I'm having a bit of a problem with LDAP search that should specify whether a user is a member of a given AD group or not (recursively).

Basically, what I'm doing is issue a LDAP search with the following parameters:

get-aduser -LDAPFilter "(memberof:1.2.840.113556.1.4.1941:={group LDAP path})" -SearchBase "{AD LDAP base}"

This does yield the expected result: instead of getting all users who are directly or indirectly members of the group I'm searching for, I get all direct members of that group, plus a random selection of indirect members (members of groups that are member of the searched for group).

The list I'm getting seems arbitrary: I can't find any difference in group membership between two users who should be present in the result set but one is there and the other isn't.

(I need to solve this issue with LDAP search because the result will be used in an application, not through powershell. But using powershell in this way, I can reproduce the original problem in the way described).

  • How many total entries are being returned so far? If its more than 5000(?) you could be hitting the ldap server search limit, and that may factor into the "randomness" of the result. – Clayton Oct 2 '14 at 15:38
  • It's only a handlfull: about 10 – Stephane Oct 3 '14 at 12:02
  • 1
    I think that query does not take into account Primary Group. As far as I know Primary Groups are not found by using "memberof" operator. – LatinSuD Oct 15 '15 at 10:25

Use Get-ADGroupMember with the -Recursive switch to get a listing of all members that do not contain child objects. This will dive down into members that have child object to get their members.


$groupName = "Domain Admins"
$group = Get-ADGroup $groupName
$groupMembers = Get-ADGroupMember $group -Recursive

You need to query the group instead of the users because memberOf can give inconsistent results due to users being members of nested groups / roles / etc.

| improve this answer | |
  • Thanks for the answer but what I'm actually looking for is a LDAP query filter that will yield that same result (see my comment about how I intend to use the solution). – Stephane Sep 19 '14 at 5:30

Do you get the same result with get-adobject (instead of get-aduser)?
Or try using the .NET Directory Searcher object

$rootDSE = [adsi]"LDAP://RootDSE"
$dnDomain = $rootDSE.defaultNamingContext
$search = New-Object DirectoryServices.DirectorySearcher([ADSI]"")
$search.searchroot = [adsi]"LDAP://$dnDomain"
$search.Filter = "(&(objectClass=user)(memberof:1.2.840.113556.1.4.1941:={group LDAP path}))"
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.