Richard
Fri Feb 10 20:49:16 CST 2006
Hi,
Once you have the Distinguished Name of the domain, you can bind to the
admin group objects, which by default are in the cn=Users container, like
"Domain Admins" and "Enterprise Admins", and enumerate the membership. If
any of the members are groups, you have to enumerate those groups also.
The problem is that these groups can be renamed or moved to other
containers/OU's. Also, administrative privileges can be granted to other
groups or users. I have no solution for that.
--
Richard
Microsoft MVP Scripting and ADSI
Hilltop Lab -
http://www.rlmueller.net
"COT-AD" <COTAD@discussions.microsoft.com> wrote in message
news:A170A563-D091-4B4C-8160-68F9A7156965@microsoft.com...
> Ok. What would I need to do to get the list of administrators once I have
> the list of domains?
>
> "Richard Mueller" wrote:
>
>> Hi,
>>
>> If all domains are in the same forest, you can use a recursive
>> subroutine.
>> The one below simply displays all domain names:
>>
>> Set objRootDSE = GetObject("LDAP://RootDSE")
>> Set objRootDomain = GetObject("LDAP://" &
>> objRootDSE.Get("rootDomainNamingContext"))
>>
>> Call EnumDomains(objRootDomain, "")
>>
>> Sub EnumDomains(objParent, strOffset)
>> ' Subroutine to document domains.
>> Dim objChild
>>
>> ' Document domain.
>> Wscript.Echo strOffset & obParent.Name
>>
>> ' Enumerate child domains.
>> objParent.Filter = Array("domain")
>> For Each objChild in objParent
>> Call EnumDomains(objChild, "--" & strOffset)
>> Next
>> End Sub
>>
>> --
>> Richard
>> Microsoft MVP Scripting and ADSI
>> Hilltop Lab -
http://www.rlmueller.net
>>
>> "COT-AD" <COTAD@discussions.microsoft.com> wrote in message
>> news:D7E125F7-1B45-4869-9B39-174E10E7C89C@microsoft.com...
>> >I would like to have a script that would run through every domain in the
>> > forest without any user interaction. Do you know of a way to
>> > accomplish
>> > this
>> > task?
>> >
>> > "Richard Mueller" wrote:
>> >
>> >> Hi,
>> >>
>> >> Finding all users with admin privileges can be a challenge. I thought
>> >> I
>> >> saw
>> >> a third party tool for this some time ago. If I find it, I'll post
>> >> again.
>> >> In
>> >> the meantime I have a sample VBScript program that displays all
>> >> members
>> >> of a
>> >> specified group linked here:
>> >>
>> >>
http://www.rlmueller.net/List%20Members%20of%20a%20Group.htm
>> >>
>> >> It reveals membership due to group nesting, plus the "Primary" group
>> >> membership. You can specify the Distinguished Name of the
>> >> Administrators
>> >> group (in the Builtin container), the "Domain Admins" group, the
>> >> "Enterprise
>> >> Admins" group, etc. The Administrators group should includes "Domain
>> >> Admins"
>> >> and "Enterprise Admins". At a command prompt, you could create a text
>> >> file
>> >> report of admin membership with:
>> >>
>> >> cscript //nologo EnumGroup.vbs
>> >> "cn=Administrators,cn=Builtin,dc=MyDomain,dc=com" > AdmReport.txt
>> >>
>> >> You would have to repeat this for each domain.
>> >>
>> >> --
>> >> Richard
>> >> Microsoft MVP Scripting and ADSI
>> >> Hilltop Lab -
http://www.rlmueller.net
>> >>
>> >> "COT-AD" <COTAD@discussions.microsoft.com> wrote in message
>> >> news:90ACB021-773A-4DF3-8CE4-9C8AEC87118E@microsoft.com...
>> >> >I only need to dump information about Domain Admins and Builtin
>> >> > Administrators for every domain in the forest. It appears this
>> >> > script
>> >> > dumps
>> >> > every user account in every domain.
>> >> >
>> >> > "deckhopper" wrote:
>> >> >
>> >> >> Try this?
>> >> >>
>> >> >> Set objConnection = CreateObject("ADODB.Connection")
>> >> >> objConnection.Open "Provider=ADsDSOObject;"
>> >> >>
>> >> >> Set objCommand = CreateObject("ADODB.Command")
>> >> >> objCommand.ActiveConnection = objConnection
>> >> >>
>> >> >> objCommand.CommandText = _
>> >> >> "<GC://dc=fabrikam,dc=com>;" & _
>> >> >> "(&(objectCategory=person)(objectClass=user));" & _
>> >> >> "name;subtree"
>> >> >>
>> >> >> Set objRecordSet = objCommand.Execute
>> >> >>
>> >> >> While Not objRecordset.EOF
>> >> >> Wscript.Echo objRecordset.Fields("name")
>> >> >> objRecordset.MoveNext
>> >> >> Wend
>> >> >>
>> >> >> objConnection.Close
>> >> >>
>> >> >>
>> >>
>> >>
>> >>
>>
>>
>>