Active Directory: how to search/query for empty OUs RRS feed

  • Question

  • I had GreatYami answer my 1st problem with creating a query to find empty groups within AD U&C...

    1.Open The Active Directory.
    2.At your left you have a map named Saved Query's right click it.
    3.Select New > Query, a new screen will appear.
    4.Give your Query a name and click Define Query.
    5.Another screen will appear, Select from the Drop Down list User, Contacts, Groups.
    6.Click the Tab Advanced Then click on Field and select Group > Members.
    7.Beneath the label "Condition" is a dropdown list select from the drop down list Not Present.
    8.Click Add and then click on OK.

    But now how about this:

    For example: I have and OU called "Payroll". Within that OU I have a Security Group called "Payroll". We no longer have any staff in the OU or Group. Your above query can help me find the empty groups, but is there a query that can help me find empty OUs?


    Wednesday, April 18, 2012 2:27 PM


  • There is no query that will retrieve empty OU's. You must query for all OU's, then count the number of child objects. This question must have been asked over a year ago, because I have a VBScript solution, which outputs the distinguished name of all empty OU's in the domain:

    Option Explicit

    Dim adoCommand, adoConnection, strBase, strFilter, strAttributes
    Dim objRootDSE, strDNSDomain, strQuery, adoRecordset, strADsPath
    Dim objOU, lngCount, objChild

    ' Setup ADO objects.
    Set adoCommand = CreateObject("ADODB.Command")
    Set adoConnection = CreateObject("ADODB.Connection")
    adoConnection.Provider = "ADsDSOObject"
    adoConnection.Open "Active Directory Provider"
    Set adoCommand.ActiveConnection = adoConnection

    ' Search entire Active Directory domain.
    Set objRootDSE = GetObject("LDAP://RootDSE")
    strDNSDomain = objRootDSE.Get("defaultNamingContext")
    strBase = "<LDAP://" & strDNSDomain & ">"

    ' Filter on all OU objects.
    strFilter = "(objectCategory=organizationalUnit)"

    ' Comma delimited list of attribute values to retrieve.
    strAttributes = "ADsPath"

    ' Construct the LDAP syntax query.
    strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
    adoCommand.CommandText = strQuery
    adoCommand.Properties("Page Size") = 100
    adoCommand.Properties("Timeout") = 30
    adoCommand.Properties("Cache Results") = False

    ' Run the query.
    Set adoRecordset = adoCommand.Execute

    ' Enumerate the resulting recordset.
    Wscript.Echo "Empty organizational Units:"
    Do Until adoRecordset.EOF
        ' Retrieve values.
        strADsPath = adoRecordset.Fields("ADsPath").Value
        ' Bind to the OU object.
        Set objOU = GetObject(strADsPath)
        ' Check if empty.
        lngCount = 0
        For Each objChild In objOU
            lngCount = lngCount + 1
            Exit For
        If (lngCount = 0) Then
            Wscript.Echo objOU.distinguishedName
        End If
        ' Move to the next record in the recordset.

    ' Clean up.


    Richard Mueller - MVP Directory Services

    Wednesday, April 18, 2012 3:07 PM