{"id":85951,"date":"2004-09-30T06:13:14","date_gmt":"2004-09-30T14:13:14","guid":{"rendered":"http:\/\/devblogs.microsoft.com\/scripting\/?p=85951"},"modified":"2019-06-05T06:19:29","modified_gmt":"2019-06-05T14:19:29","slug":"how-can-i-compare-the-memberships-of-two-groups","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-compare-the-memberships-of-two-groups\/","title":{"rendered":"How Can I Compare the Memberships of Two Groups?"},"content":{"rendered":"

\"Hey, \n

Hey, Scripting Guy! I\u2019m looking for a script that can get the memberships of two different groups, compare them, and then write out the differences. Can you help?

— LS<\/P>Spacer\"Hey,\"Script<\/A> \n

Hey, LS. When we received your question a week or so ago we thought, \u201cThat\u2019s a good question. Let\u2019s put it on the list and answer it sometime.\u201d Since then we\u2019ve had 3 or 4 more people ask the same question. Well, there\u2019s one thing about us Microsoft Scripting Guys: you might have to ask us 5 or 6 times, but by the 7th<\/SUP> time we finally get the hint. Here\u2019s how you can do this.<\/P>\n

Because a couple of people specifically mentioned being able to compare the local Administrators group on two different computers that\u2019s the example we\u2019re going to use. But, needless to say, you can compare any<\/I> two groups using this same technique. Want to compare two groups on the same computer? No problem. Want to compare two Active Directory groups? No problem. How about a local group and an Active Directory group? That\u2019s right: no problem.<\/P>\n

To begin with, we need some code that can grab the list of members of our two local groups and then stash that information somewhere so that we can then compare the two lists. Getting the membership is easy; here\u2019s a script that retrieves the members of the Administrators group on the computer atl-ws-01:<\/P>

strComputer = “atl-ws-01”\nSet objGroup = GetObject(“WinNT:\/\/” & strComputer & “\/Administrators”)\nFor Each objUser in objGroup.Members\n     Wscript.Echo objUser.Name   \nNext\n<\/PRE>\n
Of course, the preceding script echoes the user names to the screen. We don\u2019t really want to that; instead, we want to hang on to those user names so that we can then compare them with the names we get from the second computer. Fortunately, there\u2019s an easy way to do this: we just stuff the names into a Dictionary object:<\/P>
Set objGroup1 = CreateObject(“Scripting.Dictionary”)<\/p>\n
strComputer = “atl-ws-01”\nSet objGroup = GetObject(“WinNT:\/\/” & strComputer & “\/Administrators”)\nFor Each objUser in objGroup.Members\n    objGroup1.Add objUser.Name, objUser.Name   \nNext\n<\/PRE>\n
If you aren\u2019t familiar with the Dictionary object, you might want to check out this section of the Microsoft Windows 2000 Scripting Guide<\/B><\/A>. For now, consider the Dictionary object a collection of key\/value pairs; typically you store things like states and their state capitals in a Dictionary object:<\/P>
Washingon\/Olympia\nOregon\/Salem\nIdaho\/Boise\n<\/PRE>\n
In this example, Idaho is a key and Boise is its corresponding value. Oregon is a key, and Salem is its corresponding value.<\/P>\n
The whole idea here is that you can ask a question like, \u201cWhat is the capital of Washington?\u201d and the script can check the key\/value pair and respond, \u201cOlympia.\u201d It does this by searching for the key – Washington – and then reporting back the value: Olympia. Of course, in our case, we\u2019re really only interested in the keys; we want to be able to ask a question like, \u201cIs Bob a member of Group 1?\u201d However, since the Dictionary object requires both a key and a value, we end up putting the same information (the user name) in each. Thus we end up with a list like this:<\/P>
Bob\/Bob\nJill\/Jill\nJoe\/Joe\nSusan\/Susan\n<\/PRE>\n
But don\u2019t worry about the values. The important thing is that the collection of keys looks like this:<\/P>
Bob\nJill\nJoe\nSusan\n<\/PRE>\n
If we repeat this process for Computer 2 (using a second Dictionary object to hold the membership of that group), we\u2019ll have a script that looks similar to this:<\/P>
Set objGroup1 = CreateObject(“Scripting.Dictionary”)\nSet objGroup2 = CreateObject(“Scripting.Dictionary”)<\/p>\n
strComputer = “atl-ws-01”\nSet objGroup = GetObject(“WinNT:\/\/” & strComputer & “\/Administrators”)\nFor Each objUser in objGroup.Members\n    objGroup1.Add objUser.Name,objUser.Name   \nNext<\/p>\n
strComputer = “atl-ws-02”\nSet objGroup = GetObject(“WinNT:\/\/” & strComputer & “\/Administrators”)\nFor Each objUser in objGroup.Members\n    objGroup2.Add objUser.Name,objUser.Name   \nNext\n<\/PRE>\n
No, sorry, we aren\u2019t done yet. But we\u2019re getting close. We now have the two membership lists, and all we have to do is compare them and write out any differences. How do we do that? As it turns out, you can use a For Each loop to cycle through all the keys in a Dictionary object. For example, if you want to echo all the key names you can use code like this:<\/P>
colKeys = objGroup1.Keys\nFor Each strUser in colKeys\n    Wscript.Echo strUser\nNext\n<\/PRE>\n
Of course, we don\u2019t want to echo the membership list, we want to find out who is in Group 1 and then check to see if they are also in Group 2. To do that, we use the For Each loop to get the first user in Group 1 – Bob – and we then use the Dictionary object\u2019s Exists method to see if Bob is also in Group 2. If he is, that\u2019s fine; if he\u2019s not, we then echo a message that says \u201cBob is not in Group 2.\u201d We know, that sounds complicated, but it only takes a few lines of code:<\/P>
colKeys = objGroup1.Keys\nFor Each strUser in colKeys\n    If Not objGroup2.Exists(strUser) Then\n        Wscript.Echo strUser & ” is not in Group 2.”\n    End If\nNext\n<\/PRE>\n
We then repeat the process with Group 2, checking to see if all the users in that group are members of Group 1. When that part of the script ends, we\u2019ll have a list of the differences between the two groups.<\/P>\n
Here\u2019s the completed script. Again, it might look a little weird, but that\u2019s simply because people don\u2019t use the Dictionary object very often. It\u2019s actually very simple, though, and even – heaven forbid! – has some logic to it:<\/P>
Set objGroup1 = CreateObject(“Scripting.Dictionary”)\nSet objGroup2 = CreateObject(“Scripting.Dictionary”)<\/p>\n
strComputer = “atl-ws-01”\nSet objGroup = GetObject(“WinNT:\/\/” & strComputer & “\/Administrators”)\nFor Each objUser in objGroup.Members\n    objGroup1.Add objUser.Name,objUser.Name   \nNext<\/p>\n
strComputer = “atl-ws-02”\nSet objGroup = GetObject(“WinNT:\/\/” & strComputer & “\/Administrators”)\nFor Each objUser in objGroup.Members\n    objGroup2.Add objUser.Name,objUser.Name   \nNext<\/p>\n
colKeys = objGroup1.Keys\nFor Each strUser in colKeys\n    If Not objGroup2.Exists(strUser) Then\n        Wscript.Echo strUser & ” is not in Group 2.”\n    End If\nNext<\/p>\n
colKeys = objGroup2.Keys\nFor Each strUser in colKeys\n    If Not objGroup1.Exists(strUser) Then\n        Wscript.Echo strUser & ” is not in Group 1.”\n    End If\nNext<\/PRE><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! I\u2019m looking for a script that can get the memberships of two different groups, compare them, and then write out the differences. Can you help?— LS Hey, LS. When we received your question a week or so ago we thought, \u201cThat\u2019s a good question. Let\u2019s put it on the list and answer […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-85951","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! I\u2019m looking for a script that can get the memberships of two different groups, compare them, and then write out the differences. Can you help?— LS Hey, LS. When we received your question a week or so ago we thought, \u201cThat\u2019s a good question. Let\u2019s put it on the list and answer […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/85951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=85951"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/85951\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=85951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=85951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=85951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}