I have a powershell script that loops and retrieves AD information using get commands. At the moment it's retrieving the selected information for account name and distinguished name. But if I add another parameter/property e.g. members or full name it is not retrieving that information. How do I get past this as I want to retrieve more aduser information and the domain name:

    $GrpArr = @()
$Groups = get-adgroup -filter '*' -SearchBase "DC=hp,DC=dlink,DC=com" -ErrorAction "Silentlycontinue"| select samaccountname, DistinguishedName, GroupName, Name
foreach ($group in $groups)
$GrpArr += $group
$members = get-adgroupmember $group | select samaccountName, DistinguishedName, GroupName, Name
foreach ($member in $members)
    $GrpArr += $member
#$GrpArr += $domain

$GrpArr | Export-csv -ErrorAction "Silentlycontinue" -Path C:\Output.csv -NoTypeInformation

Here's a more precise explanation of what's going on:

That error means that the Identity parameter, which is the first positional parameter of Get-AD* commands, has an invalid type. In general it's a good idea to include exact, complete error messages, but in this case I can see that there's only one command that has an Identity parameter, Get-ADGroupMemeber, and you're supplying $group as the identity.

The problem is that $group is not an object type that the Identity parameter of Get-ADGroupMember can accept. Why? Because although the Identity property can accept ADGroup objects, and Get-ADGroup returns an array of ADGroup objects, Select-Object returns an array of PSCustomObjects with NoteProperties corresponding to the selected properties. So, by piping the output of Get-ADGroup through select, you're assigning an array of PSCustomObjects to $Groups, and in each iteration of the foreach loop you're supplying a member of that array as the Identity argument, hence the error.

That's the problem. The solution depends on what you're trying to accomplish, which isn't entirely clear.

You can resolve the error by simply moving | select [...] from the Get-ADGroup statement on the second line to the $GroupArr += $group line, as suggested in Tim Ferrill's answer. However, I don't think that will give you the results you want, for two reasons:

  1. You're combining results from different object types in the same CSV file. Get-ADGroup returns ADGroup objects, and Get-ADGroupMembers returns ADPrincipal objects (which can represent user, computer, or group objects). So, the CSV file will have, for each group, one line representing the group followed lines representing each member of that group.

    Maybe that's what you want, but I suspect not, because that's an odd set of data to represent in a CSV files, since generally CSV files aren't intended to be ordered, and there's nothing in the data which will distinguish between lines representing groups and lines representing group members. Also, if you have any nested groups, you'll have duplicate entries, because any group that is a member any other groups will be listed once as a group and once for each group of which it is a member.

  2. There is no "GroupName" property, either in Active Directory or in the objects returned by Get-AD* commands. The value of the GroupName property in each PSCustomObject returned by your select statements would be an empty ADPropertyValueCollection, which would show up in table format as {} (empty collection symbol) and in the CSV file as "Microsoft.ActiveDirectory.Management.ADPropertyValueCollection".

    I think it's a safe assumption that you don't want the CSV file to have a column that contains the exact same meaningless value for every entry. Also, logically it doesn't make sense to me that you'd want a GroupName column in entries representing groups when you already have a Name column, because for those entries Name would contain the name of the group.

If I had to guess, I'd guess that what you want is a CSV file with a line representing each group member, with columns for the member's sAMAccountName, distinguishedName, and name properties, and a GroupName column containing the name of the group it is a member of (which would mean that for security principals that are members of multiple groups, there would be multiple entries, each one with a different GroupName).

However, that's just an inference. If you can be more specific about what kind of output you're looking for, I can explain how to accomplish that.


Two lines need to be changed. The first step is to return the group objects instead of the only certain fields (this is why you're getting that error):

 $Groups = get-adgroup -filter '*' -SearchBase "DC=hp,DC=dlink,DC=com" -ErrorAction "Silentlycontinue"

Then to add only the fields you need to the array (this gets you the information you were originally retrieving):

$GrpArr += $group | select samaccountname, DistinguishedName, GroupName, Name

Everything else should work as-is.

  • Thanks, I have discovered it might not be passing because I dont have any groups, I have made a few more changes now taken a step back to loop through each ad to see whats being passed or not. Jun 27 '14 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.