Asp Forum - Retrieving Groups from a DSQUERY

anon1m0us

4/24/2007 1:29:00 PM

I need a list of all the groups a user is part of. When I do the
DSQuery in returns a bunch of groups. I need to capture the group
names.
All groups start with CN=group name and end with a comma.
How to I capture the group name only, which starts after CN= and ends
at the FIRST comma??

6 Answers

Clifford Heath

4/24/2007 11:32:00 PM

anon1m0us wrote:
> I need a list of all the groups a user is part of. When I do the
> DSQuery in returns a bunch of groups. I need to capture the group
> names.
> All groups start with CN=group name and end with a comma.
> How to I capture the group name only, which starts after CN= and ends
> at the FIRST comma??

Actually it doesn't end at the first comma - you could have
a backslashed comma inside the group's CN. I recsll doing it
something like this:

group_dn ='CN=Users\, Group,OU=farnarkle'

group_cn = group_dn.sub(/CN=((:?[^\\,]|\\.)*).*/, $1)

puts group_cn

Users\, Group

This matches the name as a sequence of either a single
backslashed character, or a char that's not either
a backslash or a comma. Note that the result is still
LDAP-escaped.

Clifford Heath.

Peña, Botp

4/25/2007 2:13:00 AM

From: anon1m0us [mailto:anon1m0us@yahoo.com] :
# I need a list of all the groups a user is part of. When I do the
# DSQuery in returns a bunch of groups. I need to capture the group
# names.
# All groups start with CN=group name and end with a comma.
# How to I capture the group name only, which starts after CN= and ends
# at the FIRST comma??

small world ;)

look into "dsquery group" and "dsget group <group_name> -members"

C:\family\ruby\win-ds-groups>cat test.rb
#######################
# botp
# updated: 2007 03 21
#######################

# get all internet groups w names like "internet mail or internetusers"
groups=`dsquery group -limit 1000 | egrep -i "internet(users| mail)"`

len = groups.max.length + 20 # not important; just want to get length for
header line separator

# display groups and the count
groups.each_with_index do |g,i|
puts "-"*len
puts "Group #{i+1}: #{g}"
puts "-"*len

# for each group get the members
members = `dsget group #{g} -members`

# for each member display name and the count
members.each_with_index do |m,i|
name = m.sub ",CN=Users,DC=delmonte-phil,DC=com\"", ""
name = name.sub "\"CN=", ""
name = name.sub "\\", ""
puts "#{i+1}: #{name}"
end
end
#------------------

hth.
kind regards -botp

Clifford Heath

4/25/2007 3:42:00 AM

Peña wrote:
> look into "dsquery group" and "dsget group <group_name> -members"

It sounds like the OP already did that.

> name = m.sub ",CN=Users,DC=delmonte-phil,DC=com\"", ""
> name = name.sub "\"CN=", ""
> name = name.sub "\\", ""

This only works for users in CN=Users, even assuming that
you adjust the domain name as appropriate. My solution
gets the CN from any user, whether in CN=Users or not,
without knowing the domain name.

Hint: many organizations put their users in OU's... The
CN=Users container is really only there for migration
from NT4, so the domain root isn't filled up with users
and computers from the migration.

It's even legal to put users in a container (CN=) under
an OU, though it's not advised (it's allowed because
that's what CN=Users is). The only correct solution is
to match the RDN component after the user's CN=, up to
the start of the next RDN part, as I showed.

Clifford Heath.

Peña, Botp

4/25/2007 5:59:00 AM

From: Clifford Heath [mailto:no.spam@please.net]
# You need to enumerate the Access Control Entries for
# the mailbox (and potentially the mbox's ancestors)
# and for each relevant ACE that pertains to a group,
# establish the transitive closure of the group's
# membership. Do this separately across all ACEs for
# both the allowed members and the denied members, then
# subtract the denied set from the allowed set. Either
# set may be a wild-card (like World, or Authenticated
# Users), so you must handle that.
# This is thousands of lines of code, and cannot be done
# efficiently using ADSI (or ADO/ADSI) because the ADSI
# ACE's hide the SID, exposing only the SAM name of the
# ACE, which is obtained by a remote directory lookup.
# LDAP is the way to go. Even that's not easy, since you
# can't get the ACL via LDAP unless you send a special
# custom LDAP control with the query, saying you don't
# want the sACL when you fetch the ntSecurityDescriptor.

Clifford, this great info.
Many thanks again,
-botp

last_permutation

6/14/2009 3:01:00 AM

On Jun 13, 10:36 pm, Enkidu <enk...@nogodhere.net> wrote:
> On Sat, 13 Jun 2009 18:48:46 -0700, last_permutation wrote:
> > On Jun 13, 8:22 pm, Enkidu <enk...@nogodhere.net> wrote:
> >> On Sat, 13 Jun 2009 18:28:16 -0400, J wrote:
>
> >> > 7.. Jews gain power by first pleading for "tolerance and
> >> > brotherhood."
> >> > They coddle political leaders of a nation by making themselves useful
> >> > - ingratiating themselves until they become the power behind the
> >> > throne.
>
> >> So being useful and exercising political rights of citizenship is bad?
>
> > This one is my fav, atheist retard and defender of all things "God's
> > Chosen."
>
> Being an atheist, I'm not really into defending any particular religion.
> But as a decent human, I don't want to see any particular group blamed
> for all the evils in the world,

No, you're just interested in defending ZioNazi turds, turd.

>and I am repulsed be mobs of ignorant savages.

Huh? Grab this one out the air? Stop making stuff up.

> > Weaseling into power and influence with money and relentless efforts to
> > control & subvert Congress and the President (always with help from
> > fellow ZioNazis in media) in order ensure continued unlimited support
> > for a foreign (and malevolent) Jewish state (Israel) all the while
> > eroding
> > the very principles of the Republic through subterfuge is hardly "being
> > useful...."etc, rest of ZioNazi bullshit.
>
> Everybody with money weasels their way into power and subverts democracy.
> Ever hear of the tobacco lobby?

Good boy. That is from page 1 of the ZioNazi Stock Answer Handbook.
Ever had an original thought in your life?

> > Ever hear of AIPAC dimwit? Don't bother with your ZioTurd response that
> > it's that friendly little lobby that has no more power than the
> > anti-tariff lobby.
>
> Hell, if I were in charge, there would be no lobbying, only registered
> voters could contribute to political campaigns, and only if they were
> registered to vote in the particular election they were donating funds to
> influence.

Maybe the only good idea you've ever had.

> Jewish lobbies aren't any more evil than gun lobbies, old
> peoples' lobbies, car manufacturers' lobbies, etc.

Still on page one I see. See above.

> >> Enkidu AA#2165
> >> EAC Chaplain and ordained minister, and first-rate tard ULC, Modesto,
> >> CA
>
> >> "And if there were a God, I think it very unlikely that He would have
> >> such an uneasy vanity as to be offended by those who doubt His
> >> existence."
> >> - Bertrand Russell
>
> > Meaningless prattle that only impresses tards. I've heard more
> > thought-provoking shit from Mr. Rogers.
>
> Yeah, it's tough to intelligently argue against what you are too dull to
> understand. You could have done with more Mr. Rogers and less Brian
> Scates.

Who is Brian Scates?

> --
> Enkidu AA#2165
> EAC Chaplain and ordained minister,
> ULC, Modesto, CA
>
> "Gods are fragile things; they may be killed by a whiff of science or a
> dose of common sense."
> -- Chapman Cohen

Come on pinhead, let's hear one from YOU on the matter of atheist
tardedness.

last_permutation

6/14/2009 2:59:00 PM

On Jun 14, 5:34 am, Sanity's Little Helper <elv...@noshpam.org> wrote:
> It is an ancient <last_permutat...@yahoo.com>, and he posteth:
>
> > Ever had an original thought in your life?
>
> Project much?

:):):) This is too much!

Brilliantly lifted from the ZioNazi Stock Answer Handbook
Page 1, Entry 1A. Could Davey be any dumber..

The irony flies over Davey's head like an f-15 at full throttle.

Davey got a See n Say for his bar mitzvah.

comp.lang.ruby

Retrieving Groups from a DSQUERY

anon1m0us

Clifford Heath

Peña, Botp

Clifford Heath

Peña, Botp

last_permutation

last_permutation

x Login to ForumsZone