Output machine AD groups to text file?

[FN-GM]

Hi,

 

Does anyone know a way i can make a computer on a domain output its AD groups to a text file please?

 

Thanks

[mac_shinobi]

VBScript - Listing AD Computer Group Membership

 

Vb Script, Power Shell, Bat file or what exactly ?

 

If there is a command that will do this in a command prompt or batch file you could pipe the output to a text file , I know this is for ipconfig but something like :

 

ipconfig /all>C:\log.txt

 

Would gpresult show this ?

Edited February 14, 2012 by mac_shinobi

[FN-GM]

Anything will do. I have a big job on. We are doing a rollout where we need to give users new machines. We need to retain the old computer account in ad for a time and keep the old machine joined to the domain for a time. So i need to create new computer accounts for these new machines. I need to add the computers to the same groups as the olds ones. Some of them have 30 odd groups so its going to take a long time!

 

I did think GP result but it would only show the applied group policies.

[pete]

dsquery computer -name PC-01 | dsget computer -memberof

 

Modify -name and PC-01 to suit. dsquery computer /? for more info.

 

Piping dsquery into dsget negates the need to type out the LDAP string for dsget.

 

results in:

 

C:\Users\pete>dsquery computer -name PC-01 | dsget computer -memberof
"CN=SanakoStudentClientApp,OU=Workstations,DC=Your,DC=Domain,DC=Whatever"
"CN=Rm25-StudentMachines,OU=Rm25,OU=Workstations,DC=Your,DC=Domain,DC=Whatever"
"CN=Domain Computers,CN=Users,DC=Your,DC=Domain,DC=Whatever"

Redirect the output to a file and script the input from a list of names.

Edited February 14, 2012 by pete

[FN-GM]

If i run it on the local machine can i use localhost instead of the machine name?

 

Thanks

[mac_shinobi]

If i run it on the local machine can i use localhost instead of the machine name?

 

Thanks

 

Could you not just use the variable / enviroment variable ie %computername% instead of localhost ?

[pete]

Localhost won't work (doesn't expand correctly - dsquery can't understand it), %computername% will.

 

However, you'll need to run this from a DC / somewhere with remote management tools* installed, so it's a moot point. Run it against a list of machines.

 

*it works on my Win7 Sysadmin VM, but that's not a fair test.

Edited February 14, 2012 by pete

[FN-GM]

Ah, so it wont work on machines without the RSAT tools on? If so it wont be fit for what i need. Dam! Edited February 14, 2012 by FN-GM

[pete]

Ah, so it wont work on machines without the RSAT tools on?

 

Correct - RSAT or a DC/other server with RSAT.

[FN-GM]

grrr, thought we had it then. I could do with something that doesnt require the RSAT tools and something that is processed on the machine itself.

 

 

Thanks

[Arthur]

I could do with something that doesn't require the RSAT tools and something that is processed on the machine itself.

Two options...

 

1. MemberOf from JoeWare.net.
    
   

   MemberOf.exe -comp %UserDomain%\%ComputerName% > %ComputerName%.txt

   
    
   

2. Use the Implicit Remoting feature of PowerShell to load the ActiveDirectory module from one of your 2008 R2 servers and use all of its cmdlets locally.
    
   

   $s = New-PSSession -Computer [color="#FF0000"]ServerName[/color] -Credential [color="#FF0000"]Domain\Administrator[/color]
   Invoke-Command -ScriptBlock { Import-Module ActiveDirectory } -session $s
   Import-PSSession -Session $s -Module ActiveDirectory -Prefix Rem -AllowClobber
   
   Get-RemADComputer $env:COMPUTERNAME -Properties Name,MemberOf | Select Name,MemberOf | Export-CSV "$env:USERPROFILE\Desktop\$env:COMPUTERNAME.csv" -NoTypeInformation
   
   Get-PSSession | Remove-PSSession

   
    
   N.B. The groups will all be listed on one line in the CSV file. I haven't figured out how to separate them yet.

Edited February 14, 2012 by Arthur

[CyberNerd]

Two options...

 

Surely this is just an LDAP query! I can think of a few other ways

[Arthur]

Surely this is just an LDAP query! I can think of a few other ways

I probably shouldn't have said two. You're right about there being more ways to do this though.

[FN-GM]

In this deployment i wont have access to DC's so the powershell one is out of the question. I will give MemberOf.exe a go.

 

Thanks