up vote 0 down vote favorite
2
share [g+] share [fb]

I must be doing something silly but I'm damned if I can see what. According my Googling this Powershell script should list the members of the Domain Users group:

$root=([ADSI]"").distinguishedName
$group = [ADSI] ("LDAP://cn=Domain Users,cn=Users," + $root)
Write-Host $group.distinguishedName

Write-Host "Members:"
foreach ($member in $group.member) 
{ 
  $member
}

But when I run it I just get the output:

CN=Domain Users,CN=Users,DC=mydomain,DC=local
Members:

So it's finding the group OK but not listing the members. I've tried this on Server 2003 and Server 2008 and I'm out of ideas for where my obvious mistake is. Please help ...

JR

link|improve this question
100% accept rate
feedback

4 Answers

up vote 3 down vote accepted

I've never done this in PowerShell, but I have seen the same problem in VBScript.

If Domain Users is a user's Primary Group, then that user will not show up as a member. Try changing your Primary Group to something else and then run your script again.

link|improve this answer
Ahh that answers my question above. Good thing to know. – Zypher♦ Jun 30 '09 at 17:40
+1 I just confirmed this is what's happening to my "working" execution of the script in question. All of the users in my results have something other than Domain Users as their primary group. – squillman Jun 30 '09 at 17:46
Glad I could help. It is possible to get the primaryGroupToken for the group and then query AD for a list of users with this token. Unfortunately, I've never done it in PowerShell. – Anthony Lewis Jun 30 '09 at 17:46
Here's a technet article that talks about this. support.microsoft.com/kb/275523 – squillman Jun 30 '09 at 17:48
Well done that man :-) – John Rennie Jul 1 '09 at 5:41
feedback
up vote 0 down vote

Hmm. It's working for me. Are you running this as a script or typing it interactively?

If after hitting enter (or paste) in an interactive session you get a >> prompt, then hit enter again and see if you get your results.

Assuming, of course, that there actually are users in your group ;)

link|improve this answer
Aargh, I just knew someone would say that! I'm putting it in a .ps1 file and running the file. I have tried copying and pasting the code into Powershell, and as you say I get the >> prompt but when I hit enter again there's no output i.e. just the same as running the .ps1 file. What on earth can be making it fail? – John Rennie Jun 30 '09 at 17:02
feedback
up vote 0 down vote

Odd, it seems that the Domain users group does not have the member properties. If i query another group in my domain I get the properties.

I took a peek at the group in ADSI Edit, and the member property is empty.

I would go into ADSI Edit and check the member property of the domain admins group and see if there are any entries there.

As to why they aren't there and how the group is getting it's membership, I'm not quite sure and would be curious to the answer to that myself.

link|improve this answer
feedback
up vote 0 down vote

Is this Powershell 1.0 or 2.0? I'm running it on Powershell 2.0 and I also got blank output. However, after doing a "$group | get-member", I see there is a property called "MemberOf" (nothing listed for just "member").

In this case, if you change the last line to:

foreach ($member in $group.memberOf)
{
    $member
}

After this change, I get what looks like the desired output.

link|improve this answer
That gives you the groups that $group is a member of not the members of the group. – Zypher♦ Jun 30 '09 at 17:31
Ah, true. Doh! Makes sense. I also just realized "member" is a builtin function for parsing a collection. Sorry for the confusion. – wildcard78 Jun 30 '09 at 17:33
Or is .member not a collection thing? I wish I knew Powershell better than I do, but I wonder if there needs to be a cast of some kind or something? – wildcard78 Jun 30 '09 at 17:41
Ok, I tried with a different group in my domain and the above script works. So maybe something's up with your Domain Users group? – wildcard78 Jun 30 '09 at 17:44
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.