locked
Active Directory: how to search/query for empty OUs RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote
    I had GreatYami answer my 1st problem with creating a query to find empty groups within AD U&C...

    1.Open The Active Directory.
    2.At your left you have a map named Saved Query's right click it.
    3.Select New > Query, a new screen will appear.
    4.Give your Query a name and click Define Query.
    5.Another screen will appear, Select from the Drop Down list User, Contacts, Groups.
    6.Click the Tab Advanced Then click on Field and select Group > Members.
    7.Beneath the label "Condition" is a dropdown list select from the drop down list Not Present.
    8.Click Add and then click on OK.

    But now how about this:

    For example: I have and OU called "Payroll". Within that OU I have a Security Group called "Payroll". We no longer have any staff in the OU or Group. Your above query can help me find the empty groups, but is there a query that can help me find empty OUs?

    Thanks-

    Wednesday, April 18, 2012 2:27 PM

Answers

  • Question
    Sign in to vote
    0
    Sign in to vote

    There is no query that will retrieve empty OU's. You must query for all OU's, then count the number of child objects. This question must have been asked over a year ago, because I have a VBScript solution, which outputs the distinguished name of all empty OU's in the domain:

    Option Explicit

    Dim adoCommand, adoConnection, strBase, strFilter, strAttributes
    Dim objRootDSE, strDNSDomain, strQuery, adoRecordset, strADsPath
    Dim objOU, lngCount, objChild

    ' Setup ADO objects.
    Set adoCommand = CreateObject("ADODB.Command")
    Set adoConnection = CreateObject("ADODB.Connection")
    adoConnection.Provider = "ADsDSOObject"
    adoConnection.Open "Active Directory Provider"
    Set adoCommand.ActiveConnection = adoConnection

    ' Search entire Active Directory domain.
    Set objRootDSE = GetObject("LDAP://RootDSE")
    strDNSDomain = objRootDSE.Get("defaultNamingContext")
    strBase = "<LDAP://" & strDNSDomain & ">"

    ' Filter on all OU objects.
    strFilter = "(objectCategory=organizationalUnit)"

    ' Comma delimited list of attribute values to retrieve.
    strAttributes = "ADsPath"

    ' Construct the LDAP syntax query.
    strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
    adoCommand.CommandText = strQuery
    adoCommand.Properties("Page Size") = 100
    adoCommand.Properties("Timeout") = 30
    adoCommand.Properties("Cache Results") = False

    ' Run the query.
    Set adoRecordset = adoCommand.Execute

    ' Enumerate the resulting recordset.
    Wscript.Echo "Empty organizational Units:"
    Do Until adoRecordset.EOF
        ' Retrieve values.
        strADsPath = adoRecordset.Fields("ADsPath").Value
        ' Bind to the OU object.
        Set objOU = GetObject(strADsPath)
        ' Check if empty.
        lngCount = 0
        For Each objChild In objOU
            lngCount = lngCount + 1
            Exit For
        Next
        If (lngCount = 0) Then
            Wscript.Echo objOU.distinguishedName
        End If
        ' Move to the next record in the recordset.
        adoRecordset.MoveNext
    Loop

    ' Clean up.
    adoRecordset.Close
    adoConnection.Close

    -----


    Richard Mueller - MVP Directory Services

    Wednesday, April 18, 2012 3:07 PM