Re: Finding multiple memgers of a group

OldDog wrote:

I am working on a script that will determin if three different ID's
are in the local Administrators group on a long list of servers. I can
get my script to reliably report on ONE user, but If I try fro more
than one, I get mixed results and I can't trust the accuracy. Can
someone point me to a sample script or discussion on finding multiple
users in a group?

This script will tell me if JoeUser is a memger of the Administrators
group on a list of servers.

Option Explicit
Dim objGroup, strComputer, objFSO, objTextFile
Const ForReading = 1
On Error Resume Next
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTextFile = objFSO.OpenTextFile("C:\Scripts\servers.txt",
ForReading)
Do Until objTextFile.AtEndOfStream
strComputer = Trim(objTextFile.Readline)
If (strComputer <> "") Then

Set objGroup = GetObject("WinNT://" & strComputer & "/
Administrators,group")
Wscript.Echo "Members of local Administrators group on computer " &
strComputer
Call EnumGroup(objGroup, "")
End If
Loop

Sub EnumGroup(objGroup, strOffset)
Dim objMember
For Each objMember In objGroup.Members
'Wscript.Echo strOffset & objMember.Name & " (" &
objMember.Class & ")"
If (objMember.Name = "JoeUser") Then
Wscript.Echo strOffset & objMember.Name & " (" &
objMember.Class & ")"

End If
Next
End Sub


Since you are not tracking down group nesting, but only checking direct
group membership, it would be easier to bind to each group object and use
the IsMember method. You pass the AdsPath of the prospective member to this
method and it returns True if the corresponding object is a member. Perhaps
(watch line wrapping):
==============
Option Explicit

Dim objFSO, strComputer, objTextFile
Dim objGroup, objUser1, objUser2, objUser3

Const ForReading = 1

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTextFile = objFSO.OpenTextFile("c:\scripts\servers.txt", ForReading)

' Bind the user objects, which will be checked for membership.
Set objUser1 = GetObject("WinNT://MyDomain/JoeUser,user")
Set objUser2 = GetObject("WinNT://MyDomain/JohnWilson,user")
Set objUser3 = GetObject("WinNT://MyDomain/MarySmith,user")

Do Until objTextFile.AtEndOfStream
strComputer = Trim(objFile.ReadLine)
If (strComputer <> "") Then
Set objGroup = GetObject("WinNT://" & strComputer &
"/Administrators,group")
If (objGroup.IsMember(objUser1.AdsPath) = True) Then
Wscript.Echo "User " & objUser1.Name & " is member of
Administrators on " & strComputer
End If
If (objGroup.IsMember(objUser2.AdsPath) = True) Then
Wscript.Echo "User " & objUser2.Name & " is member of
Administrators on " & strComputer
End If
If (objGroup.IsMember(objUser3.AdsPath) = True) Then
Wscript.Echo "User " & objUser3.Name & " is member of
Administrators on " & strComputer
End If
End If
Loop

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--


.

Relevant Pages

  • Re: AD group logon script question
    ... like I described our logon script: ... If individuals need special access to certain resources, ... and each group must be protected from the administrators of the other. ... membership as required. ...
    (microsoft.public.scripting.vbscript)
  • Re: VBScript to verify is user is local admin
    ... I believe the script posted using WMI addresses one complication with the ... the WMI script, only reveal direct membership. ... Administrators group is renamed, ... Dim strUser ...
    (microsoft.public.scripting.vbscript)
  • Re: User type
    ... This does help Mike - thanks ... > If the computer is member of domain then you should use domain user ... > After you have this account and group created you can write a short script ... > administrator and make your users local administrators. ...
    (microsoft.public.windows.server.setup)
  • Re: Rid AD of Circular Group Membership
    ... That at least gets them out from the domain's Administrators group. ... that should have admin on all of the machines in that subset), ... I would try very hard to make sure that the account they use for day-to-day ... is the net result of membership in each. ...
    (microsoft.public.windows.group_policy)
  • Re: User type
    ... I miss-read you message - I now know that I must handle this in the startup ... >> After you have this account and group created you can write a short ... >> in local administrator and make your users local administrators. ... >> Put above command in batch file and run it as startup script (not logon ...
    (microsoft.public.windows.server.setup)
Loading