I have a group that I use named staff. It is a parent of a few nested groups. I need to audit the group to list the users who aren't a part of that group or any nested child groups within it. I have found scripts that will give me the users who aren't part of the Staff group, but it doesn't include any of the child groups so a user could be part of the child group but still be listed as not being in the parent group. I don't want to have to script that for each child group of the parent.

Is there any way to list all accounts that aren't part of a group but also all of it's children?

  • Of course there is a way. By modifying the script. Get the list of all child groups and select users not in those groups – Jevgenij Martynenko Aug 2 '17 at 16:24

You can run a single LDAP query like that by using what it called the LDAP_MATCHING_RULE_IN_CHAIN operator. The numeric OID for this operator is 1.2.840.113556.1.4.1941. You request this type of option in the LDAP search by placing the numeric OID between the attribute and the value you are searching for (attribute:OID:=DN). You can run LDAP queries with the PowerShell cmdLet like this:

get-adobject -ldapfilter "(&(objectcategory=person)(objectclass=user)(!memberof:1.2.840.113556.1.4.1941:=CN=some,CN=group,DC=yourco,DC=com))"

This query also uses the not (!) operator as you are looking for users who are not a nested member of the group. You can also run LDAP queries through ADUC/DSA by selecting "Custom Search" and the "Advanced" tab.gui search

Two MS articles that cover this and some other details on LDAP search syntax that makes this possible:

  • This is perfect. Thanks for the info about the OID, and the links as well. Super helpful! – Zombian Aug 2 '17 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.