How Can I Retrieve a List of OUs that have a Specific Word in Their Name?

ScriptingGuy1

Hey, Scripting Guy! We have a number of OUs in our domain that have the word Servers in the OU name. How can I retrieve a list of those OUs?

— AM

Hey, AM. One of the Scripting Guys has a 15-year-old son who, whenever he hears his father tell a story about the good old days, rolls his eyes and says, “You’re just one of those old guys still living in the past.” (Of course, in the same breath this Scripting Son will say, “Remember when I was 10 and hit that home run against the Rockies?” but somehow that’s different.)

We mention this because your question takes us back to the good days, back to the glory years of the Hey, Scripting Guy! column. Back then it seemed like every other question we took had the same answer: you can find what you’re looking for by searching Active Directory. Did we do that because searching Active Directory is an incredibly powerful tool for system administrators, or did we do that because we were lazy and just liked giving the same answer over and over again? Well, we are lazy, but the truth is, ADO searches of Active Directory are enormously useful to system administrators. If you need a list of user accounts or a list of groups or a list of computers or a list of phone numbers or a list of just about anything, there’s a good chance you’ll find that information stored in Active Directory.

So, roll your eyes and sigh if you must, but here’s the answer to your question: you can find what you’re looking for by searching Active Directory. In fact, you can retrieve a list of OUs that have the word “Servers” in their name by using a script similar to this:

Const ADS_SCOPE_SUBTREE = 2

Set objConnection = CreateObject(“ADODB.Connection”)
Set objCommand =   CreateObject(“ADODB.Command”)
objConnection.Provider = “ADsDSOObject”
objConnection.Open “Active Directory Provider”
Set objCommand.ActiveConnection = objConnection
objCommand.Properties(“Page Size”) = 1000
objCommand.Properties(“Searchscope”) = ADS_SCOPE_SUBTREE 
objCommand.CommandText = _
    “SELECT ADsPath FROM ‘LDAP://dc=fabrikam,dc=com’ ” & _
        “WHERE objectCategory=’organizationalUnit’ AND Name = ‘*Servers*'”  
Set objRecordSet = objCommand.Execute
objRecordSet.MoveFirst
Do Until objRecordSet.EOF
    Wscript.Echo objRecordSet.Fields(“ADsPath”).Value
    objRecordSet.MoveNext
Loop

We won’t go over this script in detail today; if you don’t have much experience with searching Active Directory you might take a look at our two-part series Dude, Where’s My Printer?, a series that explains the ADODB.Connection object and the Searchscope and all the other crazy-looking code found in this script. Instead we’ll just focus on the SQL query that actually returns the list of OUs for us:

objCommand.CommandText = _
    “SELECT ADsPath FROM ‘LDAP://dc=fabrikam,dc=com’ ” & _
        “WHERE objectCategory=’organizationalUnit’ AND Name = ‘*Servers*'”

What we’re doing here is searching the fabrikam.com domain and retrieving the ADsPath attribute. (Obviously we could have picked any other attribute, or even multiple attributes. We chose ADsPath because once you know the ADsPath for an object you can easily bind to that object and retrieve values for all its attributes.) That part’s pretty straightforward; what we’re really interested in is the WHERE clause:

WHERE objectCategory=’organizationalUnit’ AND Name = ‘*Servers*’

We use the WHERE clause to specify the criteria for our search, and in this case we’re looking for two things:

After defining the query we call the Execute method; this actually runs the query and returns a recordset containing all the OUs that have the word Servers somewhere in the Name. We then loop through the recordset and echo the ADsPath for each of these OUs. That’s all there is to it.

Incidentally, it’s usually not recommended that you search for text in the middle of a string (*Servers*); that’s because a search like that can be resource-intensive and take awhile for the domain controller to process. We can get away with it here because we’re assuming you don’t have millions of OUs to check; typically domains have far fewer OUs than they do, say, users or groups. Therefore we don’t expect this search to cause any problems.

Does that answer your question? Good. And, although you didn’t ask, we’re sure you’d like to hear about the time we almost-single-handedly beat Hanford High School, at that time undefeated and the number 1 ranked baseball team in the state of – oh, OK. But if the Scripting Son wants to talk about his home run from this season, you better not listen to him, either. (Although that was a nice hit. It reminded Scripting Dad of that one day in Richland when he….)

ScriptingGuy1

Follow