Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I'm trying to get a list of the members of a group in Active Directory. I'm using LDAP queries, but I think that's not relevant. I've found what I believe to be an inconsistency in Active Directory's group membership information:

A security group G has been created with Global scope. Viewing G's properties using the AD Users and Computers MMC Snap-in shows three users, A B C on the Members tab.

However, on viewing the User properties of A B and C, only A and B have G listed on the 'Member Of' tab - G is not present on the 'Member Of' tab of user C.

How can it be that a user is in the Members list of a group, but that group is not in the 'Member Of' list for that user?

(note that the group G is not any user's primary group)

(I originally thought this was an LDAP querying problem, but it isn't: the queries accurately report the information in Active Directory, and it's that that's inconsistent)

share|improve this question
2  
Is it the user's primary group? – Shane Madden Feb 8 '12 at 18:29
Just for grins - which is correct according to the AD toolset? (like ADUC) – uSlackr Feb 8 '12 at 18:45
@uSlackr thanks, that tipped me off that it's actually AD giving me the results I don't understand, rather than LDAP as such. Updated the q. – AakashM Feb 9 '12 at 10:02
@Shane no, it's a freshly created group. I've updated the q to be about AD rather than LDAP, since that seems to be the root of it. – AakashM Feb 9 '12 at 10:05

1 Answer

up vote 2 down vote

There can be an issue getting complete results if you are querying a group that contains entries from mulltiple AD domains (global vs universal groups). There is more on the topic here

(Note: on the linked page, I see wingding fonts in the middle of the post from Che. Here they are converted to a real font:
- At a DC for the domain that contains the user, memberOf for the user is complete with respect to membership for groups in that domain; however, memberOf does not contain the user's membership in domain local and global groups in other domains.
- At a GC server, memberOf for the user is complete with respect to all universal group memberships. )

share|improve this answer
Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying on memberOf - does that seem reasonable? – AakashM Feb 9 '12 at 10:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.