P^i

VBScript: How Can I Count the Number of Users in a Group?

Here’s the script:

 

Set objGroup = GetObject("LDAP://CN=Finance Employees,OU=Finance,DC=fabrikam,DC=com")

i = 0

Set objDictionary = CreateObject("Scripting.Dictionary")

For Each strUser in objGroup.Member
    i = i + 1

    Set objMember = GetObject("LDAP://" & strUser)
    strType = objMember.Class

    If Not objDictionary.Exists(strType) Then
        objDictionary.Add strType, "1"
    Else
        objDictionary.Item(strType) = objDictionary.Item(strType) + 1
    End If
Next

Wscript.Echo "Total members in the group: " & i
Wscript.Echo

For Each objType in objDictionary
    Wscript.Echo objType & ": " & objDictionary.Item(objType)
Next

 

Two things we should note before we go much further. First, the only way to determine the number of members in a group is to go ahead and count those members; ADSI doesn’t have a Count property that can instantly return the number of items in a collection for us. (Or at least it doesn’t have a Count property that actually works.)

 

Second, we could have written a simpler version of this script, one that looks like this:

 

Set objGroup = GetObject("LDAP://CN=Finance Employees,OU=Finance,DC=fabrikam,DC=com")

i = 0

For Each strUser in objGroup.Member
    i = i + 1
Next

Wscript.Echo "Total members in the group: " & i
Wscript.Echo

 

The preceding script does, indeed, echo back the number of members in a group. So why didn’t we just give you that script and call it good? we decided to go the extra step and echo back not only the number of members in a group, but also a tally of the type of group member, like so:

 

Total members in the group: 840

group: 5
contact: 595
user: 240


As for the original script (the fancy one), that one kicks off by connecting to the group in question, in this case a group named Finance Employees, housed in the Finance OU of fabrikam.com:

 

Set objGroup = GetObject("LDAP://CN=Finance Employees,OU=Finance,DC=fabrikam,DC=com")

 

After we make a connection to the group account in Active Directory, we set the value of a counter variable named i to 1; we’ll use this variable to tally the number of members in the group. From there we then create an instance of the Scripting.Dictionary object, the object we’ll use to keep track of the different member types (like user, contact, and group):

 

Set objDictionary = CreateObject("Scripting.Dictionary")

 

That brings us to this line of code:

 

For Each strUser in objGroup.Member

 

As it turns out, Active Directory groups all have a multi-valued property named Member; this property contains a collection of all the members of that group. In order to get at the group membership all we have to do is set up a For Each loop to loop through all the values stored in the Member property.

 

Which, coincidentally enough, is exactly what we did in our script.

 

Inside the loop the first thing we do is increment the value of our counter variable. Each time we go through the loop we increment the value of i. Why? Well, suppose we have 37 members in the group. In that case, we’re going to run through the loop 37 times; when we exit the loop, i will be equal to 37. Which, now that we think about it, means that i will thus be able to tell us how many members are in the group.


As you may or may not know, individual group members are listed in the Member attribute by distinguished name (e.g., CN= Ken Myer, OU=Finance, dc=fabrikam, dc=com). Is that useful? You bet it is; that means we can bind to the individual member account using the following line of code:

 

Set objMember = GetObject("LDAP://" & strUser)

 

Why do we even want to bind to the individual member account? Well, in addition to keeping a simple tally of the number of members in the group, we want to determine the member type; the only way to do that is to bind to the account and retrieve the value of the Class property. That’s what we do here:

 

strType = objMember.Class

 

At this point we know that the group member is a user (or a contact or a group or whatever). But now what? Well, as we noted, we’re going to use our Dictionary object to keep a running tally of member types. With that in mind, our next step is to check and see whether this particular member type is already in the Dictionary:

 

If Not objDictionary.Exists(strType) Then

 

Suppose the preceding line of code comes back True; that means the member type is not in the Dictionary. (Notice the If Not syntax.) In that case, we use the following line of code to add the type to the Dictionary and set the value of the new item to 1:

 

objDictionary.Add strType, "1"
 

But what if the member type can be found in the Dictionary? That’s fine; if the member type already exists in the Dictionary then we simply use this line of code to increment the item value by 1:

 

objDictionary.Item(strType) = objDictionary.Item(strType) + 1

 

And then we loop around and repeat the process for the next member in the group.

 

After we’ve looped through the entire group membership we echo back the total number of members in the group (represented by our counter variable i), followed by a blank line:

 

Wscript.Echo "Total members in the group: " & i
Wscript.Echo

 

And then we set up a For Each loop to loop through all the items in the Dictionary, echoing back the member type and the item value:

 

For Each objType in objDictionary
    Wscript.Echo objType & ": " & objDictionary.Item(objType)
Next

 

And that, as you might expect, is that.

 

Oh, one more thing: if you’d like to count the number of members in a local group, use this script instead:

 

strComputer = "atl-fs-01"

i = 0

Set objGroup = GetObject("WinNT://" & strComputer & "/Administrators")

For Each strMember in objGroup.Members
    i = i + 1
Next

Wscript.Echo "Total members in the group: " & i

Basics of VBScript can be found here

VBScript How Can I Count the Number of Users in a Group , vbscript active directory groups ,