Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using the AD MMC snapin, I show that a particular user is a member of a set of groups, but when I use the net user and net groups utilities, the group membership is different, and more importantly, contradictory.

We're trying to track down a problem that seems to be related to a user not being in the right groups, but the MMC tools says she's in the group and net user and net group say she's not. What's going on, and how do we proceed?

share|improve this question
Are you connecting to the same domain controller that you're running the net commands against? Do you have delayed (or messed up) replication? – Shane Madden Nov 18 '11 at 20:36
One of our domain admins thought to remove her from the group and add her back again and that seems to have worked (still testing it out). – Ben Collins Nov 18 '11 at 20:42
@ShaneMadden I don't know. How would I find out? – Ben Collins Nov 18 '11 at 20:43

Have you checked that on multiple domain controllers? Are you seeing any other inconsistencies with groups on other users? If AD is inconsistent, you've got real issues.

Also, have you tried pulling her out of the groups in question, then forcing NTDS replication between the DCs (from Active Directory Sites & Services), then adding her back to the groups, then forcing replication again?

If you force replication, do you see any errors in the Event Logs?

share|improve this answer

What kind of group is the problem with? Global, Domain Local, Universal? NET is a very old legacy command and won't work for non Global groups. Try using the newer DSQUERY tools if the problem is one of the new group types.
dsquery user -samid THEUSER| dsget user -memberof -expand | dsget group -samid | sort

share|improve this answer
Thanks for the tip, although I don't have access to any of the domain controllers (which is presumably where I'd find that utility). – Ben Collins Nov 19 '11 at 0:02
RSAT or Adminpack have the dsquery, dsmod, dsget tools – Craig620 Nov 19 '11 at 15:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.