Querying AD Groups

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I ran into a problem today when querying AD Groups via WSH using either the
LDAP or WinNT provider. When I query Global Groups for their memberships I am
only returned users and not the nested Global Groups. When I query Domain
Local Groups I get both users and Global Groups as output. We are on a
Windows 2000 domain. Anyone have any ideas? Thanks in advance.
 
WinNT can't see same scope nesting. That is why you see GG in DLG nesting but
not GG in GG. You also wouldn't see DLG in DLG.

LDAP doesn't automatically chase nesting, you need to do it manually in your script.

The other option is to enumerate the tokenGroups attribute and resolve the SIDS
to names.

joe

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm
 
bxr222 said:
I ran into a problem today when querying AD Groups via WSH using either the
LDAP or WinNT provider. When I query Global Groups for their memberships I
am
only returned users and not the nested Global Groups. When I query Domain
Local Groups I get both users and Global Groups as output. We are on a
Windows 2000 domain. Anyone have any ideas? Thanks in advance.
Click to expand...

The WinNT provider never exposes nested groups, except in local groups. The
LDAP provider exposes groups as members of groups, but you must chase the
nesting. This is true if you use the memberOf attribute of the user or the
member attribute of the group. In both cases LDAP does not expose membership
in the "Primary" group.

The tokenGroups attribute of user objects is a multi-valued collection of
the Sids of groups the user belongs to. It includes the "primary" group and
all nested groups (except in other domains). It requires some code to
retrieve group names. Also, it doesn't help enumerate the membership of a
group.

A sample VBScript program to document group membership with a recursive
subroutine to chase the member attributes of the groups is linked here:

http://www.rlmueller.net/List Members of a Group.htm

The program also uses the primaryGroupToken attribute to reveal "primary"
group membership. The program uses a dictionary object to reveal duplicates
(a user is a member directly, and then again due to membership in a nested
group) and also to prevent an infinite loop if the nesting is circular.
 
Back
Top