0

I've tried to list all of the members of one of the groups in AD, but nothing is returned, although the command is completed successfully. It neither works with group DN specified, instead of sAMAccountName.

Get-ADGroupMember "sAMAccountName" -Recursive | select name

See output below: enter image description here

The following message appears if one views Members from dsa.msc

---------------------------
Active Directory Domain Services
---------------------------
Some of the object names cannot be shown in their user-friendly form. 
This can happen if the object is from an external domain and 
that domain is not available to translate the object's name.
---------------------------
OK   
---------------------------

Can this be a reason for powershell not returning results? Any thoughts?

UPD: this doesn't seem to be permissions issue, since dsquery does return group members.

5
  • Is the group part of your domain? a different domain? or a different forest? I would suggest to have a look at your Global Catalog server too. Jul 1, 2013 at 9:50
  • Is the group empty? Try running without the "|select name" to see if the powershell notice goes away.
    – uSlackr
    Jul 1, 2013 at 16:14
  • @uSlackr, No, the group is not empty. Still doesn't work even without "|select name". Jul 2, 2013 at 6:22
  • @Noor Yes, group is the part of my domain and it contains some users from other domains. Jul 2, 2013 at 6:23
  • @Volodymyr try to dcdiag the server and post us the results. Jul 2, 2013 at 8:29

3 Answers 3

2

I get the same results on groups if they contain ForeignSecurityPrincipal Objects. As these are displayed as SID's, it looks like a DS query throws that exception which isn't picked up by Get-Adgroupmember cmdlet.

1

Get-ADGroupMember requires an ADGroup object to work with so you need to retrieve the ADGroup and pipe it into the Get-ADGroupMember cmdlet.

Get-ADGroup "GROUP_NAME" | Get-ADGroupMember -Recursive | Select name
5
  • Still same result, command completed successfully, but nothing is returned. Jul 2, 2013 at 6:57
  • I'll throw out an example to make sure we're on same page. Say you have a group called VPN. dsquery group -name "VPN" And you get "CN=VPN,OU=groups,dc=example,dc=com" Then you would do a Get-ADGroup "VPN" | Get-ADGroupMember -Recursive | Select name You use the part after CN= and before the first comma for the quoted value in Get-ADGroup
    – Pablo
    Jul 2, 2013 at 12:59
  • Yes, that's the way I tried this, but it is still the same result, - nothing is returned, although command completes successfully. I tried to calculate number of the objects in the group with powershell to compare with dsquery output and specified group DN and it worked. The group name itself is correct, don't know why it doesn't work for get-adgroupmember cmd-let. Jul 2, 2013 at 13:58
  • Does 'Get-ADGroup "GROUP_NAME" -properties members' show a list of members?
    – Pablo
    Jul 2, 2013 at 14:24
  • I'm not sure if this was true when posted, but it is not the case now. You can absolutely do Get-AdGroupMember -Identity WhateverMyGroupNameIs. What's unfortunately still true is that if the group in question has Foreign Security Principals (members from other forests) in its membership, the cmdlet will fail and return nothing. Dec 18, 2015 at 21:34
0

Give this a try

Get-ADGroupMember -identity “GROUP NAME” | select name| Export-csv -path C:\test.csv -NoTypeInformation

Regards, UnMelc

1
  • Your answer could be made more helpful by elaborating a bit on the elements of your solution. Aug 20, 2015 at 11:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .