View parents of many nested sub groups in Active Directory

Question

Using Exchange 2007 on a Windows 2003 Server, how can we view the parent of a nested sub group that is nested many levels deep? For example, I created a Group named "Baseball". Then, I created a second group called "Teams". I made "Teams" a member of "Baseball" by choosing "Members" -> "Add" ( under the "Baseball" group ). Then, I created another group named "Indians" and made that a member of "Teams". Finally, I made a fourth group named "Players" and made that a member of "Indians". When I look at "Member Of" for "Players", I only see that I am a member of the group "Indians". Is there somewhere where I can see that the highest level parent for "Players" is "Baseball"? I would think I should be able to see something like this:

Baseball -> Teams -> Indians -> Players

We are trying to set up an organization in Active Directory by putting groups within groups. Maybe I am even doing this the wrong way. But, I saw no options of creating a sub group when I had a group highlighted. I could only create a Group when I highlighted the folder "Users". The folder "Users" is one of about 10 folders found under our domain in the tree on the left side in Active Directory and Users.

---

That worked.

In a command prompt, I typed in:

dsquery * -filter "(member:1.2.840.113556.1.4.1941:=CN=Players,CN=Users,DC=xxx,DC=yyy,DC=zzz)"

Where xxx, yyy, zzz were the letters of my actual domain that I am not posting here for security.

Anyways, I saw the parent ( "Indians" ), grandparent ( "Teams" ), and great-grandparent ( "Baseball" ) to "Players" listed after running that dsquery command listed above.

I must admit, LDAP has a big learning curve behind it.

Other things I had tried that did not help:

1. Softerra LDAP browser tool is nice to use to return users. But, I still could not see the parents, grandparents, etc. of this lowest level group.

2. I also tried ldifde in the command line: ldifde -f exportuser.ldf

   In the exportuser.ldf file that the results were put into, I could see the "Players" group. But, only "Indians" was listed once again as the "memberOf:".

3. I also tried ldp.exe, but that was not much help either.

So, this was a nice response to help me out. Thanks!

Answer 1

With 2003, you'll need the ds tools included with the Admin Pack.

Check the "players" group DN:

dsquery group -name "players"
"CN=Players,CN=Users,DC=example,DC=org"

OK, look up the group using "1.2.840.113556.1.4.1941" LDAP_MATCHING_RULE_IN_CHAIN matching rule. This will return all matches on the member:

dsquery * -filter "(member:1.2.840.113556.1.4.1941:=CN=Players,CN=Users,DC=example,DC=org)"
"CN=Baseball,CN=Users,DC=example,DC=org"
"CN=Teams,CN=Users,DC=example,DC=org"
"CN=Indians,CN=Users,DC=example,DC=org"