JSI Tip 9305. How can I list the members of a domain group, security or distribution, given the group distinguished name?

Using the DSGET Active Directory command-line tool, I have scripted DNGrpmbrs.bat to retrieve the members of a domain group.

The syntax for using DNGrpmbrs.bat is:

\[call\] DNGrpmbrs GroupDN

Where GroupDN is the distinguished name of the group.

To process the output in a script:

for /f "Tokens=1* Delims=;" %%a in ('DNGrpmbrs GroupDN') do (
 set UserDN=%%a
 set UserSAMID=%%b
 ...
 ...
)

NOTE: Imbedded domain groups are recursively expanded to arrive at a complete set of domain members.

NOTE: See How can I list the members of a domain group, security or distribution, given the group sAMAccountName (SAMID)?

DNGrpmbrs.bat contains:

@echo off
if \{%1\}==\{\} @echo Syntax: DNGrpMbrs GroupDN&goto :EOF
setlocal ENABLEDELAYEDEXPANSION
for /f "Tokens=*" %%a in ('dsget group %1 -members -expand') do (
 for /f "Skip=1 Tokens=*" %%u in ('dsget user %%a -samid 2^>nul^|FIND /I /V "dsget succeeded"') do (
  set samid=%%u
  set samid=!samid:  =!
  @echo %%a;"!samid!"
 )
)
endlocal