Updated Script - http://portal.sivarajan.com/2011/10/search-ad-collect-local-admin-group.html
This script can be used to list group membership in Active Directory.
As you can see on the following screenshot, this script uses an input file called Glist.csv which contains all group names.
You will see the output on the screen as well as in the GroupDetails.csv file.
You can download the script from the following locations. Rename the file to .PS1
http://www.sivarajan.com/scripts/Group_Members.txt
http://gallery.technet.microsoft.com/scriptcenter/dcc9432e-d541-4be2-a39c-637c8d4c9fd0
Modified Script – This script will prompt you for the Group distinguishedName (DN).
20 comments:
Hi Santosh,
Do you have any disc.vouchers for MCTS 70-432 now? iam planning to finish it off this weekend.
Regards,
Vinodh
Chennai,India
No. I don't :)
Could you elaborate on the contents of Glist.csv? I have an AD with no OUs created and I am not sure what to put there.
Also, does the DC=local indicate the script is run on the DC? Should I put something else to run it remotely?
It is the DN (Distinguished Name) of the group. If you have Windows 2008 or R2, you can go to the properties of the group and select the “Attribute” Tab, you will see the Distinguished Name (DN) there.
DC is the domain name. In my example, my domain name is “Infralab.local”
“Test1” is the group name. It is inside the “Test” OU.
So the DN of the Group = “name of the group, name of OU, domain name”
http://msdn.microsoft.com/en-us/library/windows/desktop/aa366101(v=vs.85).aspx
http://technet.microsoft.com/en-us/library/cc776019(WS.10).aspx
Please let me know if you need more clarification.
How do I select the group only accounts enable
What do you mean by “group only accounts enable”? What are you trying to accomplish?
He wants to have only active accounts in the group.
'Where userAccountControl = 512'
http://support.microsoft.com/kb/305144
512 0x0200 NORMAL_ACCOUNT
Hi Santhosh,
I get this error when i run your script..Please help..i am a newbie to powershell
Windows PowerShell
Copyright (C) 2009 Microsoft Corporation. All rights reserved.
PS C:\Windows\system32> $GFile = New-Item -type file -force "C:\Scripts\GroupDetails.csv"
PS C:\Windows\system32> Write-Host "Schema Admins" -ForegroundColor Red
Schema Admins
PS C:\Windows\system32> $GName = Read-Host
$group = [ADSI] "LDAP://$GName"
PS C:\Windows\system32> $group.cn
PS C:\Windows\system32> $group.cn | Out-File $GFile -encoding ASCII -append
PS C:\Windows\system32> foreach ($member in $group.member)
>> {
>> $Uname = new-object directoryservices.directoryentry("LDAP://$member")
>> $Uname.cn
>> $Uname.samaccountname
>> $Uname.samaccountname $Uname.cn | Out-File $GFile -encoding ASCII -append
>> }
>>
Unexpected token 'Uname' in expression or statement.
At line:6 char:41
+ $Uname.samaccountname $Uname <<<< .cn | Out-File $GFile -encoding ASCII -append
+ CategoryInfo : ParserError: (Uname:String) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : UnexpectedToken
As you know, this script is not searching AD for “active” users. In that case, you need validate the Admin group result against AD.
Hi Santosh,
I am also getting the same error "Unexpected token 'Uname' in expression or statement"
What do you mean by "you need validate the Admin group result against AD"
Please post the complete script here.
Since this script is not searching or validating the result against AD, you need to compare the local admin member details against AD.
Very useful Santhosh, modified to automate the creation of the DN's file (could probably use an array, but I'm not there yet. Also modified the output to display additional fields.
<# from a list of group names (GroupName.txt), generate a list with the group's DN, (Glist.csv),
import this list and generate list of group members (GroupDetails.csv) for each group
#>
$GroupsList = "C:\Glist.csv" #list with DN's
$GFile = New-Item -type file -force "C:\GroupDetails.csv" #list with group members
#original list with group names
foreach($item in (gc "C:\GroupName.txt")){
get-QADGroup $item | select DN | Export-Csv $GroupsList
Import-CSV $GroupsList | ForEach-Object {
# .DN - this is the header used for the list
$GName = $_.DN
# query group
$group = [ADSI] "LDAP://$GName"
$group.cn
$group.cn | Out-File $GFile -encoding ASCII -append
foreach ($member in $group.member)
{
$Uname = new-object directoryservices.directoryentry("LDAP://$member")
$Uname.sAMAccountName
$Uname.displayName
$Uname.userPrincipalName
$Outline = "`""
$Outline +=$Uname.sAMAccountName
$Outline += "`",`""
$Outline += $Uname.displayName
$Outline += "`",`""
$Outline += $Uname.userPrincipalName
$Outline += "`""
$Outline | Out-File $GFile -encoding ASCII -append
}
}
}
Thanks. It looks like you are using some Quest cmdlets also.
Thanks for sharing your version of the script.
Is there a way to limit output to just groups that are members, and not users or computers, is there a way to filter this output for that?
I'm trying Where {objectclass -eq 'group'} and getting nothing...
Santosh,
I am having difficulty with the GList. Can you offer some advice please?
GroupName
"OU=CTX-Office2007Suite,CN=Groups,CN=SEC-Groups,CN=Site,DC=mydomain,DC=com"
TEK,
Please post the error message here
Palmcroft,
Yes. You can. What is your actual requirement?
Great script that potentially can save my a lot of work. Just one questrion from a Powershell-virgin: Is there a way I can modify the script to only show the users that are members and not groups that are member of other groups?
I eventually got this script to work after much fuddling around. I comment that the script leaves out a LOT of preliminary knowledge and information. I work in a large enterprise environment and I only care about my Site's groups. So I used the old ldp.exe (from the Windows 2000 Server Resource Kit) to inspect the Distinguished Names of each of my groups. Then I used Active Directory Users and Computers "Export" function to dump my groups into text file which I opened in Excel. I then appended the necessary Distinguished Name information to create the GList.csv text file. It still bloody didn't work until I added the "GroupName" header at the top of the csv file. I then debugged it in Windows PowerShell Integrated Scripting Environment (ISE) program and finally got it to dump the desired text file of users. I thank the script authors but comment that they should expect the audience to be much less expert than themselves in respect of knowledge of LDAP DN paths, etc. and should provide step-by-step illustrated instructions for "aspiring" Systems Admins like myself seeking enlightenment.
Mr Maw is there any step-by-step tutorial to use for this procedure?
Post a Comment