I'm trying to retrieve information about members of an active directory group using dsget. The command retrieves some but not all members (53 of 141). The problem group contains a child group. The same command syntax with other groups not having a child group is successful. Docs for dsget make it clear quering sub groups is expected to work.

dsget group "CN=MyGroup,OU=Users and Groups,DC=example,DC=ca" -members -expand -c | dsget user -samid -display

dsget failed:CN=SomeChildGroup,OU=Users and Groups,DC=example,DC=ca:The object class of the target does not match the one specified on the command line.
type dsget /? for help.  samid       display
  dandithe    Danny.Dithers
  adamaca     Adam.Abacus
  sarahso     Sarah.Soother
  colcust     Colin.Custard

This is run on a client workstation (win7) from a user account that does not have any domain admin privileges. Adding or removing the -expand parameter for recursively querying sub-groups seems to have no effect. Neither does -c for continue on error.

Any idea what is wrong and how to work around it? Please keep in mind I have no domain privileges.


I discovered that I was putting the -c on the wrong side of the pipe. Or perhaps it should be on both sides. In any case adding it to the right works:

set ad_path=CN=MyGroup,OU=Users and Groups,DC=example,DC=ca
dsget group "%ad_path%" -members -expand -c | dsget user -samid -display -c

There is still an error, because the child group isn't a user, but it passes over that and keeps going.

Solution found thanks to Richard Parmiter.

  • You may also use dsquery * and an LDAP filter to query a specific object category: dsquery * -filter "(&(objectCategory=person)(memberOf:1.2.840.113556.1.4.1941:=CN=MyGroup,OU=Users and Groups,DC=example,DC=ca)" -limit 0 – jscott Mar 2 '12 at 20:37
  • @DavidMakogon What exactly was the reason for rolling back that edit? Seriously... o_O – Tomalak May 12 '16 at 22:42
  • Because the change you made materially modified the answer (one with several upvotes). Post your own answer or post a reply in a comment. – David Makogon May 12 '16 at 22:48

The problem is that some of the objects coming from the dsget group are, in fact, groups, yet you are passing them all to dsget user.

The simple way to get around this is to send the results of the first command to a file, edit out the group entries and feed the result to the second command.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.