I ran the following PowerShell script to compare a list of groups....

$dasMem = Get-ADUser -Server "<some-srv>" -Identity "<some-usr>" -Properties MemberOf | Select MemberOf
$blahx = $dasMem.MemberOf | % { $_ -replace "^CN=", "" } | % { $_ -replace ",.*$", "" } | sort

When I got the list, I ended up with a missing group, Domain users which I believe is a standard default group. Is there any reason why it's missing when I pull the script?

To be clear I was able to see the group in Active Directory Users and Computers, but not from my script above.

1 Answer 1


As silly as it sounds, it's because Domain Users is not actually in the memberOf attribute. You can verify in ADUC by turning on View - Advanced Features, going to the Attributes tab on your object and opening the memberOf attribute (not the "Member Of" tab).

The "Member Of" tab you see on an object's properties in ADUC is actually a conglomeration of the memberOf attribute and the primaryGroupID attribute. By default, users in AD get their Domain Users membership via this primaryGroupID attribute rather than an entry in memberOf. Though it's possible to change the primaryGroupID, most people don't.

  • 1
    Also, if you want a Powershell cmdlet that includes the Domain Users group (because, who knows), use the Get-ADPrincipalGroupMembership
    – curropar
    Feb 27, 2019 at 16:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.