VBScript to list the Active Directory security groups a user belongs to

This is a little script that queries the Active Directory domain and returns the AD security group memberships that the given user belong to by querying the MemberOf  property of the user.

Note:

• The computer that the script is run on has to be joined to a domain, as it is querying the root DSE.

'Response.Write GetADGroups("tallitguy")    'ASP
MsgBox GetADGroups("tallitguy")             'VBScript

Function GetADGroups (ADUserName)
    
    Const ADS_SCOPE_SUBTREE = 2
    
    Dim objRootDSE, strDNSDomain, strTarget
    Dim objConnection, objCmd, objRecordSet
    Dim tmp, Ctr, i, Grp, strList
    
    ' Connect to the LDAP server's root object
    Set objRootDSE = GetObject("LDAP://RootDSE")
    strDNSDomain = objRootDSE.Get("defaultNamingContext")
    strTarget = "LDAP://" & strDNSDomain

    ' Connect to AD Provider
    Set objConnection = CreateObject("ADODB.Connection")
    objConnection.Provider = "ADsDSOObject"
    ' Domain account credentials with read access to LDAP:
    objConnection.Properties("User ID") = "domain\username" 
    objConnection.Properties("Password") = "password" 
    ' Connect to AD
    objConnection.Open "Active Directory Provider"

    Set objCmd =   CreateObject("ADODB.Command")
    Set objCmd.ActiveConnection = objConnection 

    ' Query to get groups a user is a Member Of:
    objCmd.CommandText = "SELECT memberof " & _
                        " FROM '" & strTarget & "' " & _
                        " WHERE objectCategory = 'user' " & _
                        " and name='" & ADUserName & "' "
    ' Set up the command object before running it
    objCmd.Properties("Page Size") = 100
    objCmd.Properties("Timeout") = 30
    objCmd.Properties("Searchscope") = ADS_SCOPE_SUBTREE
    objCmd.Properties("Cache Results") = False
    
    ' Execute query
    Set objRecordSet = objCmd.Execute

    ' Initialize counter & return value
    Ctr = 0
    strList = ""
    
    ' Iterate through the query results    
    Do Until objRecordSet.EOF
        For i = 0 to objRecordSet.Fields.Count -1
            For each Grp in objRecordSet.Fields("memberof").value
                Ctr = Ctr + 1
                tmp = Replace(Split(Grp, ",")(0), "CN=", "") 
                
                strList = strList & tmp & "; " & vbcrlf
                
            Next
        Next
        objRecordSet.MoveNext
    Loop
    
    GetADGroups = strList
    End Function

VBScript to authenticate against Active Directory

Came across this function somewhere online a long time ago to validate provided user credentials against Active Directory in VBScript (mainly if you had to update a "Classic" ASP 3.0 application to use AD authentication vs some other non-IIS integrated method - like querying a database). More recently I noticed that this was hard to find thanks to the age of ASP, so here it is for posterity.

Thanks to whomever wrote it all those years ago!

Here it is, basically the function takes a username & password as parameters, and in the example has the domain hard-coded in the domainName variable, though you can easily change it to pass that as a parameter as well. It then uses ADO to connect to the Active Directory domain using the provided credentials to try to execute a simple query. If it succeeds, then the credentials are good. If it errors out, then the username/password combination is bad.

Note: I've only used this approach on computers that are joined to the AD domain in question.

Function validateUser(username, password)
    Dim adConn, adCom, adRS
    Dim domainName

    On Error Resume Next
  
    domainName = "mydomain.com"
    err.clear

    Set adConn = Server.CreateObject("ADODB.Connection")

    adConn.provider ="ADsDSOObject"
    adConn.properties("user id") = username
    adConn.properties("password") = password
    adConn.Properties("Encrypt Password") = true
    adConn.Open "DS Query"

    Set adCom = CreateObject("ADODB.Command")
    Set adCom.ActiveConnection = adConn

    adCom.CommandText = _
          "select cn from 'LDAP://" & domainName & "' WHERE objectCategory='user'"
    Set adRS = adCom.Execute

    If err.Number = 0 Then
        validateUser = True
    Else
        validateuser = False
    End If

    adRS.close
    adConn.close

    Set adRS=nothing
    Set adCom=nothing
    Set adConn=nothing

End Function

In use:

<%
Dim bLoggedIn, usr, pwd

bLoggedIn = False

usr = Trim(Request("user"))  'validate your input IRL (In Real Life)!
pwd = Trim(Request("pwd"))

If usr<>"" and pwd<>"" Then
    bLoggedIn = validateUser (usr, pwd)
End If
%>

<html>
<body>

<% If bLoggedIn = False Then %>
    <form method=post>
    <p>Username: <input type="text" name="user" value="" /><br/>
       Password: <input type="password" name="pwd" value="" /><br/>
       <input type="submit" value="Login" /></p>
    </form>
<% Else %>
    <h2>Logged in!</h2>
<% End If %>

</body>
</html>