2

Something that is kind of weird that I haven't ran into before. We just did a domain migration and so now when I run a Get-ADUser {username} -Properties MemberOf against a standard user the MemberOf property returns {}.

Get-ADUser lsmith -Properties MemberOf
GivenName         : Lloyd
MemberOf          : {}
Name              : Lloyd Smith
ObjectClass       : user
ObjectGUID        : 5a599172-4913-4866-8767-ce8cb7d0887a
SamAccountName    : lsmith
SID               : S-1-5-21-2658504567-3195209084-2410544121-3270
Surname           : Smith
UserPrincipalName : lsmith@domain.com

If I run that same command against a user who is a domain admin, the MemberOf property returns the groups they are a member of. However, if I open PowerShell as an Administrator, the MemberOf property is populated when running this command against any user.

Has anyone else ran into this issue? It wouldn't be a huge deal, if I didn't need that property to be populated when running a PowerShell script through an ASP.Net web application.

3
  • 1
    Can you check the ACL on one the affected users to verify effective access for a non-domain-admin users allows "read group membership"? – jscott Feb 15 '15 at 2:25
  • I've ran the command as a domain admin against a domain user, verified that domain admins have access to read group information and it still returns {} UNLESS I run PowerShell as Administrator. I should note that I did not have to run PowerShell as Administrator in the old domain to return the MemberOf property. – Lloyd Smith Feb 15 '15 at 2:28
  • Also, it might be helpful to point out that the Get-ADPrincipalGroupMembership cmdlet exists. It'll return group objects instead of strings of the DNs of the groups that the object is a member of. – Cory Plastek Mar 1 '15 at 19:00
3

Going back through the old domain, it looks like the permissions were not set for authenticated users to be able to have read group membership. Once this was set, the property is populated without an issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.