Scripts to count and generate statistics about the number of security groups to which an Exchange user belongs

re: Scripts to count and generate statistics about the number of security groups to which an Exchange user belongs

Brian — Wed, 04 Jan 2006 18:30:51 GMT

Ok, appreciate the scripts but I can't seem to get them to run. I am (sadly) not a scripting person so maybe I'm doing something wrong... but I cut and pasted into notepad, saved as vbs, ran the command as documented (starting with cscript...), and on both scripts I receive the error message:

groups.vbs(42, 1) Microsoft VBScript compilation error: Syntax error.

(of course it has the other script name for the other script).

Can anyone point me in the right direction? The only thing I'm not sure of is whether I'm doing the domain naming context correctly, but I think I am. For example, if our domain is tom.dick.harry.com, i'm using dc=tom, dc=dick, dc=harry, dc=com for that. Thanks in advance for any tips!

re: Scripts to count and generate statistics about the number of security groups to which an Exchange user belongs

Al — Wed, 04 Jan 2006 19:07:45 GMT

In Response to Brian. When you copy from the web, it often puts in formatting that you don't see displayed. In your case, I believe if you look, you'll see a bunch of spaces in your notepad version of the script. Take out the spaces and try again. If you still get an error, open notepad, and use CTRL+G to go to the line referenced in the error. If it got line wrapped or a space or other character got entered, it needs to be fixed for formatting. Keep up this cycle and you'll get it working.

Your grasp of domain context (dc=tom,dc=dick,dc=harry,dc=com) is correct.

-ajm

re: Scripts to count and generate statistics about the number of security groups to which an Exchange user belongs

Darren — Wed, 04 Jan 2006 19:13:48 GMT

You need to edit the .vbs files, since every line has a blank space when the files got posted, the continuation vb lines cause problems with multiline variable declaration. You need to remove the blank line in between the declaration.

In groups.vbs, remove blank lines from the following multiline variable values:
- strFilter
- Com.CommandText
- fileStream.WriteLine (near end of while loop/wend)

In groups_statistics.vbs, remove the blank lines from the following multiline variable values:
- strFilter
- Com.CommandText
- Set oDirObject

Once doing this, both mine ran fine.

re: Scripts to count and generate statistics about the number of security groups to which an Exchange user belongs

Teo Heras — Wed, 04 Jan 2006 19:37:52 GMT

Mike,

Thanks for the great article! It's something I've never come across before. Do chached mode clients require more or less paged pool memory from the server than non-chached mode clients?

Teo

re: Scripts to count and generate statistics about the number of security groups to which an Exchange user belongs

Brian — Wed, 04 Jan 2006 20:28:02 GMT

Great, works now! Thanks Al & Darren for the assist!!

re: Scripts to count and generate statistics about the number of security groups to which an Exchange user belongs

Exchange — Wed, 04 Jan 2006 20:38:42 GMT

Thank you Darren for helping on this!!

Apologize for the confusion on this - we do realize there are issues with pasting scripts into the body but that's the only way we can put them up on the blog so they download to RSS readers. When KB article gets published - scripts will be available in the form that does not need tweaking.

re: Scripts to count and generate statistics about the number of security groups to which an Exchange user belongs

joe — Wed, 04 Jan 2006 22:39:21 GMT

I think you will find you can substantially speed up these scripts by dumping the query

strFilter = "(&(mail=*)(objectCategory=person)(objectClass=user)" &_

"(msExchHomeServerName=*" & strArgs(3) & "))" 'Mail users search filter

and instead looking at values of the homeMDBBL attribute on the msExchPrivateMDB objects of the server in question.

The medial portion of the filter above (the msExchHomeServerName=*servername) can be quite slow unless you have enabled medial indexing on that specific attribute. You should seriously notice a difference in the two mechanisms of retrieving the user DNs with mailboxes on that server if you have busy DCs or a large domain.

The query you show would have to look at the very least at every object with a mail address as the mail attribute would most likely have the smallest number of objects of the indexed attributes in the query. Lots of contacts or mail enabled groups would add even more time to the query plus if you have lots of Exchange servers you have to weed out all but the one you are interested in. So you probably end up making AD touch as many objects as have mail addresses, hundreds, thousands, tens or hundreds of thousands, etc.

On the flip side, looking at the homemdbbl values on the private MDB objects shows you exactly who has mailboxes on that server and will only have to touch and return maybe 20 objects.

Another alternative is to create a normal (non-medial) index for msExchHomeServerName and use the full value of the name instead of doing a medial search. That still probably wouldn't be as fast as looking at the private mdb objects but I would have to test it to be sure.

joe

re: Scripts to count and generate statistics about the number of security groups to which an Exchange user belongs

Mike Lee — Wed, 04 Jan 2006 22:40:38 GMT

@Teo Heras

Yes, Exchange cached mode uses more paged pool than online mode. I'm still working on providing more detail and recommendations for a KB article, so take what I say here as preliminary only.

An online user will typically cause 3 or 4 copies of the token to be generated, while a cached mode user requires 6 to 8 copies. This can go up if you have public folder and free/busy access happening on the mailbox server.

Here's a quick and dirty way to estimate how many copies a particular Outlook 2003 user is generating (this will typically estimate a little high):

Ctrl+right click the Outlook 2003 icon in the system tray. This exposes the Connection Status dialog. On that dialog, count the number of connections listed for a particular server.

Now, run netstat -o and count the connections going to the Exchange server.

Add these together and add 2, and that gives you a decent estimate of number of connections.

The logons page in ESM does not give you an accurate count, for this purpose.

re: Scripts to count and generate statistics about the number of security groups to which an Exchange user belongs

Kyryl Perederiy — Thu, 05 Jan 2006 00:23:40 GMT

Joe,

Thanks for the advice. You are right, the performance of the script could be improved in several ways at the cost of flexibility. In large environments you're typicaly will be interested in looking at a bunch of servers (like EXCH-MBX-*). And yes, it will take several seconds or minutes to execute a query but you want to run it only once.

Kyryl

re: Scripts to count and generate statistics about the number of security groups to which an Exchange user belongs

Ed — Thu, 26 Jan 2006 02:13:41 GMT

Do these scripts include the group membership of all DLG's in the Forest, or only the DLG's of the domain in which the script is run against?

re: Scripts to count and generate statistics about the number of security groups to which an Exchange user belongs

Kyryl Perederiy — Fri, 27 Jan 2006 04:38:40 GMT

Ed,

The second is true. These scripts will count only DLG's of the domain in which the script is running.