Download Script: AD-Admin-Audit
Update 2011.06.21: I found a missing line in this script keeping it from running. I fixed that in the code below. I also added a downloadable zip file with the script to help with the formatting issues caused when copying and pasting directly from the site.

Update 2009.04.16: At the request of a commenter, I added a couple lines to the script that will dump the output to a text file in the root of the C: drive. I also corrected a couple errors in the script.

I was tasked to get a dump of all the users in our Schema Admins, Enterprise Admins and Domain Admins for our Forest. I started thinking about it and realized a couple things. Two of the three groups reside at the forest root while the Domain Admins group exists for every domain in the forest. This meant I would need to enumerate every domain and depending on the domain, enumerate either all three groups or just one.

My thinking was overly complex and I realized this halfway through writing a new script. Using the power of LDAP, I can use a logical “or” (|) statement. When run against a domain, it would always return “Domain Admins” since it will always exist in an AD domain. When it is run against the forest root domain, it would also return the “Enterprise Admins” group and “Schema Admins” group. Here is the LDAP query:

(&(objectCategory=group)(|((name=Enterprise Admins*)(name=Domain Admins*)(name=Schema Admins*))))

At this point, all I need to do is this:

  1. Enumerate all domains in the forest
  2. Loop through each domain
  3. Execute LDAP query against each domain
  4. Loop through LDAP query results
  5. Dump membership of each group

The script below does just that. I hope some find it useful. There is no configuration necessary. You should be able to just run it from your environment as no domain references (or really anything) is hard coded. The only thing you may want to add to or remove from is the LDAP filter. Cheers!

'==========================================================================
' VBScript Source File
' NAME   : Active Directory Admin Audit
' AUTHOR : Andrew J Healey
' DATE   : 2009.04.16
' UPDATED: 2011.06.21
' USAGE  : cscript /nologo AD-AdminAudit.vbs
' COMMENT: This script will check all the domains within a forest
'		and report all the members of the following groups: Schema
'		Admins, Enterprise Admins and Domain Admins. See notes to
'		expand on the groups.
'==========================================================================

Option Explicit
 
'Define Constants
Const adUseClient = 3
Const ForWriting = 2
 
'Set the path and filename for the dump of sensitive users
'  Folder must exist!
Dim fileTemp : fileTemp = "C:\AD Admin Audit.txt"
 
' Create tmp file and report file
Dim objFSO, objTempFile
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTempFile = objFSO.OpenTextFile(fileTemp, ForWriting, True)
 
' Query RootDSE and return array with all AD domains in forest
Dim adoCommand, adoConnection, objRootDSE
Set adoCommand = CreateObject("ADODB.Command")
Set adoConnection = CreateObject("ADODB.Connection")
adoConnection.Provider = "ADsDSOObject"
adoConnection.cursorLocation = adUseClient
adoConnection.Open "Active Directory Provider"
adoCommand.ActiveConnection = adoConnection
Set objRootDSE = GetObject("LDAP://RootDSE")
 
' Build the LDAP Query
Dim strBase, strFilter, strAttrs, strScope, strQuery
strBase   =  "<GC://" & objRootDSE.Get("rootDomainNamingContext") & ">;"
strFilter = "(objectcategory=domainDNS);"
strAttrs  = "distinguishedName;"
strScope  = "subtree"
strQuery = strBase & strFilter & strAttrs & strScope
 
' Set Query parameters
adoCommand.CommandText = strQuery
adoCommand.Properties("Page Size") = 50
adoCommand.Properties("Timeout") = 30
adoCommand.Properties("Cache Results") = False
 
' Execute the query
Dim adoRecordSet : Set adoRecordSet = adoCommand.Execute
 
' Start Loop
Do Until adoRecordSet.EOF
	' Parse ad search results to create well formed DNS domain
	Dim strDomain
	strDomain = Replace(adoRecordSet.Fields(0).Value,"DC=","")
	strDomain = Replace(strDomain,",",".")
	Call GrpAll(strDomain)
	adoRecordSet.MoveNext
Loop
adoRecordSet.Close
adoConnection.Close
 
Private Function GrpAll(byVal strDomain)
	' To search for more groups, edit the "strFilter" line. It uses a simple
	'  LDAP or (|) so multiple groups can be added. It uses ADO record sets
	'  to loop so it doesn't have to find all of them, just one. Every domain
	'  will contain at least the Domain Admins group.
	Dim adoComm, adoConn
	Set adoComm = CreateObject("ADODB.Command")
	Set adoConn = CreateObject("ADODB.Connection")
	adoConn.Provider = "ADsDSOObject"
	adoConn.cursorLocation = adUseClient
	adoConn.Open "Active Directory Provider"
	adoComm.ActiveConnection = adoConn
 
	strBase   = "<GC://" & strDomain & ">;"
	strFilter = "(&(objectCategory=group)(|((name=Enterprise Admins*)(name=Domain Admins*)(name=Schema Admins*))));"
	strAttrs  = "name,member;"
	strScope  = "subtree"
 
	strQuery = strBase & strFilter & strAttrs & strScope
	adoComm.CommandText = strQuery
	adoComm.Properties("Page Size") = 5000
	adoComm.Properties("Timeout") = 30
	adoComm.Properties("Cache Results") = False
 
	Dim adoRS : Set adoRS = adoComm.Execute
 
	objTempFile.WriteLine "Group report for domain: " & strDomain
 
	adoRS.MoveFirst
 
	Do Until adoRS.EOF
		Dim strMember
		objTempFile.WriteLine vbTab & adoRS.Fields(0).Value
		For Each strMember in adoRS.Fields(1).Value
			objTempFile.WriteLine vbTab & vbTab & strMember
		Next
		adoRS.MoveNext
	Loop
 
	adoRS.Close
	adoConn.Close
End Function