Most Efficient Way to Check Membership for ~1000 users on ~1500 AD Groups

[gcue]

hello world!

not looking for a script - just advice on how to approach this task:

1. get the members of an AD group (~1,000 users) - (members always changing)

2. get a list of ad groups (1,500) (list always changing)

3. check if users in #1 are members of each of the ad groups in #2

4. ability to exclude an AD group from item #2

here's what I'm thinking...

store the users of #1 in a separate USERS table

store items for #4 in a separate EXLCUDE_AD_GROUP table

store the members of each group in #2 in sqlite for subsequent user checks? (to speed up repeated checks for 1000 users the same ad group (x1500) )  can sqlite hold several hundred members per record?

appreciate your advice! 

[spudw2k]

Since it seems you are particularly interested in if a user in AD group (from #1) are members of groups (from #2), perhaps you could just get get the memberof for each user, then cross reference with the groups (from #2), instead of enumerating each group to see if users are members.

[gcue]

great idea - that would definitely work much faster

thank you!!!