroup(strGroupDN)
	Set objGroup = GetObject(strGroupDN)
	For Each objMember in objGroup.Members
		If (LCase(objMember.Class) = "group") Then
			wscript.echo objMember.AdsPath
			EnumNestedgroup objMember.AdsPath
		Else
			Wscript.Echo objGroup.Name & " ; " & objMember.DisplayName & " ; " & objMember.Mail &_
			" ; " & objMember.Department &  " ; " &	objMember.Company & " ;  " & objMember.Title
		End If
	Next
	Set objGroup = Nothing
End Function

When you have problems/questions with the script please post a reply.

Happy scripting.

Best regards,

Dirk Adamsky

Active Directory: VBscript to enumerate all empty groups

dirk adamsky — Thu, 18 Mar 2010 12:11:13 +0000

For most system administrators cleaning up Active Directory is not their favorite thing.
This script helps you by enumerating all empty groups, so you can remove them (manually).

Follow the next steps to run the script (no admin rights needed):

* open your favorite text editor
* copy and paste the script into the editor
* save the script (for example c:\temp\emptygroups.vbs)
* open a command prompt
* go to “c:\temp”
* give “cscript emptygroups.vbs” (without quotes) and enter

The script:

' Name : emptygroups.vbs
' Description : script to enumerate all empty groups
' Author : dirk adamsky - deludi bv
' Version : 1.00
' Date : 18-03-2010
' Level : intermediate

Set objCommand = CreateObject("ADODB.Command")
Set objConnection = CreateObject("ADODB.Connection")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
objCommand.ActiveConnection = objConnection

Set objRootDSE = GetObject("LDAP://RootDSE")
strBase = ""
Set objRootDSE = Nothing

strFilter = "(&(objectCategory=group)(!member=*))"
strAttributes = "name"
strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
objCommand.CommandText = strQuery
objCommand.Properties("Page Size") = 100
objCommand.Properties("Timeout") = 30
objCommand.Properties("Cache Results") = False

Set objRecordSet = objCommand.Execute
Do Until objRecordSet.EOF
	Wscript.Echo objRecordSet.Fields("name").Value
	objRecordSet.MoveNext
Loop

objRecordSet.Close
objConnection.Close

Set objRecordSet = Nothing
Set objConnection = Nothing
Set objCommand = Nothing

When you have problems/questions please post a reply, you can also rate the script.

Happy scripting.

Best regards,

Dirk Adamsky – Deludi BV

Active Directory: VBscript to show all groups with multiple smtp addresses

dirk adamsky — Tue, 23 Feb 2010 08:06:08 +0000

This script is a mutation of yesterday’s script.
It searches Active Directory for mail enabled groups with multiple smtp addresses.
By changing the treshold value (i) in line number 39 you can broaden or narrow your searches.

Follow the next steps to run the script (no admin rights needed):

* open your favorite text editor
* copy and paste the script into the editor
* save the script (for example c:tempshowgroupswithmultiplesmtp.vbs)
* open a command prompt
* go to “c:temp”
* give “cscript showgroupswithmultiplesmtp.vbs” (without quotes) and enter

The script:

' Name : showgroupswithmultiplesmtp.vbs
' Description : script to show all groups with multiple smtp addresses
' Author : dirk adamsky - deludi bv
' Version : 1.00
' Date : 23-02-2010
' Level : intermediate

Set adoCommand = CreateObject("ADODB.Command")
Set adoConnection = CreateObject("ADODB.Connection")
adoConnection.Provider = "ADsDSOObject"
adoConnection.Open "Active Directory Provider"
adoCommand.ActiveConnection = adoConnection

Set objRootDSE = GetObject("LDAP://RootDSE")
strDNSDomain = objRootDSE.Get("defaultNamingContext")
strBase = ""

strFilter = "(&(objectCategory=group)(mail=*))"
strAttributes = "distinguishedName"

strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
adoCommand.CommandText = strQuery
adoCommand.Properties("Page Size") = 100
adoCommand.Properties("Timeout") = 30
adoCommand.Properties("Cache Results") = False

Set adoRecordset = adoCommand.Execute

Do Until adoRecordset.EOF
	On Error Resume Next
	Set objGroup = GetObject ("LDAP://" & adoRecordset.Fields("distinguishedName").Value)
	arrProxy = objGroup.GetEx("proxyAddresses")
	i = 0
	For Each strMailAddress in arrProxy
		If Lcase(Left(strMailAddress,5))= "smtp:" Then
			i = i + 1
		End If
	Next
	If i >= 2 Then
		strAllMailAddresses = ""
		For Each strMailAddress in arrProxy
			If Lcase(Left(strMailAddress,5))= "smtp:" Then
				strAllMailAddresses = strAllMailAddresses & " ; "  & strMailAddress
			End If
		Next
		Wscript.Echo objGroup.DisplayName & strAllMailAddresses
	End If
	Set objGroup = Nothing
	adoRecordset.MoveNext
Loop

adoRecordset.Close
adoConnection.Close

Set adoRecordset = Nothing
Set objRootDSE = Nothing
Set adoConnection = Nothing
Set adoCommand = Nothing

When you have problems/questions please post a reply.
I also added a rating system yesterday, thank you in advance for your reaction.

Happy scripting.

Best regards,

Dirk Adamsky – Deludi BV

Active Directory: VBscript to enumerate the members of nested groups V2

dirk adamsky — Mon, 08 Feb 2010 09:04:19 +0000

A couple of weeks ago I posted the enumeratenestedgroup script.
Last friday (while working at another script) I thought: this can be done better/more efficient.
What I have done is a rewrite of the script, it now contains 50% less code.
This is mainly because the recursion is implemented better.
When you are not familiar with recursion: here’s a extensive wikipedia article.
You can easily modify the script with extra user attributes, counters, etc.
Here you can find some mutations of the enumerate nested group script:

What the script does:

fill a variable with the group distinguished name
call the function EnumNestedgroup
the function checks whether the member is a group or a user
when the member is a user the displayname and smtp address are echoed on the screen
when the member is a group the group distinguished name is echoed and the function is called again
this loop continues untill the last member is enumerated

Follow the next steps to run the script (no admin rights needed):

find the distinguished name of the nested group (adsiedit.msc)
open your favorite text editor
copy and paste the script into the editor
change the distinguished name
save the script (for example c:\tempenumeratenestedgroup.vbs)
open a command prompt
go to “c:\temp”
give “cscript enumeratenestedgroup.vbs” (without quotes) and enter

The script:

' Name : enumeratenestedgroup.vbs
' Description : script to enumerate the members of a nested group
' Author : dirk adamsky - deludi bv
' Version : 2.2 replaced the subroutine statement with a function statement
' Date : 07-06-2011

strTargetGroupDN = "LDAP://CN=testgroup,OU=groups,DC=test,DC=org"
EnumNestedgroup strTargetGroupDN
Function EnumNestedgroup(strGroupDN)
	Set objGroup = GetObject(strGroupDN)
	For Each objMember in objGroup.Members
		If (LCase(objMember.Class) = "group") Then
			wscript.echo objMember.AdsPath
			EnumNestedgroup objMember.AdsPath
		Else
			Wscript.Echo objMember.DisplayName & " ; " & objMember.Mail
		End If
	Next
	Set objGroup = Nothing
End Function

When you have a modified version or problems/questions that you want to share please post it at the comments below.

Happy scripting.

Dirk Adamsky

Active Directory: VBscript to enumerate all active directory distributiongroups with manager

dirk adamsky — Mon, 01 Feb 2010 08:47:35 +0000

This script enumerates all active directory distribution groups with a manager.
It starts with an ado query for the distinguished name of all group objects with an smtp address (accomplished by checking the mail property in the ado filter).
For each group a group object is created, the displayname, mail attribute and managedBy attribute of the group are displayed.

Follow the next steps to make and run the script (no admin rights needed):

open your favorite text editor (mine is notepad++)
copy and paste the script into the editor (delete the line numbers)
save the script (for example c:tempdistributiongroupswithmanager.vbs)
open a command prompt
go to “c:temp”
give “cscript distributiongroupswithmanager.vbs” (without quotes) and enter

When you want to save the output in a textfile give:

“cscript distributiongroupswithmanager.vbs > distributiongroupswithmanager.txt” (without quotes) and enter

The script:

' Name : distributiongroupswithmanager.vbs
' Description : script to enumerate all distributiongroups with manager
' Author : dirk adamsky - deludi bv
' Version : 1.00
' Date : 01-02-2010
' Level : intermediate

Set adoCommand = CreateObject("ADODB.Command")
Set adoConnection = CreateObject("ADODB.Connection")
adoConnection.Provider = "ADsDSOObject"
adoConnection.Open "Active Directory Provider"
adoCommand.ActiveConnection = adoConnection

Set objRootDSE = GetObject("LDAP://RootDSE")
strDNSDomain = objRootDSE.Get("defaultNamingContext")
strBase = ""
strFilter = "(&(objectCategory=group)(mail=*))"
strAttributes = "distinguishedName"

strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
adoCommand.CommandText = strQuery
adoCommand.Properties("Page Size") = 100
adoCommand.Properties("Timeout") = 30
adoCommand.Properties("Cache Results") = False

Set objRecordset = adoCommand.Execute

objRecordSet.MoveFirst
Do Until objRecordSet.EOF
	On Error Resume Next
	Set objGroup = GetObject("LDAP://" & objRecordSet.Fields("distinguishedName").Value)
	Wscript.Echo objGroup.DisplayName & " ; " & objGroup.Mail & " ; " & objGroup.managedBy
	Set objGroup = Nothing
	objRecordSet.MoveNext
Loop

Set objRecordset = Nothing
Set objRootDSE = Nothing
Set adoConnection = Nothing
Set adoCommand = Nothing

When you have questions or problems with the script please drop a comment.

Active Directory: Simple VBscript to enumerate group members

dirk adamsky — Fri, 29 Jan 2010 07:56:21 +0000

Scripting sometimes seems tough to learn.
To help you I have made a couple of starter scripts.

This starter script is only 5 lines of code.
The script lists all members of a group.

Follow the next steps to make and run the script (no admin rights needed):

open your favorite text editor (mine is notepad++)
copy and paste the script into the editor (delete the line numbers)
open adsiedit as a user (start=>run=>adsiedit.msc)
browse to the group
rightclick the group and choose properties
select the distinguishedname attribute
copy the value of the distinguishedname attribute
change the value of the distinguishedname attribute in the script
save the script (for example c:tempenumerategroup.vbs)
open a command prompt
go to “c:temp”
give “cscript enumerategroup.vbs” (without quotes) and enter

When you want to save the output in a textfile give:

“cscript enumerategroup.vbs > groupname.txt” (without quotes) and enter

The script:

' Name : enumerategroup.vbs
' Description : script to enumerate group members
' Author : dirk adamsky - deludi bv
' Version : 1.10 corrected with the input of Ciobotario
' Date : 12-04-2011
' Level : beginner

Set objGroup = GetObject("LDAP://CN=test,OU=test,DC=test,DC=org")	' create the group object
For Each Member in objGroup.Members	' for  each member of the group
	WScript.echo Member.cn & " ; " & Member.displayName	' echo the common name and displayname
Next
Set objGroup = Nothing	' delete the group object and clear memory

When you have questions or problems with the script please drop a comment.

Happy scripting.

Best regards,

Dirk Adamsky – Deludi BV

Active Directory: VBscript to copy the members of a nested group to another group

dirk adamsky — Thu, 28 Jan 2010 13:48:24 +0000

This script copies the members of a nested group to another group.

Follow the next steps to run the script (admin rights needed):

open your favorite text editor
copy and paste the script into the editor
change the distinguished name of the source group to your source group name
change the distinguished name of the target group to your target group name
save the script (for example c:tempcopynestedgroupuserstogroup.vbs)
open a command prompt with administrative rights
go to “c:temp”
give “cscript copynestedgroupuserstogroup.vbs” (without quotes) and enter
give “ok”

The script:

' Name : copynestedgroupuserstogroup.vbs
' Description : script to copy the members of a nested group to another group
' Author : dirk adamsky - deludi bv
' Version : 1.00
' Date : 28-01-2010

Set objSourceGroup = GetObject("LDAP://CN=sourcegroupname,OU=test,DC=test,DC=org")
For Each objMember in objSourceGroup.Members
	If (LCase(objMember.Class) = "group") Then
		Set objSubGroup = GetObject(objMember.AdsPath)
		Call EnumNestedgroup(objSubGroup)
		Set objSubGroup = Nothing
	Else
		On Error Resume Next
		Set objTargetGroup = GetObject("LDAP://CN=targetgroupname,OU=test,DC=test,DC=org")
		objTargetGroup.Add(objMember.ADsPath)
		objTargetGroup.Setinfo
		Set objTargetGroup = Nothing
	End If

Next
Set objSourceGroup = Nothing

Sub EnumNestedGroup(objNestedGroup)
    For Each objSubMember In objNestedGroup.Members
        If (LCase(objSubMember.Class) = "group") Then
            Set objSubNestedGroup = GetObject(objSubMember.AdsPath)
			Call EnumNestedGroup(objSubNestedGroup)
			Set objSubNestedGroup = Nothing
		Else
			On Error Resume Next
			Set objTargetGroup = GetObject("LDAP://CN=targetgroupname,OU=test,DC=test,DC=org")
			objTargetGroup.Add(objSubMember.ADsPath)
			objTargetGroup.Setinfo
			Set objTargetGroup = Nothing
		End If
    Next
End Sub

Active Directory: VBScript to enumerate all groups a user is memberOf

dirk adamsky — Thu, 21 Jan 2010 14:04:47 +0000

This script enumerates all group memberships of a user.

What the script does:

ask for the smtp address of the user (inputbox)
the function GetDN gets the distinguished name
create the user object
check is there are groups that the user is memberOf
enumerate the group DN’s

Follow the next steps to run the script (no admin rights needed):

find the smtp address of the user (outlook/aduc)
open your favorite text editor
copy and paste the script into the editor
save the script (for example c:tempenumerategroupsfromuser.vbs)
open a command prompt
go to “c:temp”
give “cscript enumerategroupsfromuser.vbs” (without quotes) and enter
in the input box fill in the smtp address of the user
give “ok”

The script:

' Name : enumerategroupsfromuser.vbs
' Description : script to enumerate all groups a user is memberOf
' Author : dirk adamsky - deludi bv
' Version : 1.00
' Date : 21-01-2010

strChangeUser = InputBox("Fill in the smtp address of the user")
strUserDN = GetDN(strChangeUser)

Set objUser = GetObject("LDAP://" & strUserDN)
If Ubound(objUser.memberOf) <> "" Then
    objGroups = objUser.GetEx("memberOf")
    For Each objGroup in objGroups
        Wscript.Echo objGroup
    Next
End If
Set objUser = Nothing

Function GetDN(strMail)

    Set adoCommand = CreateObject("ADODB.Command")
    Set adoConnection = CreateObject("ADODB.Connection")
    adoConnection.Provider = "ADsDSOObject"
    adoConnection.Open "Active Directory Provider"
    adoCommand.ActiveConnection = adoConnection

    ' Search entire Active Directory domain.
    Set objRootDSE = GetObject("LDAP://RootDSE")
    strDNSDomain = objRootDSE.Get("defaultNamingContext")
    strBase = ""

    ' Filter on user objects.
    strFilter = "(&(objectCategory=person)(objectClass=user)(mail=" &  strMail & "))"

    ' Comma delimited list of attribute values to retrieve.
    strAttributes = "distinguishedName"

    ' Construct the LDAP syntax query.
    strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
    adoCommand.CommandText = strQuery
    adoCommand.Properties("Page Size") = 100
    adoCommand.Properties("Timeout") = 30
    adoCommand.Properties("Cache Results") = False

    ' Run the query.
    Set adoRecordset = adoCommand.Execute
    GetDN = adoRecordset.Fields("distinguishedName").Value
    ' Clean up.
    adoRecordset.Close
    adoConnection.Close

    Set adoRecordset = Nothing
    Set objRootDSE = Nothing
    Set adoConnection = Nothing
    Set adoCommand = Nothing

End Function

Active Directory: VBScript to change the groups from a user based on an example user

dirk adamsky — Thu, 14 Jan 2010 16:11:10 +0000

In large organisations users frequently change departments.
As a consequence the group memberships of the user have to change also.
Often this is achieved by using an example user.
When the example user has a lot of memberships this can be a time consuming task.
This script asks for the smtp address of the user that has to be changed,
then for the smtp address of the example user.
The function GetDN does a lookup in Active Directory for the distinguished name
of both users.
Then the old group memberships of the user are removed.
At last the group memberships of the example user are added.

Follow the next steps to run the script (admin rights needed):

open your favorite text editor
copy and paste the script into the editor
save the script (for example c:tempchangegroupmemberships.vbs)
open a command prompt with administrative rights
go to “c:temp”
give “cscript changegroupmemberships.vbs” (without quotes) and enter
in the input box fill in the smtp address of the user that has to be changed
in the next input box fill in the smtp address of the example user
give “ok”

The script:

' Name : changegroupmemberships.vbs
' Description : script to change group memberships based on example user
' Author : dirk adamsky - deludi bv
' Version : 1.01
' Date : 16-01-2010

strChangeUser = InputBox("Fill in the SMTP address of the user that has to be changed")
strVoorbeeldUser = InputBox("Fill in the SMTP address of the example user")
strChangeUserDN = GetDN(strChangeUser)
strVoorbeeldUserDN = GetDN(strVoorbeeldUser)
Removegroups strChangeUserDN
Addgroups strChangeUserDN, strVoorbeeldUserDN

Function GetDN(strMail)

    Set adoCommand = CreateObject("ADODB.Command")
    Set adoConnection = CreateObject("ADODB.Connection")
    adoConnection.Provider = "ADsDSOObject"
    adoConnection.Open "Active Directory Provider"
    adoCommand.ActiveConnection = adoConnection

    ' Search entire Active Directory domain.
    Set objRootDSE = GetObject("LDAP://RootDSE")
    strDNSDomain = objRootDSE.Get("defaultNamingContext")
    strBase = ""

    ' Filter on user objects.
    strFilter = "(&(objectCategory=person)(objectClass=user)(mail=" &  strMail & "))"

    ' Comma delimited list of attribute values to retrieve.
    strAttributes = "distinguishedName"

    ' Construct the LDAP syntax query.
    strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
    adoCommand.CommandText = strQuery
    adoCommand.Properties("Page Size") = 100
    adoCommand.Properties("Timeout") = 30
    adoCommand.Properties("Cache Results") = False

    ' Run the query.
    Set adoRecordset = adoCommand.Execute
    GetDN = adoRecordset.Fields("distinguishedName").Value
    ' Clean up.
    adoRecordset.Close
    adoConnection.Close

    Set adoRecordset = Nothing
    Set objRootDSE = Nothing
    Set adoConnection = Nothing
    Set adoCommand = Nothing

End Function

Sub Removegroups(strUserDN)
    Const ADS_PROPERTY_DELETE = 4
    Set objUser = GetObject("LDAP://" & strUserDN)
    If Ubound(objUser.memberOf) <> "" Then
        arrMemberOf = objUser.GetEx("memberOf")
        For Each Group in arrMemberOf
            Set objGroup = GetObject("LDAP://" & Group)
            objGroup.PutEx ADS_PROPERTY_DELETE, "member", Array(strUserDN)
            objGroup.SetInfo
            Set objGroup = Nothing
        Next
    End If
End Sub

Sub Addgroups(strChangeDN,strVBDN)
    On Error Resume Next
    Set objUser = GetObject("LDAP://" & strVBDN)
    arrMemberOf = objUser.GetEx("memberOf")
    For Each Group in arrMemberOf
        Set objGroup = GetObject("LDAP://" & Group)
        objGroup.Add("LDAP://" & strChangeDN)
        objGroup.SetInfo
        Set objGroup = Nothing
    Next
End Sub