{"id":63833,"date":"2007-10-10T10:25:00","date_gmt":"2007-10-10T10:25:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2007\/10\/10\/hey-scripting-guy-how-can-i-search-multiple-ous-in-active-directory\/"},"modified":"2007-10-10T10:25:00","modified_gmt":"2007-10-10T10:25:00","slug":"hey-scripting-guy-how-can-i-search-multiple-ous-in-active-directory","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/hey-scripting-guy-how-can-i-search-multiple-ous-in-active-directory\/","title":{"rendered":"Hey, Scripting Guy! How Can I Search Multiple OUs in Active Directory?"},"content":{"rendered":"

\"Hey, <\/H2>\n

Hey, Scripting Guy! I have an HTA that searches Active Directory for user accounts and then displays those user names. We have 10 OUs in Active Directory, but I only want to retrieve the users from three of those OUs. How do I do that?

— DP<\/P>\"Spacer\"\"Hey,\"Script<\/A> \n

Hey, DP. Here\u2019s a little secret for you: it\u2019s very easy to tell when a writer is getting lazy and isn\u2019t even trying any more. How can you tell that? Because they will inevitably start off an article by using some tired old clich\u00e9, like the old \u201cI\u2019ve got some good news for you and some bad news for you\u201d routine. Just something everyone should watch out for; you know how the Scripting Guys feel about lazy writers who don\u2019t even try anymore. Now, as for your question about searching Active Directory, well, we\u2019ve got some good news for you and some bad news for you. Let\u2019s go over the bad news first. You want to search Active Directory for user accounts, but you only want to retrieve the accounts found in 3 of your 10 OUs. Well, guess what? You can\u2019t do that. (At least not very easily.) That\u2019s because, oddly enough, Active Directory does not have a property that specifies the OU where a user account (or any other object) resides. In theory, we could write a complicated wildcard-based query that might<\/I> do the trick, but we can\u2019t do anything as simple and straightforward as this hypothetical Where clause:<\/P>

Where OU=’Finance’ OR OU=’Research’ OR OU=”Shipping’\n<\/PRE>\n
It just can\u2019t be done.<\/P>\n
Anyway, sorry about the bad news, DP. See you all tomorrow!<\/P>\n
Oh, right. As the Scripting Editor has \u2026 helpfully \u2026 pointed out, any time you do the old good news-bad news routine it\u2019s customary to tell people the good news as well. (Unfortunately, that\u2019s also a lot more work, which is why we didn\u2019t tell you the good news in the first place. Besides, we\u2019d always heard that no news was<\/I> good news.) But, as you know, the Scripting Editor\u2019s word is law. Therefore, DP, the good news is that we can still retrieve users from a specified set of OUs; we just have to perform multiple searches in order to do so. (But don\u2019t worry; Active Directory searches \u2013 particularly searches targeted towards a single OU \u2013 are pretty darn fast.) And there\u2019s even better<\/I> news: we\u2019ll also show you an HTA that displays all<\/I> your OUs in a list box, lets you select as many (or as few) of those OUs as you wish, and then retrieves information about the user accounts found in each of the selected OUs.<\/P>\n
We agree: that\u2019s also the best news that we\u2019ve<\/I> heard all week.<\/P>\n
But, then again, we work at Microsoft, so we don\u2019t have much of a chance to hear really<\/I> good news. (Scripting Guys advice: Don\u2019t ever<\/I> say the letters MTPS in front of the Scripting Editor. Trust us.)<\/P>\n
At any rate, here\u2019s the code:<\/P>
<SCRIPT Language=”VBScript”><\/p>\n
    Const ADS_SCOPE_SUBTREE = 2\n    Const ADS_SCOPE_ONELEVEL = 1<\/p>\n
    Set objConnection = CreateObject(“ADODB.Connection”)\n    Set objCommand =   CreateObject(“ADODB.Command”)\n    objConnection.Provider = “ADsDSOObject”\n    objConnection.Open “Active Directory Provider”\n    Set objCommand.ActiveConnection = objConnection<\/p>\n
    objCommand.Properties(“Page Size”) = 1000<\/p>\n
    Sub Window_onLoad\n        objCommand.Properties(“Searchscope”) = ADS_SCOPE_SUBTREE \n        objCommand.CommandText = _\n            “SELECT Name, ADsPath FROM ‘LDAP:\/\/dc=fabrikam,dc=com’ WHERE ” & _\n                “objectCategory=’organizationalUnit’ ORDER By Name”  \n        Set objRecordSet = objCommand.Execute<\/p>\n
        objRecordSet.MoveFirst<\/p>\n
        strHTML = “<select size = ’20’ name=’OUList’ style=’width:300px’>”<\/p>\n
        Do Until objRecordSet.EOF  \n            Set objOption = Document.createElement(“OPTION”)\n            objOption.Text = objRecordSet.Fields(“Name”).Value\n            objOption.Value = objRecordSet.Fields(“ADsPath”).Value\n            MyOUs.Add(objOption)\n            objRecordSet.MoveNext\n         Loop<\/p>\n
    End Sub<\/p>\n
    Sub SearchForUsers\n        For i = 0 to (MyOUs.Options.Length – 1)\n            If (MyOUs.Options(i).Selected) Then\n                strSearchOU = MyOUs.Options(i).Value \n                objCommand.Properties(“Searchscope”) = ADS_SCOPE_ONELEVEL <\/p>\n
                objCommand.CommandText = _\n                    “SELECT Name FROM ‘” & strSearchOU & “‘ WHERE objectCategory=’user'”  \n                Set objRecordSet = objCommand.Execute<\/p>\n
                If objRecordSet.RecordCount > 0 Then\n                    objRecordSet.MoveFirst\n                    Do Until objRecordSet.EOF\n                        strNames = strNames & objRecordSet.Fields(“Name”).Value & “<BR>”\n                        objRecordSet.MoveNext\n                    Loop\n                End If\n            End If\n        Next\n        UserList.InnerHTML = strNames\n    End Sub<\/p>\n
<\/SCRIPT><\/p>\n
<body>\n    <select size=”10″ name=”MyOUs” style=”width:400″ multiple><\/select><p>\n    <input type=”button” value=”Get Users” onClick=”SearchForUsers”><p>\n    <div id=”UserList”><\/div>\n<\/body>\n<\/PRE>\n
You\u2019re right: this is<\/I> a big, long chunk of code, isn\u2019t it? But don\u2019t worry; we\u2019ll explain how it all works.<\/P>\n\n<\/THEAD>\n\n\n
\n
Note<\/B>. Well, except for the parts where we don\u2019t<\/I> explain how it all works. For example, we won\u2019t talk much about the basic fundamentals of searching Active Directory; for that, we recommend you take a peek at our two-part Tales From the Script<\/I> series Dude, Where\u2019s My Printer?<\/B><\/A> And we won\u2019t spend a lot of time discussing the process by which we create a dynamic list box for displaying OUs; after all, we already have a column<\/B><\/A> that discusses the process for creating dynamic list boxes. And \u2013 well, you get the idea.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
<\/DIV>\n
Let\u2019s start by looking at the HTML objects we\u2019re using in this HTA:<\/P>
<select size=”10″ name=”MyOUs” style=”width:400″ multiple><\/select><p>\n<input type=”button” value=”Get Users” onClick=”SearchForUsers”><p>\n<div id=”UserList”><\/div>\n<\/PRE>\n
As you can see, our HTA consists of three objects:<\/P>\n\n\n\n\n\n
\u2022<\/TD>\n\n
A multi-select list box named MyOUs<\/B>. How do we know that this is a multi-select list box? Because we added the multiple<\/B> parameter. What is a multi-select list box? That\u2019s simply a list box that allows you to make multiple selections: you can click on as many items as you wish, and our subroutine (which we\u2019ll talk about in a minute or two) will run against each of the selected items.<\/P><\/TD><\/TR>\n
\u2022<\/TD>\n\n
A button with the label Get Users<\/B>. When this button is clicked, a subroutine named SearchForUsers is triggered; as the name implies, this is the subroutine that searches for users in the selected OUs. The basic premise here is that you select as many (or as few) OUs from the list box as needed, then click the Get Users<\/B> button; in turn, the SearchForUsers subroutine will grab user account information from the selected OUs and then \u2013 well, good question: what will the subroutine do with that information? (Hint: The answer can be found in the next bullet.)<\/P><\/TD><\/TR>\n
\u2022<\/TD>\n\n
A <DIV> with the ID UserList<\/B>. A <DIV> is nothing more than a named area of an HTA, an area whose contents can be manipulated programmatically. As you can see, right now our <DIV> doesn\u2019t actually have any content. But that\u2019s only temporary; the SearchForUsers subroutine will eventually write the retrieved user names to this portion of the HTA.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
Got all that? Good; now it\u2019s time to talk scripting.<\/P>\n\n<\/THEAD>\n\n\n
\n
Note<\/B>. Ah, good question: is talking scripting good news or bad news? Guess we\u2019ll all find out in a minute, won\u2019t we?<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
<\/DIV>\n
To begin with, you might have noticed that we started off our HTA with the <SCRIPT> tag, then immediately added in the following lines of code, code that we did not<\/I> include in a subroutine:<\/P>
Const ADS_SCOPE_SUBTREE = 2\nConst ADS_SCOPE_ONELEVEL = 1<\/p>\n
Set objConnection = CreateObject(“ADODB.Connection”)\nSet objCommand =   CreateObject(“ADODB.Command”)\nobjConnection.Provider = “ADsDSOObject”\nobjConnection.Open “Active Directory Provider”\nSet objCommand.ActiveConnection = objConnection<\/p>\n
objCommand.Properties(“Page Size”) = 1000\n<\/PRE>\n
Why didn\u2019t we put these commands in a subroutine? Well, what we\u2019re doing here is defining a pair of constants (ADS_SCOPE_SUBTREE and ADS_SCOPE_ONELEVEL); creating a pair of objects (ADODB.Connection<\/B> and ADODB.Command<\/B>); and then configuring some of the properties for these objects. We want these constants and objects to be global; that is, we want them to be available to all the subroutines in our HTA. The easiest way to do that is to place the code inside the <SCRIPT> tag, but not<\/I> inside a subroutine. So that\u2019s exactly what we did.<\/P>\n\n<\/THEAD>\n\n\n
\n
Note<\/B>. Incidentally, these commands are explained in more detail in our Tales From the Script series<\/B><\/A>.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
<\/DIV>\n
Now we have our two subroutines \u2013 Window_OnLoad and SearchForUsers \u2013 to deal with. To begin with, we should note that we didn\u2019t pick the name Window_OnLoad simply because we liked the way that sounded. (Although it does<\/I> tend to just roll off the tongue, doesn\u2019t it?) Instead, we chose this name because any subroutine with the name Window_OnLoad automatically runs any time an HTA is opened or refreshed. By putting our code for retrieving a list of OU names in a subroutine named Window_OnLoad, we guarantee that each time we start the HTA our list box will be populated with all the OUs in Active Directory.<\/P>\n
As for how<\/I> we go about retrieving OU names, well, again, we won\u2019t discuss that in any detail today. Instead, we\u2019ll simply focus on the SQL query we employed:<\/P>
objCommand.CommandText = _\n    “SELECT Name, ADsPath FROM ‘LDAP:\/\/dc=fabrikam,dc=com’ WHERE ” & _\n        “objectCategory=’organizationalUnit’ ORDER By Name”\n<\/PRE>\n
As you can see, we\u2019re requesting that the script return the values of two attributes (Name<\/B> and ADsPath<\/B>) for all the objects in the domain (fabrikam.com) that have an objectCategory<\/B> equal to organizationalUnit<\/I>. (In addition, we\u2019re also sorting these objects alphabetically by Name.) How do we know that we\u2019ll get back all<\/I> the OUs in the domain? Because, right before we execute the query, we set the Searchscope<\/B> to ADS_SCOPE_SUBTREE:<\/P>
objCommand.Properties(“Searchscope”) = ADS_SCOPE_SUBTREE\n<\/PRE>\n
When we do that, our script searches not only the specified container (fabrikam.com) but also any and all sub-containers (e.g., any and all OUs and sub-OUs). Because we started the search in our Active Directory root, the script will methodically search the entire directory service, and bring back each of the OUs it finds lurking in there.<\/P>\n
Once we get back a recordset containing all the OU names we then use this block of code to add each OU to the list box:<\/P>
Do Until objRecordSet.EOF  \n    Set objOption = Document.createElement(“OPTION”)\n    objOption.Text = objRecordSet.Fields(“Name”).Value\n    objOption.Value = objRecordSet.Fields(“ADsPath”).Value\n    MyOUs.Add(objOption)\n    objRecordSet.MoveNext\nLoop\n<\/PRE>\n
Without going into too much detail, for each record (OU) in our recordset we create an instance of the Option<\/B> object. We assign the OU Name to the Text<\/B> property (the label displayed in the list box) and the ADsPath to the Value<\/B> property (the actual information to be used by our SearchForUsers subroutine). Once that\u2019s done we call the Add<\/B> method to add this new option to the list box.<\/P>\n
Isn\u2019t that a lot of work just to get our HTA up and running? Well, sure; the bad news is that there is<\/I> a little bit of prep work required to get things going here. But if there\u2019s bad news that can only mean one thing: there must be some good news as well. And the good news is that we\u2019re now ready to start searching for user accounts.<\/P>\n
Before we can do that, of course, we need to figure out which OUs we\u2019re supposed to search. The easiest way to do that? By executing this block of code:<\/P>
For i = 0 to (MyOUs.Options.Length – 1)\n    If (MyOUs.Options(i).Selected) Then\n        strSearchOU = MyOUs.Options(i).Value\n<\/PRE>\n
What we\u2019ve done here is set up a For Next loop that runs from 0 to the Length<\/B> of the list box, minus 1. Why 0? Because, in a VBScript collection, the first item always has the index number 0. And why the number of items minus 1<\/I>? Well, suppose we selected three items in the list box. The first item has the index number 0; the second item has the index number 1; and the third item has the index number 2. The last item in a collection always has an index number 1 less than the total number of items in that array.<\/P>\n
Crazy, but that\u2019s how it works.<\/P>\n
For each item in the list box we check to see if the Selected<\/B> property is True; if it is, that means that this OU was selected and needs to be searched. To carry out that search we grab the Value property (which just happens to be the ADsPath for the OU) and stash that information in a variable named strSearchOU.<\/P>\n
Now we have two other chores to carry out. First, we need to set the SearchScope to ADS_SCOPE_ONELEVEL:<\/P>
objCommand.Properties(“Searchscope”) = ADS_SCOPE_ONELEVEL\n<\/PRE>\n
Why? Because this constant tells the script to search only<\/I> the specified OU; it will not search any child OUs. That\u2019s how we manage to limit a search to a single OU.<\/P>\n
Second, we need to define our SQL query:<\/P>
objCommand.CommandText = _\n    “SELECT Name FROM ‘” & strSearchOU & “‘ WHERE objectCategory=’user'”\n<\/PRE>\n
In this query, we\u2019re simply searching the selected OU, retrieving the Name of every object that has an objectCategroy equal to user<\/I>. Needless to say, that\u2019s going to bring back a recordset containing information about each user in the OU. And then for each user in that recordset we add the user name and a <BR> tag (the HTML equivalent of the carriage return-linefeed character):<\/P>
strNames = strNames & objRecordSet.Fields(“Name”).Value & “<BR>”\n<\/PRE>\n
What if we selected more than one OU in the list box? That\u2019s fine; after we finish with the first OU we loop around and continue looking for more selected items. If we find one, we repeat this process using that<\/I> OU.<\/P>\n
When we\u2019ve finished with all the items in the list box we then use this line of code to write the user names to our <DIV>:<\/P>
UserList.InnerHTML = strNames\n<\/PRE>\n
That should do it, DP. The bad news is that this isn\u2019t a very fancy HTA; you\u2019ll undoubtedly need to do some additional work to ensure that the returned information is displayed in a coherent fashion. (Incidentally, here\u2019s one cool way<\/B><\/A> to do that.) The good news is that even though this is<\/I> a bit of a workaround, at least it enables you to retrieve user accounts from three different OUs, even if it does require three separate searches.<\/P>\n
Oh, and the even better<\/I> news? That\u2019s right: we\u2019re finally done for today! See you all tomorrow.<\/P><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! I have an HTA that searches Active Directory for user accounts and then displays those user names. We have 10 OUs in Active Directory, but I only want to retrieve the users from three of those OUs. How do I do that?— DP Hey, DP. Here\u2019s a little secret for you: it\u2019s […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,3,8,5],"class_list":["post-63833","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-scripting-guy","tag-searching-active-directory","tag-vbscript"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! I have an HTA that searches Active Directory for user accounts and then displays those user names. We have 10 OUs in Active Directory, but I only want to retrieve the users from three of those OUs. How do I do that?— DP Hey, DP. Here\u2019s a little secret for you: it\u2019s […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/63833","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=63833"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/63833\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=63833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=63833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=63833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}