AutoHotkey Community

FindDistinguishedName(_Item)
{
   ;This finds a full DN name from a short name or a samaccount name.
   MembersOfGroup := Object()
   objRootDSE := ComObjGet("LDAP://rootDSE")
   strDomain := objRootDSE.Get("defaultNamingContext")
   strADPath := "LDAP://" . strDomain
   objDomain := ComObjGet(strADPath)
   objConnection := ComObjCreate("ADODB.Connection")
   objConnection.Open("Provider=ADsDSOObject")
   objCommand := ComObjCreate("ADODB.Command")
   objCommand.ActiveConnection := objConnection

   objCommand.CommandText := "<" . strADPath . ">;(|(name=" . _Item . ")(sAMAccountName=" . _Item . "));distinguishedName;subtree"
   objRecordSet := objCommand.Execute
   objRecordCount := objRecordSet.RecordCount
   objOutputVar :=
   While !objRecordSet.EOF
   {
      _Item := objRecordSet.Fields.Item("distinguishedName").value
      objRecordSet.MoveNext
   }
   objRelease(objRootDSE)
   objRelease(objDomain)
   objRelease(objConnection)
   objRelease(objCommand)
   return _Item
}


GetMembersOfADGroup(_Group, _Type = "both") ; _Type can be user (return only users of the group), group (return only groups in this group) or both.
{
   MembersOfGroup := Object()
   objRootDSE := ComObjGet("LDAP://rootDSE")
   strDomain := objRootDSE.Get("defaultNamingContext")
   strADPath := "LDAP://" . strDomain
   objDomain := ComObjGet(strADPath)
   objConnection := ComObjCreate("ADODB.Connection")
   objConnection.Open("Provider=ADsDSOObject")
   objCommand := ComObjCreate("ADODB.Command")
   objCommand.ActiveConnection := objConnection
   
   StringLeft, GroupNameStart, _Group, 3
   StringUpper, GroupNameStart, GroupNameStart
   If GroupNameStart != "CN=" ; We were given a simple name for the group so we find the distinguished name.
   {
      _Group := FindDistinguishedName(_Group)
   }
   
   LDAPSearchString := "<" . strADPath . ">;"
   
   IfEqual, _Type,user
   {
      LDAPSearchString .= "(&(&(&(memberOf=" . _Group . ")(objectCategory=user)(objectClass=user))))"
   }
   
   IfEqual, _Type,group
   {
      LDAPSearchString .= "(&(objectCategory=group)(memberOf=" . _Group . "))"
   }
   
   IfEqual, _Type,both
   {
      LDAPSearchString .= "(memberOf=" . _Group . ")"
   }
   
   LDAPSearchString .= ";sAMAccountName;subtree"
   objCommand.CommandText := LDAPSearchString
   
   objRecordSet := objCommand.Execute
   objRecordCount := objRecordSet.RecordCount
   objOutputVar :=
   x = 0
   MemberGroups =
   
   While !objRecordSet.EOF
   {
      sAMAccountName := objRecordSet.Fields.Item("sAMAccountName").value
      ;sAMAccountType := objRecordSet.Fields.Item("sAMAccountType").value
      If MemberGroups
      {
         MemberGroups := MemberGroups . "`n"
      }
      MemberGroups := MemberGroups . sAMAccountName      
      objRecordSet.MoveNext
   }

   objRelease(objRootDSE)
   objRelease(objDomain)
   objRelease(objConnection)
   objRelease(objCommand)
   return MemberGroups
}

IsUserOfGroup(_User,_Group, _Recurse=0)
{
   ; First we check the obvious first level of the group.
   Users := GetMembersOfADGroup(_Group, "user")
   StringSplit, Users, Users,`n
   Loop, %Users0%
   {
      If Users%a_index% = %_User%
      {
         return true
      }
   }
   
   If _Recurse
   {
      ; User was not in first level of group and since the recursive flag is set, we have to go deeper.
      ; This is limited to only one recursion for now. It will check all the groups in this group for the user.
      GroupIndex = 0
      
      Groups := GetMembersOfADGroup(_Group, "group")
      StringSplit, GroupsArray, Groups,`n
      If GroupsArray0
      {
         Loop
         {
            GroupIndex++
            If GroupIndex > %GroupsArray0%
            {
               return false
            }
            
            ;Look for the user in the current group in the list.
            CurGroup := GroupsArray%GroupIndex%
            Users := GetMembersOfADGroup(CurGroup, "user")
            StringSplit, Users, Users,`n
            Loop, %Users0%
            {
               If Users%a_index% = %_User%
               {
                  return true
               }
            }
         }
      }
      return false
   }
   ; We couldn't find the user.
   return false
}

UserIsMemberOf(_Username)

;     (.)~(.)   
;    (-------)                                   
;---ooO-----Ooo---------------------------------------------------
;    Hoppfrosch  - AHK 1.1.05.06 Unicode 32bit on Win7 Ultimate
;-----------------------------------------------------------------                       
;    ( )   ( )                           
;    /|\   /|\ 

Option Explicit

Dim objSysInfo, objGroupList, objUser, strDN, MemberOf

Set objSysInfo = CreateObject("ADSystemInfo")
strDN = objSysInfo.UserName

Set objUser = GetObject("LDAP://" & strDN)

' Bind to dictionary object.
Set objGroupList = CreateObject("Scripting.Dictionary")

' Enumerate group memberships.
Call EnumGroups(objUser)
Wscript.Echo MemberOf

' Clean up.
Set objGroupList = Nothing
Set objUser = Nothing

Sub EnumGroups(ByVal objADObject)
    Dim colstrGroups, objGroup, j
    objGroupList.CompareMode = vbTextCompare
    colstrGroups = objADObject.memberOf
    If (IsEmpty(colstrGroups) = True) Then
        Exit Sub
    End If
    If (TypeName(colstrGroups) = "String") Then
        colstrGroups = Replace(colstrGroups, "/", "\/")
        Set objGroup = GetObject("LDAP://" & colstrGroups)
        If (objGroupList.Exists(objGroup.sAMAccountName) = False) Then
            objGroupList.Add objGroup.sAMAccountName, True
          
         MemberOf = MemberOf & objGroup.CN & Chr(13)
         
            Call EnumGroups(objGroup)
        End If
        Set objGroup = Nothing
        Exit Sub
    End If
    For j = 0 To UBound(colstrGroups)
        colstrGroups(j) = Replace(colstrGroups(j), "/", "\/")
        Set objGroup = GetObject("LDAP://" & colstrGroups(j))
        If (objGroupList.Exists(objGroup.sAMAccountName) = False) Then
            objGroupList.Add objGroup.sAMAccountName, True
          
         MemberOf = MemberOf & objGroup.CN & Chr(13)
         
            Call EnumGroups(objGroup)
        End If
    Next
    Set objGroup = Nothing
End Sub

UserIsMemberOf(_User)
{

   StringLeft, UserNameStart, _User, 3
   StringUpper, UserNameStart, UserNameStart
   If UserNameStart != "CN=" ; We were given a simple name for the group so we find the distinguished name.
   {
      UserName := FindDistinguishedName(_User)

   } else {
      UserName := %_User%
   }
   
   objRootDSE := ComObjGet("LDAP://rootDSE")
   strDomain := objRootDSE.Get("defaultNamingContext")
   strADPath := "LDAP://" . strDomain
   objDomain := ComObjGet(strADPath)
   objConnection := ComObjCreate("ADODB.Connection")
   objConnection.Open("Provider=ADsDSOObject")
   objCommand := ComObjCreate("ADODB.Command")
   objCommand.ActiveConnection := objConnection
   objCommand.CommandText := "<" . strADPath . ">" . ";(&(&(&(objectCategory=group)(member=" . UserName . "))));Name;subtree"
   objRecordSet := objCommand.Execute
   objRecordCount := objRecordSet.RecordCount
   objOutputVar :=
   While !objRecordSet.EOF
   {
      strObjectDN := objRecordSet.Fields.Item("Name").value
      a = %a%`n%strObjectDN%
      objRecordSet.MoveNext
   }
   objRelease(objRootDSE)
   objRelease(objDomain)
   objRelease(objConnection)
   objRelease(objCommand)
   return a
}