-4

If I'm at the domain controller (in the Active Directory) to find out what groups the "XPSP3-A" workstation is a member of, I do:

dsquery computer "CN=XPSP3-A,CN=Computers,DC=pvk,DC=local" -name XPSP3-A | dsget computer -memberof

and receive the following:

"CN=Sec Group 001,OU=OU1,DC=pvk,DC=local" 
"CN=Domain Computers,CN=Users,DC=pvk,DC=local"

But how to do the same from the "XPSP3-A" workstation?

2
  • 2
    You can do this using a VBS script. What are you trying to achieve, though, is this just for diagnostics?
    – Dan
    Nov 11, 2012 at 20:04
  • I actually do need this for another script. So can you post the VBS?
    – David
    Nov 11, 2012 at 20:12

3 Answers 3

2

Caution, terrible VBS follows. This is ripped straight from an old VBS script that I wrote to deploy user shortcuts and is essentially untested etc. It doesn't display the DN of the group, but it should be possible to implement.

Option Explicit

Dim elem, UserGroupDict, ComputerGroupDict, currentDomain, currentUser, strComputerName, uCN, cCN
Dim objShell, oRoot, oDomain, fqDomain, objNetwork, objUser, objComputer, objFSO
Dim WshShell, WshNetwork

Set UserGroupDict = CreateObject("Scripting.Dictionary")
UserGroupDict.CompareMode = vbTextCompare

Set ComputerGroupDict = CreateObject("Scripting.Dictionary")
ComputerGroupDict.CompareMode = vbTextCompare

Set objShell = WScript.CreateObject( "WScript.Shell" )

'Obtain FQDN
Set oRoot = GetObject("LDAP://rootDSE")
Set oDomain = GetObject("LDAP://" & oRoot.Get("defaultNamingContext"))
fqDomain = oRoot.Get("defaultNamingContext")

'Obtain netbios username, computername and domainname
Set objNetwork = CreateObject("Wscript.Network")
currentDomain = objNetwork.UserDomain
currentUser = objNetwork.UserName
strComputerName = objNetwork.ComputerName

'Find user DistingishedName and bind to user object
uCN = findDN
Set objUser=GetObject("LDAP://" & uCN) 

'Find computers DistingishedName and bind to computer object
cCN = findDNComputer
Set objComputer=GetObject("LDAP://" & cCN) 

Set WshShell = WScript.CreateObject("WScript.Shell")
Set WshNetwork = WScript.CreateObject("WScript.Network")
Set objFSO = CreateObject("Scripting.FileSystemObject")

'Get the users group memberships
EnumUserGroups()
'Get the computers group memberships
EnumComputerGroups()

MsgBox("User DN: " + uCN)

MsgBox("Computer DN: " + cCN)

MsgBox("User Groups")

For Each elem In UserGroupDict
MsgBox elem
Next

MsgBox("Computer Groups")

For Each elem In ComputerGroupDict
MsgBox elem
Next

'=========================
'FUNCTIONS
'=========================

'Function to find groups to which user is a *DIRECT* member of.
Function EnumUserGroups() 
    Dim colGroups, objGroup

    Set colGroups = objUser.Groups
    For Each objGroup In colGroups
        If Not CBool(UserGroupDict.Exists(objGroup.CN)) Then
            UserGroupDict.Add objGroup.CN, "-"
            GetNested(objGroup)
        End If
    Next
End Function

'Searches groups recursively to enumerate nested groups
Function GetNested(objGroup) 
    Dim colMembers, strMember, strPath, objNestedGroup

    On Error Resume Next
    colMembers = objGroup.GetEx("memberOf")
    For Each strMember In colMembers
        If Not strMember = "" Then
            strPath = "LDAP://" & strMember
            Set objNestedGroup = GetObject(strPath)
            If Not CBool(UserGroupDict.Exists(objNestedGroup.CN)) Then
                UserGroupDict.Add objNestedGroup.CN, "-"
                GetNested(objNestedGroup)
            End If
        End If
    Next

    Set objNestedGroup = Nothing

End Function

'Function to find groups to which computer is a *DIRECT* member of.
Function EnumComputerGroups() 
    Dim colGroups, objGroup

    Set colGroups = objComputer.Groups
    For Each objGroup In colGroups
        If Not CBool(ComputerGroupDict.Exists(objGroup.CN)) Then
            ComputerGroupDict.Add objGroup.CN, "-"
            GetNestedComputer(objGroup)
        End If
    Next
End Function

'Searches groups recursively to enumerate nested groups
Function GetNestedComputer(objGroup)
    Dim colMembers, strMember, strPath, objNestedGroup

    On Error Resume Next
    colMembers = objGroup.GetEx("memberOf")
    For Each strMember In colMembers
        If Not strMember = "" Then
            strPath = "LDAP://" & strMember
            Set objNestedGroup = GetObject(strPath)
            If Not CBool(ComputerGroupDict.Exists(objNestedGroup.CN)) Then
                ComputerGroupDict.Add objNestedGroup.CN, "-"
                GetNested(objNestedGroup)
            End If
        End If
    Next
End Function

'Funtion to find DistinguishedName of User Object using sAMAccountName
Function findDN 
    Dim objConnection, objCommand, objRecordSet

    Set objConnection = CreateObject("ADODB.Connection")
    objConnection.Open "Provider=ADsDSOObject;"

    Set objCommand = CreateObject("ADODB.Command")
    objCommand.ActiveConnection = objConnection

    objCommand.CommandText = _
    "<LDAP://" & fqDomain & ">;(&(objectCategory=" & "User" & ")" & _
    "(samAccountName=" & currentUser & "));samAccountName,distinguishedName;subtree"

    Set objRecordSet = objCommand.Execute

    If objRecordset.RecordCount = 0 Then
        MsgBox("Error: Couldn't get User Groups. Exiting")
        WScript.Quit(0)
    Else
        findDN = objRecordSet.Fields("distinguishedName").Value
        objConnection.Close
    End If
End Function

'Funtion to find DistinguishedName of Computer Object using name
Function findDNComputer 
    Dim objConnection, objCommand, objRecordSet

    Set objConnection = CreateObject("ADODB.Connection")
    objConnection.Open "Provider=ADsDSOObject;"

    Set objCommand = CreateObject("ADODB.Command")
    objCommand.ActiveConnection = objConnection

    objCommand.CommandText = _
    "<LDAP://" & fqDomain & ">;(&(objectCategory=" & "Computer" & ")" & _
    "(name=" & strComputerName & "));samAccountName,distinguishedName;subtree"

    Set objRecordSet = objCommand.Execute

    If objRecordset.RecordCount = 0 Then
        MsgBox("Error: Couldn't get Computer Groups. Exiting")
        WScript.Quit(0)
    Else
        findDNComputer = objRecordSet.Fields("distinguishedName").Value
        objConnection.Close
    End If
End Function
1
  • Wow, thanks a lot. This seems to be very close to what I need. One modification though. Your VBS gives the group name as "Sec Group 001", is it possible to make it display the whole Distinguished Name?
    – David
    Nov 11, 2012 at 21:00
3

You can do this exact same command from a workstation as well. You can either grab the dsquery and dsget executables from a DC, or you can install RSAT or the 2003 Admin Toolkit. It's included in both.

2
  • Thanks. You see, the problem is that I can't install anything on the workstations. I need to do this with whatever I have available there... So VBS would be ideal. First, because I'm familiar with it and secondly, it has to run on Windows XP as well.
    – David
    Nov 11, 2012 at 20:29
  • 3
    This question is starting to sound like something you should be working with your systems administrators to work on. Without rights to install things you aren't going to get very far. Nov 11, 2012 at 20:31
2

Do this with PowerShell. VBS is old and busted, PowerShell is the new hotness. Here's a link to a TechNet article that discusses how to code this all out. It also has a lot of good VBS to PS conversion info.

2
  • Thanks for the link, but I have no knowledge of the power shell whatsoever. Can someone re-write my queries for me?
    – David
    Nov 11, 2012 at 20:27
  • 3
    @David NO, that not how this works. We provide ideas and suggestions, its up to you to actually implement them. If you want us to do it send me an e-mail, I'll be happy to send my consulting rates over, as will anyone else on the site. Nov 11, 2012 at 20:30

Not the answer you're looking for? Browse other questions tagged .