Vista - Group object MEMBERS property confusion

Hello all,

I have a quick little script to simply tell me how many members I have
in all my groups. I am using the "MEMBERS" property. Now everywhere I've
read it says that the property is singular (MEMBER). This has never worked
for me, whereas the plural does work. Can anyone tell me (us?) what the real
story is here?

Set oConnection = CreateObject("ADODB.Connection")
Set oCommand = CreateObject("ADODB.Command")
Set RecordSet = CreateObject("ADODB.RecordSet")

oConnection.Open "Provider=ADsDSOObject"
oCommand.ActiveConnection = oConnection
oCommand.Properties("Page Size") = 1000
oCommand.CommandText = DomainRootADSPath &
";(objectcategory=group);ADsPath;subtree"
Set RecordSet = oCommand.Execute

RecordSet.movefirst
wscript.stdout.writeline "Name,Count,Description"
While not RecordSet.EOF
sADsPath = RecordSet.Fields("ADsPath").Value
Set oGroup = GetObject(sADsPath)
sGroupname = UCase(oGroup.cn)
set colMembers = oGroup.members <====== This must be plural for it
to work, against all documentation I've read.
(even "The scripting guys" say this should be "member" and
not "members")
wscript.stdout.writeline oGroup.cn & "," & colMembers.count & "," &
oGroup.Description
RecordSet.movenext
Wend

Set oGroup = Nothing

Tim Munro wrote:
The "member" attribute of group objects is a multi-valued collection of
direct member DN's. The "Members" method of the group object is a function
that returns a collection of object references, one for each direct member
of the group. In your example you retrieve the AdsPath of each group, then
in the loop you bind to each group object (using the AdsPath) and invoke the
Members method to get an object reference to each member. That works,
although it involves binding to each group and member object, which can be
slow. Alternatively, you could retrieve the member attribute directly and
enumerate the multi-valued collection of DN's. Or, you can determine the
number of direct members. For example:
===========
Set oConnection = CreateObject("ADODB.Connection")
Set oCommand = CreateObject("ADODB.Command")
Set RecordSet = CreateObject("ADODB.RecordSet")

oConnection.Open "Provider=ADsDSOObject"
oCommand.ActiveConnection = oConnection
oCommand.Properties("Page Size") = 100
oCommand.CommandText = DomainRootADSPath _
& ";(objectcategory=group)" _
& ";cn,description,sAMAccountName,member;subtree"
Set RecordSet = oCommand.Execute

Wscript.Echo "Common Name,NetBIOS Name,description,count"
Do Until Recordset.EOF

strName = Recordset.Fields("sAMAccountName").Value

strCN = Recordset.Fields("cn").Value

strDesc = Recordset.Fields("description").Value

arrMembers = Recordset.Fields("member").Value

If IsNull(arrMembers) Then

lngCount = 0

ElseIf (TypeName(arrMembers) = "String") Then

lngCount = 1

Else

lngCount = UBound(arrMembers) + 1

End If

Wscript.Echo strCN & "," & strName & "," & strDesc & "," &
CStr(lngCount)
Recordset.MoveNext
Loop



Recordset.Close

oConnection.Close

===========

Note there is no need to bind to the group objects to retrieve the values of
the cn, sAMAccountName, or description attributes. Just add them to the
comma delimited list of attribute values to retrieve. If you need more
information about the direct members, you may need to bind to those objects.
However, it is easy to display the DN of the members, or in this case, the
number of direct members of each group. The code just must account for the
possibility that the member attribute is empty (in which case ADO retrieves
a Null), has one value (in which case ADO retrieves the value as a String),
or more than one value (in which case ADO retrieves the values as an array).
The advantage here is that no AD objects need to be bound. This will be much
faster if there are many groups and members. Much of the work is done on the
DC in one shot.


--
Richard Mueller
MVP Directory Services
Hilltop Lab - http://www.rlmueller.net
--

"Richard Mueller [MVP]" <rlmueller-nospam@xxxxxx> wrote in
message news:uMT9RJSQJHA.2228@xxxxxx
Oops, I forgot that "description" is also multi-valued, although there is
never more than one value. This should work (in part):
============
Do Until Recordset.EOF
strName = Recordset.Fields("sAMAccountName").Value
strCN = Recordset.Fields("cn").Value
arrDesc = Recordset.Fields("description").Value
If IsNull(arrDesc) Then
strDesc = ""
Else
For Each strItem In arrDesc
strDesc = strItem
Next
End If
arrMembers = Recordset.Fields("member").Value
If IsNull(arrMembers) Then
lngCount = 0
ElseIf (TypeName(arrMembers) = "String") Then
lngCount = 1
Else
lngCount = UBound(arrMembers) + 1
End If
Wscript.Echo strCN & "," & strName & "," & strDesc & "," &
CStr(lngCount)
Recordset.MoveNext
Loop

--
Richard Mueller
MVP Directory Services
Hilltop Lab - http://www.rlmueller.net
--

Thanks very much Richard. I'll play with some code to cement this in head.
--
Tim.

"Richard Mueller [MVP]" <rlmueller-nospam@xxxxxx> wrote in
message news:uMT9RJSQJHA.2228@xxxxxx

In order to retrieve this property I would use the GetEX method?

"Richard Mueller [MVP]" <rlmueller-nospam@xxxxxx> wrote in
message news:uMT9RJSQJHA.2228@xxxxxx

No need to use the GetEx method. The Members method automatically returns an
array of DN's. You can retrieve the member attribute like any other, but it
is multi-valued. You can use the Get method.

--
Richard Mueller
MVP Directory Services
Hilltop Lab - http://www.rlmueller.net
--

"Tim Munro" <Excelsior@xxxxxx> wrote in message
news:OKHkMtCRJHA.2228@xxxxxx

correct.. see here >
http://www.microsoft.com/technet/scr....mspx?mfr=true

object.Get("property") or object.GetEx("property") is different than doing
something like object.Name

Allan



"Tim Munro" <Excelsior@xxxxxx> wrote in message
news:OKHkMtCRJHA.2228@xxxxxx

OK Thanks (gain) Richard. Now to look up the difference between "Get" and
"GetEx". The examples in the ScriptCentre show using GetEx.

(learning is fun (as long as it stays)).


"Richard Mueller [MVP]" <rlmueller-nospam@xxxxxx> wrote in
message news:Orj0QrHRJHA.4524@xxxxxx