I need to get a list of all of the users who are ultimately members of an active directory group. There's a single parent group which has a few other groups as its members, and each of those groups have a few users and several other groups as members in turn.

I need to extract:

  • First Name
  • Last Name
  • AD Username

From every user who is a member (directly or indirectly) of the top level group. It feels like this should be possible with dsquery, but I've only limited experience and can't figure out the syntax. It also should be possible using a DirectorySearcher in the System.DirectoryServices .Net namespace, but my LDAP isn't quite good enough!

Any suggestions on how to proceed with either approach would be much-appreciated.

Many thanks,

  • Do you have to use LDAP for this (is it part of an application or alike) or can you use Powershell to generate a list? I guess it depends on what the end use of this data is. – Sam Cogan Nov 16 '09 at 11:28
  • I'm eventually going to import this into a C# app - it doesn't need to be dynamic as it's not going to change in the lifetime of the app. Powershell would be great - all I really need is a way to extract a CSV or somesuch! – Jon Artus Nov 16 '09 at 12:01
  • 1
    Looks like a dupe of serverfault.com/questions/18018/… The answer that mystikphish gave over there serverfault.com/questions/18018/… has a great way to do what you want w/ the LDAP_MATCHING_RULE_IN_CHAIN operator. – Evan Anderson Nov 16 '09 at 16:32

Ok, well I've used this Powershell script to do this a number of times, it produces a listing of all users and groups under the group you specify. Obviously it can be tailored to give you the output you want.

You can use the export-csv command to then get your output into a CSV file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.