{"id":69153,"date":"2005-08-17T20:16:00","date_gmt":"2005-08-17T20:16:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2005\/08\/17\/how-can-i-enumerate-all-the-universal-groups-in-active-directory\/"},"modified":"2005-08-17T20:16:00","modified_gmt":"2005-08-17T20:16:00","slug":"how-can-i-enumerate-all-the-universal-groups-in-active-directory","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-enumerate-all-the-universal-groups-in-active-directory\/","title":{"rendered":"How Can I Enumerate All the Universal Groups in Active Directory?"},"content":{"rendered":"

\"Hey, \n

Hey, Scripting Guy! How can I enumerate all the universal groups in Active Directory?

— MW<\/P>\"Spacer\"\"Hey,\"Script<\/A> \n

Hey, MW. You know, we\u2019re glad you asked this question. Any time people talk about Active Directory then tend to talk about groups as if Active Directory had only one type of group. It doesn\u2019t. Instead, there are six types of Active Directory groups: global, domain local, and universal security groups; and global, domain local, and universal distribution groups. And it\u2019s important to be able to distinguish between the various types: after all, your ability to perform certain tasks, such as assigning security permissions or adding users to groups, often hinges on the group type.<\/P>\n

So how do you list all the universal groups in Active Directory? The best way is by using ADO to conduct a search. The tricky part there is understanding how to search for different group types. Each group object has an attribute named groupType<\/B>, but group types are not stored by name. Consequently, a query like this, which purports to search for all universal security groups, won\u2019t work:<\/P>

“SELECT Name FROM ‘LDAP:\/\/dc=fabrikam,dc=com’ WHERE objectCategory=’group'” & _\n        “AND groupType = ‘universal security'”\n<\/PRE>\n
Instead, group types are assigned numbers, and those numbers are stored in the groupType attribute:<\/P>\n\n<\/THEAD>\n\n\n\n\n\n\n
\n
Group Type<\/B><\/P><\/TD>\n
\n
Value<\/B><\/P><\/TD><\/TR>\n
\n
Global group<\/P><\/TD>\n
\n
2<\/P><\/TD><\/TR>\n
\n
Domain local group<\/P><\/TD>\n
\n
4<\/P><\/TD><\/TR>\n
\n
Universal group<\/P><\/TD>\n
\n
8<\/P><\/TD><\/TR>\n
\n
Security group<\/P><\/TD>\n
\n
-2147483648<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
<\/DIV>\n
To search for all the universal groups, you search for groups that have a groupType value of 8. If you want to search for only universal security groups, then you need to add the value for universal groups to the value for security groups. In other words, 8 + -2147483648, which happens to equal -2147483640. To return a list of all the universal security groups in a domain, you use this query:<\/P>
“SELECT Name FROM ‘LDAP:\/\/dc=fabrikam,dc=com’ WHERE objectCategory=’group'” & _\n        “AND groupType = -2147483640”\n<\/PRE>\n
After you understand how to construct the query, the rest of the script is boilerplate: it resembles every other Active Directory search script you\u2019ve ever written. We won\u2019t discuss the details of searching Active Directory today; that goes a bit beyond the scope of this column. But if you\u2019d like to learn more about searching Active Directory, you might take a look at our two-part <\/B>Tales from the Script<\/I><\/B> series<\/B><\/A> (from April and May, 2005) that covers this very topic in-depth.<\/P>\n
Here\u2019s a completed script that returns a list of all the universal security groups found in the fabrikam.com domain:<\/P>
On Error Resume Next<\/p>\n
Const ADS_SCOPE_SUBTREE = 2<\/p>\n
Set objConnection = CreateObject(“ADODB.Connection”)\nSet objCommand =   CreateObject(“ADODB.Command”)\nobjConnection.Provider = “ADsDSOObject”\nobjConnection.Open “Active Directory Provider”\nSet objCommand.ActiveConnection = objConnection<\/p>\n
objCommand.Properties(“Page Size”) = 1000\nobjCommand.Properties(“Searchscope”) = ADS_SCOPE_SUBTREE <\/p>\n
objCommand.CommandText = _\n    “SELECT Name FROM ‘LDAP:\/\/dc=fabrikam,dc=com’ WHERE objectCategory=’group'” & _\n        “AND groupType = -2147483640” \nSet objRecordSet = objCommand.Execute<\/p>\n
objRecordSet.MoveFirst\nDo Until objRecordSet.EOF\n    Wscript.Echo objRecordSet.Fields(“Name”).Value\n    objRecordSet.MoveNext\nLoop\n<\/PRE><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! How can I enumerate all the universal groups in Active Directory?— MW Hey, MW. You know, we\u2019re glad you asked this question. Any time people talk about Active Directory then tend to talk about groups as if Active Directory had only one type of group. It doesn\u2019t. Instead, there are six types […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,44,3,5],"class_list":["post-69153","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-groups","tag-scripting-guy","tag-vbscript"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! How can I enumerate all the universal groups in Active Directory?— MW Hey, MW. You know, we\u2019re glad you asked this question. Any time people talk about Active Directory then tend to talk about groups as if Active Directory had only one type of group. It doesn\u2019t. Instead, there are six types […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/69153","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=69153"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/69153\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=69153"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=69153"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=69153"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}