0

I've tried to list all of the members of one of the groups in AD, but nothing is returned, although the command is completed successfully. It neither works with group DN specified, instead of sAMAccountName.

Get-ADGroupMember "sAMAccountName" -Recursive | select name

See output below: enter image description here

The following message appears if one views Members from dsa.msc

---------------------------
Active Directory Domain Services
---------------------------
Some of the object names cannot be shown in their user-friendly form. 
This can happen if the object is from an external domain and 
that domain is not available to translate the object's name.
---------------------------
OK   
---------------------------

Can this be a reason for powershell not returning results? Any thoughts?

UPD: this doesn't seem to be permissions issue, since dsquery does return group members.

  • Is the group part of your domain? a different domain? or a different forest? I would suggest to have a look at your Global Catalog server too. – Noor Khaldi Jul 1 '13 at 9:50
  • Is the group empty? Try running without the "|select name" to see if the powershell notice goes away. – uSlackr Jul 1 '13 at 16:14
  • @uSlackr, No, the group is not empty. Still doesn't work even without "|select name". – Volodymyr M. Jul 2 '13 at 6:22
  • @Noor Yes, group is the part of my domain and it contains some users from other domains. – Volodymyr M. Jul 2 '13 at 6:23
  • @Volodymyr try to dcdiag the server and post us the results. – Noor Khaldi Jul 2 '13 at 8:29
2

I get the same results on groups if they contain ForeignSecurityPrincipal Objects. As these are displayed as SID's, it looks like a DS query throws that exception which isn't picked up by Get-Adgroupmember cmdlet.

1

Get-ADGroupMember requires an ADGroup object to work with so you need to retrieve the ADGroup and pipe it into the Get-ADGroupMember cmdlet.

Get-ADGroup "GROUP_NAME" | Get-ADGroupMember -Recursive | Select name
  • Still same result, command completed successfully, but nothing is returned. – Volodymyr M. Jul 2 '13 at 6:57
  • I'll throw out an example to make sure we're on same page. Say you have a group called VPN. dsquery group -name "VPN" And you get "CN=VPN,OU=groups,dc=example,dc=com" Then you would do a Get-ADGroup "VPN" | Get-ADGroupMember -Recursive | Select name You use the part after CN= and before the first comma for the quoted value in Get-ADGroup – Pablo Jul 2 '13 at 12:59
  • Yes, that's the way I tried this, but it is still the same result, - nothing is returned, although command completes successfully. I tried to calculate number of the objects in the group with powershell to compare with dsquery output and specified group DN and it worked. The group name itself is correct, don't know why it doesn't work for get-adgroupmember cmd-let. – Volodymyr M. Jul 2 '13 at 13:58
  • Does 'Get-ADGroup "GROUP_NAME" -properties members' show a list of members? – Pablo Jul 2 '13 at 14:24
  • I'm not sure if this was true when posted, but it is not the case now. You can absolutely do Get-AdGroupMember -Identity WhateverMyGroupNameIs. What's unfortunately still true is that if the group in question has Foreign Security Principals (members from other forests) in its membership, the cmdlet will fail and return nothing. – Kevin Baker Dec 18 '15 at 21:34
0

Give this a try

Get-ADGroupMember -identity “GROUP NAME” | select name| Export-csv -path C:\test.csv -NoTypeInformation

Regards, UnMelc

  • Your answer could be made more helpful by elaborating a bit on the elements of your solution. – Tilman Schmidt Aug 20 '15 at 11:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.