PowerShell: AD Group Membership

Question

Is it possible to generate group membership for all groups in AD, b member of that group?
Thanks
*alex

Answer 1

One good thing about using DirectoryServices.DirectorySearcher in PowerShell is that the syntax is so similar to similar VBScript programs using ADODB. The first program in VBScript would be as follows:
Option Explicit
Dim adoCommand, adoConnection, strBase, strFilter, strAttributes
Dim objRootDSE, strDNSDomain, strQuery, adoRecordset, strName, strDN
Dim strLine, arrMembers, strMember
' Setup ADO objects.
Set adoCommand = CreateObject("ADODB.Command")
Set adoConnection = CreateObject("ADODB.Connection")
adoConnection.Provider = "ADsDSOObject"
adoConnection.Open "Active Directory Provider"
Set adoCommand.ActiveConnection = adoConnection
' Search entire Active Directory domain.
Set objRootDSE = GetObject("LDAP://RootDSE")
strDNSDomain = objRootDSE.Get("defaultNamingContext")
strBase = "<LDAP://" & strDNSDomain & ">"
' Filter on group objects.
strFilter = "(objectCategory=group)"
' Comma delimited list of attribute values to retrieve.
strAttributes = "distinguishedName,sAMAccountName,member"
' Construct the LDAP syntax query.
strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
adoCommand.CommandText = strQuery
adoCommand.Properties("Page Size") = 200
adoCommand.Properties("Timeout") = 30
adoCommand.Properties("Cache Results") = False
' Run the query.
Set adoRecordset = adoCommand.Execute
' Enumerate the resulting recordset.
Do Until adoRecordset.EOF
    ' Retrieve values and display.
    strDN = adoRecordset.Fields("distinguishedName").Value
    strName = adoRecordset.Fields("sAMAccountName").Value
    strLine = """" & strDN & """,""" & strName & """"
    arrMembers = adoRecordset.Fields("member").Value
    If Not IsNull(arrMembers) Then
        For Each strMember In arrMembers
            strLine = strLine & ",""" & strMember & """"
        Next
    End If
    Wscript.Echo strLine
    ' Move to the next record in the recordset.
    adoRecordset.MoveNext
Loop
' Clean up.
adoRecordset.Close
adoConnection.Close
The second program, where sAMAccountName's are substituted for member DN's, would be as follows:
Option Explicit
Dim adoCommand, adoConnection, strBase, strFilter, strAttributes
Dim objRootDSE, strDNSDomain, strQuery, adoRecordset, strName, strDN
Dim strLine, arrMembers, strMember, objMemberList
' Setup ADO objects.
Set adoCommand = CreateObject("ADODB.Command")
Set adoConnection = CreateObject("ADODB.Connection")
adoConnection.Provider = "ADsDSOObject"
adoConnection.Open "Active Directory Provider"
Set adoCommand.ActiveConnection = adoConnection
' Search entire Active Directory domain.
Set objRootDSE = GetObject("LDAP://RootDSE")
strDNSDomain = objRootDSE.Get("defaultNamingContext")
strBase = "<LDAP://" & strDNSDomain & ">"
' Retrieve all users, groups, and computers.
strFilter = "(|(objectCategory=user)(objectCategory=group)(objectCategory=computer))"
' Comma delimited list of attribute values to retrieve.
strAttributes = "distinguishedName,sAMAccountName"
' Dictionary object (hash table).
Set objMemberList = CreateObject("Scripting.Dictionary")
objMemberList.CompareMode = vbTextCompare
' Construct the LDAP syntax query.
strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
adoCommand.CommandText = strQuery
adoCommand.Properties("Page Size") = 200
adoCommand.Properties("Timeout") = 30
adoCommand.Properties("Cache Results") = False
' Run the query.
Set adoRecordset = adoCommand.Execute
' Enumerate the recordset.
Do Until adoRecordset.EOF
    ' Retrieve values and display.
    strDN = adoRecordset.Fields("distinguishedName").Value
    strName = adoRecordset.Fields("sAMAccountName").Value
    ' Skip contacts.
    If (strName <> "") Then
        objMemberList.Add strDN, strName
    End If
    ' Move to the next record in the recordset.
    adoRecordset.MoveNext
Loop
' Recordset must be closed before it can be opened again.
adoRecordset.Close
' Filter on all group objects.
strFilter = "(objectCategory=group)"
' Comma delimited list of attribute values to retrieve.
strAttributes = "distinguishedName,sAMAccountName,member"
' Construct the LDAP syntax query.
strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
adoCommand.CommandText = strQuery
' Run the query.
Set adoRecordset = adoCommand.Execute
' Enumerate the resulting recordset.
Do Until adoRecordset.EOF
    ' Retrieve values and display.
    strDN = adoRecordset.Fields("distinguishedName").Value
    strName = adoRecordset.Fields("sAMAccountName").Value
    strLine = """" & strDN & """,""" & strName & """"
    arrMembers = adoRecordset.Fields("member").Value
    If Not IsNull(arrMembers) Then
        For Each strMember In arrMembers
            If (objMemberList.Exists(strMember) = True) Then
                ' Substitute the sAMAccountname from dictionary object.
                strLine = strLine & ",""" & objMemberList(strMember) & """"
            Else
                ' Use the Distinguished Name.
                strLine = strLine & ",""" & strMember & """"
            End If
        Next
    End If
    Wscript.Echo strLine
    ' Move to the next record in the recordset.
    adoRecordset.MoveNext
Loop
' Clean up.
adoRecordset.Close
adoConnection.Close
Richard Mueller - MVP Directory Services