JSI Tip 7698. Who has domain administration privileges in my domain?

Using the Active Directory command-line tools, in a Windows 2000 domain, or Windows Server 2003 domain, I have scripted WhoDomainAdmin.bat to determine which user accounts have domain administration privileges in my domain.

The syntax for using WhoDomainAdmin.bat is:

\[call\] WhoDomainAdmin SamId | *

where Samid is a user name, like Jerold, that you wish to check, or an asterisk (*) is used to display all users who have the privilege.

The output is displayed on the CMD console, but you can pipe it to a file using the following syntax:

WhoDomainAdmin *>FileName

You can use the output in subsequent commands, as in:

for /f "Tokens=*" %%i in ('WhoDomainAdmin *') do SomeCommand %%i

WhoDomainAdmin.bat contains:

@echo off
if \{%1\}==\{\} @echo Syntax \[call\] WhoDomainAdmin SamId ^| *&exit /b 1
setlocal
set user=%1
set query=dsquery * domainroot -filter "(&(objectCategory=Person)(objectClass=User)(sAMAccountName=%user%))" -attr distinguishedName adminCount -limit 0
for /f "Tokens=*" %%u in ('%query%') do set line=%%u&call :parse
endlocal
exit /b 0
:parse
if /i "%line:~0,17%" NEQ "distinguishedName" goto detail
set /a pos=17
:loop
set /a pos=%pos% + 1
call set work=%%line:~%pos%^,11%%
if /i "%work%" NEQ " adminCount" goto :loop
set /a pos=%pos% + 1
set /a len=%pos% - 2
goto :EOF
:detail
call set am=%%line:~%pos%%%
if "%am:~0,1%" NEQ "1" goto :EOF
call set dn="%%line:~0,%len%%%"
set dn=%dn:   =%
set dn=%dn:  =%
set dn=%dn: "="%
@echo %dn%