I'm running into a problem with a script I am trying to create. Some quick
background-
We have a limited number of MOSS enterprise CALs, we are running a mixed
farm environment, so some web aps are running standard MOSS 2007 and some
are running enterprise MOSS.

Due to the number of users on our network (18k+) I cannot do the standard
method of ensuring CAL compliance, ie create an AD security group of all
users without an assigned enterprise CAL and deny them access to the web ap.
So to ensure we stay in compliance I'm working on a script that will
compare the members of an AD group that has all the Enterprise CAL users to
all the people with access to the Enterprise sites.

It would seem that stsadm -o enumusers would do the trick, but it doesn't.
When I run this on the site I get back a single AD group and two user IDs.
I added a user id that is not in the group and it did *not *appear when I
re-ran the command. Also I tried putting Authenticated Users into one of
the sharepoint groups and it does not appear when I run the stsadm command.

Is there a reliable way of getting the IDs of all users in a site
collection?