I've noticed that when I use Powershell to get the group membership of an Active Directory domain security group, the Powershell cmdlet
Get-ADGroupMember $Group fails with the error message:
PS C:\> get-adgroupmember MyGroup
get-adgroupmember : An operations error occurred
At line:1 char:1
+ get-adgroupmember MyGroup
+ CategoryInfo : NotSpecified: (MyGroup:ADGroup) [Get-ADGroupMember], ADException
+ FullyQualifiedErrorId : ActiveDirectoryServer:8224,Microsoft.ActiveDirectory.Management.Commands.GetADGroupMember
I have tried specifying the
-server $DC parameter so that the cmdlet targets a specific DC, and then I check the Security logs on that DC as I reproduce the error and no relevant security failure audits are generated. I turned up all the Diagnostics registry entries in the
services\NTDS\Diagnostics key and that doesn't produce anything interesting in the Directory Services logs either.
If I remove the group members that reside in the other domain from MyGroup, the cmdlet works no problem.
Interestingly, I notice that if I run the command locally on the DC itself, it works. But when I run the command remotely from a member server, using the same user account, (who is a Domain Admin,) it fails.
Any idea what's wrong?