Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a command line way to list all the users in a particular Active Directory group?

I can see who is in the group by going to Manage Computer --> Local User / Groups --> Groups and double clicking the group.

I just need a command line way to retrieve the data, so I can do some other automated tasks.

share|improve this question

8 Answers 8

up vote 22 down vote accepted

try

dsget group "CN=GroupName,DC=domain,DC=name,DC=com" -members
share|improve this answer
    
You probably need to do a little more in order to resolve members and duplicate members in nested groups. –  duffbeer703 Aug 9 '09 at 20:49
    
dsget group "CN=GroupName,DC=domain,DC=name,DC=com" -members -expand gets you the members in the nested groups, though it may not help with duplicates, and it gives you the full AD query string for the member, not just their CN. –  jonnybot Jul 1 at 19:08
    
Command not found on Win7 SP1. I'm guessing you need RSAT installed? –  Iszi Nov 12 at 19:54

Here's a version of the ds command I found more typically useful, especially if you have a complex OU structure and don't necessarily know the full distinguished name of the group.

dsquery group -samid "Group_SAM_Account_Name" | dsget group -members -expand

or if you know the CN of the group, usually the same as the SAM ID, quoted in case there are spaces in the name:

dsquery group -name "Group Account Name" | dsget group -members -expand

As stated in the comments, by default the ds* commands (dsquery, dsget, dsadd, dsrm) are only available on a Domain Controller. However, you can install the Admin Tools pack from the Support Tools on the Windows Server installation media or download it from the Microsoft Download site.

You can also perform these queries using PowerShell. PowerShell is already available as an installable feature for Server 2008, 2008 R2, and Windows 7, but you'll need to download the WinRM Framework to install it on XP or Vista.

To get access to any AD-specific cmdlets in PowerShell you will ALSO need to perform at least one of the following installs:

share|improve this answer
    
I use the first query all the time –  Jim B Aug 3 '09 at 20:29
    
Be aware that you have to run this command on the domain controler. –  skolima Mar 24 '11 at 11:49
8  
You DO NOT have to run this command on a Domain Controller. However, you DO need to have installed the Admin Support Pack .msi which is included in the Support Tools on the Windows 2003 Server CDROM. Or download it from microsoft.com/downloads/en/… –  Ryan Fisher Mar 24 '11 at 15:50

Using PowerShell and Quest Software's Free ActiveRoles Management Shell for Active Directory, you can use:

(Get-QADGroup "GroupName").Members

http://www.quest.com/powershell/activeroles-server.aspx

share|improve this answer
    
Also: Get-QADGroupMember 'GroupName' –  Gordon Bell Aug 9 '12 at 15:13

Here's another way from the command prompt, not sure how automatable though since you would have to parse the output:

net group /domain <your_groupname>
share|improve this answer
11  
not sure why this was downvoted... the output might require a little parsing, but it has the advantage of depending only on utilities that are part of the base windows install. –  G-Wiz Jul 14 '11 at 16:07
1  
But is there any way around the truncated group names? –  deed02392 Oct 14 '13 at 11:19

For a PowerShell solution that doesn't require the Quest AD add-in, try the following

Import-Module ActiveDirectory

Get-ADGroupMember "Domain Admins" -recursive | Select-Object name

This will enumerate the nested groups as well. If you don't wish to do so, remove the -recursive switch.

share|improve this answer
3  
You're correct that the ActiveDirectory module doesn't require the Quest ActiveRoles AD snap-in, but it does require that you have the RSAT tools installed and that your AD has at least one DC with either the Active Directory Web Service (for 2008 R2) or the Active Directory Management Gateway Service (for 2003, 2008 DCs) installed. See my answer above for details and links. –  Ryan Fisher Oct 11 '11 at 19:36

The answers here using dsget and dsquery will only work on server versions of Windows as those command's aren't shipped on other versions of Windows (e.g. Windows 7). On machines without those commands you can get the information you want using the AdFind command.

Here's an example query for getting group membership:

AdFind.exe -default -f name="Domain Admins" member -list
share|improve this answer
3  
ADFind.exe is a third party tool you have to install anyway. The ds* commands are installable via the Admin Tools pack. –  Ryan Fisher Oct 11 '11 at 19:37

A very easy way which works on servers and clients:

NET GROUP "YOURGROUPNAME" /DOMAIN | find /I /C "%USERNAME%"

Returns 1 if user is in group YOURGROUPNAME, else will return 0

You can then use the %ERRORLEVEL% value (0 if user in group, 1 if not) like

IF %ERRORLEVEL%==0 NET USE %LOGONSERVER%\YOURGROUPSHARE
share|improve this answer

For display members of the UserGroup1 try:

dsquery group -name UserGroup1 | dsget group -members | dsget user -display
share|improve this answer
1  
Might want to point out what CLI utility you'd use this in. I don't think that's gonna work too well from cmd, for some reason. –  HopelessN00b Oct 10 '12 at 9:01
    
@HopelessN00b: this works in cmd –  Pete Nov 7 '12 at 20:42
    
@Pete Newp! dsget failed:'Target object for this command' is missing. –  HopelessN00b Nov 7 '12 at 20:53
    
@HopelessN00b: I get error if UserGroup1 doesn't exist, try something like "Accounting*" –  Pete Nov 7 '12 at 21:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.