List and Retrieve Groups in an OU

Keywords: 	 list retrieve groups OU

Question:

I am upgrading my program to create users etc from Windows NT 4 environment to Windows 2000 (AD). I can create accounts OK but have a few queries I hope you can help me on.

How do I get a list of groups in a certain OU and also all OU's below.
How do I retrieve certain types of group (domain global, domain local and Universal)
Do I need to differentiate between these groups when search & adding)
The number of groups will be in excess of 4000 spread over different OU's.
At present because of number of groups I present the operator with option to extract list of groups. If they say yes, the program extracts list of local & global groups, does a loop to get description and then does a binary replace on html file (for use with HTML extender - to provide drop down list). Is there a better way to do this especially with AD as it takes 15 mins to retrieve 4000 plus groups, then retrieve description for each and write to html file.
Performance:-

When doing a search for users/groups in AD, does the adsi commands search the catalog or work its way down the OU structure looking for a specific user/group affecting performance.

Answer:

Responses embedded in original text.


On 11/26/01 7:49:00 AM, Andyc wrote:
>Hi,
>
>I am upgrading my program to
>create users etc from Windows
>NT 4 environment to Windows
>2000 (AD).
>I can create accounts OK but
>have a few queries I hope you
>can help me on.
>
>1. How do I get a list of
>groups in a certain OU and
>also all OU's below.

You can use the dsFindPath function to this information, as long as you restrict your search to the OU in question and construct the correct filter. For example,

; Get a known OU's display name
sDisplayName = dsGetProperty(sAdsiPath, "ldapDisplayName")

; Query for all OU's below this ou.
sResults = dsFindPath(sAdsiPath, "(objectCategory=%sDisplayName%)")


>2. How do I retrieve certain
>types of group (domain global,
>domain local and Universal)

You can examine the "groupType" property of a group to determine it's type. You can search for groups of a particular type, as well. For example, the search

GLOBAL_GROUP = 2
sResults = dsFindPath(sAdsiPath,
"(&(objectClass=group)(groupType:1.2.840.113556.1.4.804:=%GLOBAL_GROUP%) )")

will find all global groups in the ADSI path. (the groupType:1.2.840.113556.1.4.804: tells dsFindPath to look for groupType fields with the indicated bits set). You can find the constants for group types in the "Constants.wbt" file that ships with the extender.


>3. Do I need to differentiate
>between these groups when
>search & adding)

That depends on the design of your AD directory.


>The number of groups will be
>in excess of 4000 spread over
>different OU's.
>
>4. At present because of
>number of groups I present the
>operator with option to
>extract list of groups. If
>they say yes, the program
>extracts list of local &
>global groups, does a loop to
>get description and then does
>a binary replace on html file
>(for use with HTML extender -
>to provide drop down list).
>Is there a better way to do
>this especially with AD as it
>takes 15 mins to retrieve 4000
>plus groups, then retrieve
>description for each and write
>to html file.

There may be. Retrieving the group descriptions could take a long time depending on how fast your network is. Unfortunately, the ADSI extender does not currently cache requests so each descriptions generates transaction with the server. I know this is not a solution but it may provide an avenue for investigation or redesign.



>Performance:-
>1. When doing a search for
>users/groups in AD, does the
>adsi commands search the
>catalog or work its way down
>the OU structure looking for a
>specific user/group affecting
>performance.

Search performance is controlled to a great extent by the search filter you create and the search's starting position. For Example, using the "objectCategory" property is much faster than "objectClass" and using indexed properties is better than using un-indexed properties. Remember that the extender is limited to 1000 records in result sets. To answer your question, if you wish to search the GC, bind to it directly with the "GC:" moniker.

Article ID:   W15046

File Created: 2002:09:05:13:49:16

Last Updated: 2002:09:05:13:49:16

Database Search

TechHome

List and Retrieve Groups in an OU

Question:

Answer: