Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to retrieve information about members of an active directory group using dsget. The command retrieves some but not all members (53 of 141). The problem group contains a child group. The same command syntax with other groups not having a child group is successful. Docs for dsget make it clear quering sub groups is expected to work.

dsget group "CN=MyGroup,OU=Users and Groups,DC=example,DC=ca" -members -expand -c | dsget user -samid -display

dsget failed:CN=SomeChildGroup,OU=Users and Groups,DC=example,DC=ca:The object class of the target does not match the one specified on the command line.
type dsget /? for help.  samid       display
  dandithe    Danny.Dithers
  adamaca     Adam.Abacus
  sarahso     Sarah.Soother
  colcust     Colin.Custard

This is run on a client workstation (win7) from a user account that does not have any domain admin privileges. Adding or removing the -expand parameter for recursively querying sub-groups seems to have no effect. Neither does -c for continue on error.

Any idea what is wrong and how to work around it? Please keep in mind I have no domain privileges.

share|improve this question
add comment

2 Answers 2

I discovered that I was putting the -c on the wrong side of the pipe. Or perhaps it should be on both sides. In any case adding it to the right works:

set ad_path=CN=MyGroup,OU=Users and Groups,DC=example,DC=ca
dsget group "%ad_path%" -members -expand -c | dsget user -samid -display -c

There is still an error, because the child group isn't a user, but it passes over that and keeps going.

Solution found thanks to Richard Parmiter.

share|improve this answer
    
You may also use dsquery * and an LDAP filter to query a specific object category: dsquery * -filter "(&(objectCategory=person)(memberOf:1.2.840.113556.1.4.1941:=CN=MyGroup,OU=Users and Groups,DC=example,DC=ca)" -limit 0 –  jscott Mar 2 '12 at 20:37
add comment

The problem is that some of the objects coming from the dsget group are, in fact, groups, yet you are passing them all to dsget user.

The simple way to get around this is to send the results of the first command to a file, edit out the group entries and feed the result to the second command.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.