How to Enumerate Users in a Group with VBScript

Guy recommends:
VBScript Training Video on CD

---

Guy's Top 10 Free Tools

1) FreePing
2) Network Monitor
3) Xobni
4) PuTTY (UNIX)
5) IP SLA Monitor
6) BgInfo
7) Net-SNMP
8) CatTools 
9) Exchange Monitor
10) WinDiff

Tutorial for Enumerating Users in a Group with VBScript

This page will show you how to list all the members of a group.  By group, I mean the Global, Domain Local and Universal Groups found in Active Directory.  Feel free to adapt my examples to enumerate groups in your Windows Server 2003 domain.

Topics for Discovering which Users are in Group with VBScript

• Our Mission and Goal
• Example 1:  Discovering who is a member of the Administrators Group
• VBScript Tutorial: Learning Points for Enumerating a Group
• Example 2:  Amended Script to Display Group Members neatly
• Example 3:  Example Kindly Sent by John Wagner
• Summary of Enumerating a Group

Our Mission and Goal

Part of the reason why groups are so tricky is the sheer number of different VBScript techniques that you can apply to the group object.  This page is all about listing members or enumerating.  Incidentally, I love that first syllable - enuuuum.

Before we start scripting, let us pay attention to detail and examine the two relevant tabs in Active Directory Users and Computers.  The first tab is called Members and it means, 'who is in this group'.  The second tab is Member Of, this lists  not users, but other groups to which the selected group belongs.  It really is worth mastering this difference between Members (plural) and Member Of (singular).

Example 1: Discover who are the 'Members' belonging to the
Administrators Group

This script employs the GetEx method to interrogate the members attribute of the Administrators group.  Perhaps Members array would be a more descriptive term, in any case, the technique involves looping through the 'Members' field, listing the users.  When ever you want to discover more about these LDAP properties, launch ADSI Edit (see more here).

Prerequisites

I recommend that you logon as administrator, preferably at a domain controller.  Alternatively, try Remote Desktop.  If all else fails, you can try these script on an XP machine as a non-administrator, but why introduce extra complications?  Let us start with some easy successes.

Instructions for Listing the Administrators

1. You should run this VBScript on a Windows Active Directory domain.
2. Copy and paste the example script below into notepad or a VBScript editor.
3. Save the file with a .vbs extension, for example: GroupEnum.vbs.
4. Double click GroupEnum.vbs and check the strOU for your new group.

Sample Script to Discover who is a Member of the Administrators Group

Script corrected August 2005. Line 12 now says:
strContainer= "cn=administrators,cn=Builtin"

VBScript Tutorial - Learning Points

Note 1: The crucial feature of this script is: arrMemberOf = objGroup.GetEx("member"). Normally it would be plain Get("member").  However, since we are dealing with an array, we must get the extended or expanded list, hence GetEx, not Get.

Note 2: Observe how the 'For... Next' loop is also extended to,  'For Each .... Next'.  Or to be accurate the construction is 'For Each.... in ...Next'.  The reason for the extra command is that we are dealing with not one, but a collation of members in the Administrators group.

Note 3:  After case sensitive problems with 'user', (in other scripts), I can report that here, 'member' or 'MEMBERS' are equally effective.  Neither produces an error.

Note 4: However, beware of spaces "Member  " does not work it should be "Member".

Example 2:  Amended Script to Display Group Members neatly

This script achieves the same result, but displays the names more clearly by removing the dc=domain clutter.

Script corrected August 2005. Line 12 now says:
strContainer= "cn=administrators,cn=Builtin"

Learning Points

Note 1: The improvements are mainly cosmetic, nevertheless, there filters 'Mid' and 'Split' are handy to make the output easier to read.

Note 2: With 'Split', arrGroup(0) on the following line, is crucial.  To see what I mean change to arrGroup(1).

 Example 3: Enumerating Group with VBScript Kindly Sent by John Wagner

John says: "I'm using this to enable scheduled tasks. I spent a fair bit of time trying to figure how to do this my way."

Guy says: "Never miss the chance of learning by studying two different methods of achieving the same goal".

Summary of Enumerating a Group

This script lists the membership of the Administrators group.  The key attribute is "Member".  The key to understand what the script does is to investigate the User's Member and Member Of tabs and compare them with your script commands.

Guy Thomas recommends Computer Training Software. 

Their topics and material are ideal for getting you started with VBScript.  The videos are easy to follow and you can control the pace.  Try their free demo material and then see if you want to buy the full package. See more about VB Script Training CD.

See Also

● Enumerate Groups a User is a MemberOf       ● Create a Group       ● Add Members to a Group