The following script will allow you to enumerate a user, computer or group.

Copy the script locally and name it adenumeration.vbs. Then replace the line 10 with your respective domain.

To run simply go to command and type in: cscript.exe adenumeration.vbs "name of user, computer, or group"

Option Explicit Dim oMemberOfList Dim aMemberOfList Dim sMemberOf Dim sDomainDN Dim sArgument Dim sObjectDN ' CONFIGURATION BLOCK sDomainDN = "dc=enter,dc=your,dc=domain,dc=here" If WScript.Arguments.Count <> 1 Then ' Wrong number of arguments passed WScript.Echo "USAGE: cscript //nologo <name of script> [DN | ADSPath | NAME]" WScript.Echo "where the object can be represented by a distinguished name," WScript.Echo "ADSPath, pre-Windows 2000 logon name (user/group) or name (computer)" WScript.Quit(501) ' 501 is an Exit Code that I use indicate a generic error in scripts I write End If ' Get Argument sArgument = WScript.Arguments(0) ' Translate it to DN sObjectDN = ADObject_DN_UCG(sArgument, sDomainDN) If sObjectDN = "" Then WScript.Echo "ERROR--NOT FOUND: " & sArgument WScript.Quit (501) End If ' Create dictionary object to store group names Set oMemberOfList = CreateObject("Scripting.Dictionary") ' Set comparison mode to case insensitive oMemberOfList.CompareMode = vbTextCompare Call ADObject_MemberOf (sObjectDN) aMemberOfList = oMemberOfList.Keys aMemberOfList = Array_Sort(aMemberOfList) WScript.Echo "MEMBERSHIPS" Dim objBuilder, i, cars dim counter For Each sMemberOf In aMemberOfList WScript.Echo sMemberOf Next ' ====================== ' FUNCTIONS FROM LIBRARY ' ====================== Function ADObject_DN_UCG(ByVal sObject, sSearchDN) ' Version 070706 ' Takes any input (name, DN, or ADsPath) of a user, computer, or group, ' and returns the distinguished name of the object ' INPUTS: sObject: name, DN or ADsPath to a user, group, or computer ' sSearchDN: the DN within which to search (often, the DN of the domain, 'e.g. dc=contoso, dc=com) ' RETURNS: ADObject_DN_UCG: distinguished name (cn=...) of the object ' REQUIRES: ADObject_Find_UCG routine Dim sObjectName, oObject, sObjectADsPath, sObjectDN If Len(sObject) = 0 Then sObjectDN = "" ElseIf Len(sObject) < 3 Then ' can't be a DN or an ADsPath - must be a name sObjectADsPath = ADObject_Find_UCG(sObject, sSearchDN) If sObjectADsPath <> "" Then sObjectDN = mid(sObjectADsPath,8) ElseIf LCase(Left(sObject,3)) = "cn=" Then ' is a DN - make sure it exists On Error Resume Next Set oObject = GetObject("LDAP://" & sObject) sObjectDN = oObject.distinguishedName If Err.Number <> 0 Then ' Error - couldn't find object sObjectDN = "" Err.Clear End If On Error GoTo 0 ElseIf Len(sObject) < 8 Then ' can't be an ADsPath and isn't a DN, must be a name sObjectADsPath = ADObject_Find_UCG(sObject, sSearchDN) If sObjectADsPath <> "" Then sObjectDN = mid(sObjectADsPath,8) ElseIf Ucase(Left(sObject, 7)) = "LDAP://" Then ' is an ADsPath - make sure it exists ' first, make sure LDAP:// is upper case, to avoid error sObject = "LDAP://" & Mid(sObject, 8) On Error Resume Next Set oObject = GetObject(sObject) sObjectDN = oObject.distinguishedName If Err.Number <> 0 Then ' Error - couldn't find object sObjectDN = "" Err.Clear End If On Error GoTo 0 Else ' must be a name sObjectADsPath = ADObject_Find_UCG(sObject, sSearchDN) If sObjectADsPath <> "" Then sObjectDN = mid(sObjectADsPath,8) End If ADObject_DN_UCG = sObjectDN End Function Function ADObject_Find_UCG(sObjectName, sSearchDN) ' VERSION 070706 ' Returns the full ADsPath (LDAP://...) of a user, computer, or group ' Inputs: ' sObjectName: The unique identifier for the object class. The script supports: ' User: sAMAccountName (pre-Windows 2000 logon name) ' Group: sAMAccountName (pre-Windows 2000 logon name) ' Computer: Name (translated by the script to the computer's sAMAccountName ' by adding a $) ' sSearchDN: the DN within which to search (often, the DN of the domain, e.g. 'dc=contoso, dc=com) Dim oConnection Dim oRecordset Dim sLDAPObjectQuery Dim sLDAPIdentifierQuery Dim sLDAPQuery Dim sProperties Dim oADObject Dim aProperties Dim sProperty Dim sLDAPIdentifier Dim sSearchScope sLDAPIdentifier = "samAccountName" sProperties = "ADsPath" sSearchScope = "subtree" ' Open an ADO connection using null credentials Set oConnection = CreateObject("ADODB.Connection") oConnection.Provider = "ADsDSOObject" 'On Error Resume Next oConnection.Open "", vbNullString, vbNullString If oConnection.State = 0 Then ' 0 = adStateClosed ' Error handling code: can't connect to AD ADObject_Find_UCG = "" Exit Function End If ' Build the LDAP Query sLDAPQuery = "<LDAP://" & sSearchDN & ">;" sLDAPQuery = sLDAPQuery & _ "(|(samAccountName=" & sObjectName & ")" & _ "(samAccountName=" & sObjectName & "$));" & _ sProperties & ";" & sSearchScope ' Retrieve the result set, close the connection, and check to make ' sure we received at least one result Set oRecordset = oConnection.Execute (sLDAPQuery) If oRecordset.EOF and oRecordset.BOF Then ' Error handling code: no object found ADObject_Find_UCG = "" Exit Function End If ADObject_Find_UCG = oRecordset.Fields("ADsPath") oRecordset.Close oConnection.Close End Function Sub ADObject_MemberOf(ByVal sObjectDN) ' Version 070701 ' Enumerates the group memberships of a user or computer ' INPUTS: sObjectDN: the DN of the user or computer ' RETURNS: oMemberOfList sorted with each group ' to which the user or computer belongs. ' REQUIRES: ADObject_MemberOf_Enum function ' Array_Sort function ' oMemberOf List with global scope ' e.g. ' Set oMemberOfList = CreateObject("Scripting.Dictionary") ' oMemberOfList.CompareMode = vbTextCompare ' Case INsensitive Dim oObject Dim iPrimaryGroup Dim sPrimaryGroup Dim aMemberOf On Error Resume Next Set oObject = GetObject("LDAP://" & sObjectDN) If Err.Number<>0 Or oObject Is Nothing Then Err.Clear Exit Sub End If On Error GoTo 0 If oObject.Class = "computer" Or oObject.Class = "user" Then iPrimaryGroup = oObject.PrimaryGroupID sPrimaryGroup = "" Select Case iPrimaryGroup Case 513 sPrimaryGroup = "Domain Users" Case 514 sPrimaryGroup = "Domain Guests" Case 515 sPrimaryGroup = "Domain Computers" Case 516 sPrimaryGroup = "Domain Controllers" End Select If sPrimaryGroup > "" Then Call ADObject_MemberOf_Enum(sPrimaryGroup) oMemberOfList.Add sPrimaryGroup, True End If End If On Error Resume Next aMemberOf = oObject.GetEx("memberOf") If Err.Number <> 0 Then ' Assume error is because memberOf has no distinguished names Err.Clear On Error GoTo 0 Exit Sub Else On Error GoTo 0 Call ADObject_MemberOf_Enum(oObject) End If End Sub Sub ADObject_MemberOf_Enum(ByVal oObject) ' Version 070701 ' Enumerates MemberOf property of an object ' INPUTS: oObject: object for which to enumerate MemberOf ' REQUIRES: oMemberOfList dictionary object with global scope ' e.g. ' Set oMemberOfList = CreateObject("Scripting.Dictionary") ' oMemberOfList.CompareMode = vbTextCompare ' Case INsensitive Dim aMemberOf Dim sMemberOf Dim oMemberOf Dim sMemberOfSAM On Error Resume Next aMemberOf = oObject.GetEx("memberOf") If Err.Number <> 0 Then ' Assume error is because memberOf has no distinguished names Err.Clear On Error GoTo 0 Exit Sub Else On Error GoTo 0 For Each sMemberOf In aMemberOf Set oMemberOf = GetObject("LDAP://" & sMemberOf) sMemberOfSAM = oMemberOf.sAMAccountName If (oMemberOfList.Exists(sMemberOfSAM) = False) Then ' We have not seen this group yet ' Add it to the dictionary object oMemberOfList.Add sMemberOfSAM, True ' Enumerate this group's nested memberships Call ADObject_MemberOf_Enum(oMemberOf) End If Next End If End Sub Function Array_Sort(ByVal aArray) ' VERSION 070701 ' Sorts an array, very quickly, using .NET objects ' INPUTS: aArray: an array (incl Dictionary object) requiring sort ' RETURNS: Array_Sort: sorted ' REQUIRES: .NET Framework 2.0 Dim oNAL Dim nIdx Set oNAL = CreateObject("System.Collections.ArrayList") For nIdx = 0 To UBound(aArray) oNAL.Add aArray(nIdx) Next oNAL.Sort For nIdx = 0 To UBound(aArray) aArray(nIdx) = oNAL(nIdx) Next Array_Sort = aArray End Function