Mark,
In addition to what Jerold suggested, are you familiar with ldifde? This
would be another way to do what you need.
Here is an example that you could use:
ldifde -f GroupMembership.ldf -s servername -d dc=yourdomain,dc=com -p
subtree -r "(objectClass=group)" -l
"dn,member,description,mail,groupType,name"
This would give you the membership of A L L groups in your domain. Not
exactly what you want but it is a start. You could then go to that
GroupMembership.ldf file and do a 'look for' using the parameter of
'groupType: 2' for your Global Distribution Groups and 'groupType: 8' for
your Universal Distribution Groups. Just for your info and for possible
future use, any Local Security Group would have a groupType: -2147483644
while any Global Security Group would have a groupType: -2147183646 and any
Universal Security Group would have a groupType: -214748640
Here is what the above means:
ldifde = the name of the utility that you are running
-f GroupMembership.ldf = is the name of the file that will be created.
Please note that it will be located at c:\ on the DC where you run ldifde
(unless you specify another location - ldifde knows that this is an 'export'
as that is the default operation. If you were trying to use ldifde to
create the groups contained in the file listed then you would have to
stipulate this with the '-i' switch in front of -f GroupMembership.ldf )
-s servername = is the name of the DC to which you would like to bind in
order to run this tool. This is optional as ldifde will default to the DC
on which you are running it. I just like to use it to maintain good habits.
So, if you had three DCs in your domain ( DC01, DC02 and DC03 ) and you were
sitting ( either physically or remotely - maybe through TS in Remote Admin
Mode ) at DC02 but wanted to run this against DC01 you could by using the -s
DC01....otherwise it bind to DC02
-d domainname = is the root of the ldap search. Again, I like to use it
to maintain good habits. So, if your domain name is gotcha.net it would
look like this: -d dc=gotcha,dc=net
-p subtree = the Search Scope
-r "(objectClass=group)" = you are filtering the scope of this query by
making use of the -r switch. ldifde will default to "(objectClass=*)" so
you want to limit this to groups by making use of the -r
"(objectClass=group)" switch
-l "dn,....,name" = you are exporting only the fields that you want by
making use of the -l switch ( that is a lowercase letter L ).
Take a look at the following MSKB Article:
http://support.microsoft.com/default.aspx?scid=kb;[LN];237677
What exactly have you found already?
HTH,
Cary