Powershell - (Active Directory Module) - Get-ADGroupMember only works for groups in my Domain

powershell active-directory active-directory-group
MKANET picture MKANET · Oct 24, 2013 · Viewed 19.5k times · Source

I'm a bit embarrassed to say how much time I've spent on this!

I dont have any issues using the ADUC GUI (Active Directory User and Computers) to find the group, All Supervisors in east.ad.company.com. The result comes up within a few seconds.

However, if I try to do the same thing using the Active Directory module:

Get-ADGroupMember "All Supervisors" -server east.ad.company.com

produces the error:

....FullyQualifiedErrorId : Cannot find an object with identity: 'All Supervisors' under: 'DC=east,DC=ad,DC=company,DC=com'.,Microsoft.ActiveDirectory.Management.Commands.GetADGroupMember...

---------------------------------------------------------------------------------------------------------

A few things to note:

  • Group scope of "All Supervisors" is Universal (not sure if that makes a difference)
  • My Computer and AD user account is currently in the west.ad.company.com
  • I can successfully use Get-AdGroupMember as long as it's in the same domain as me
  • I can successfully use get-aduser -identity ADUserID -server ba.ad.ssa.gov

---------------------------------------------------------------------------------------------------------

Lastly: I would also like to know how to do the equivalent of searching in ADUC for Users and Groups in "Entire Directory" in Powershell (ideally a simple function or script I can use to quickly search do this at the command-line; instead of depending on the ADUC GUI app). Surely, there has to be a way to do this using pure powershell!

Answer

Simon picture Simon · Oct 27, 2013

Searching the 'Entire Directory' is known as a Global Catalog search, so you just need to tell PowerShell to use the Global Catalog. It's found on DCs on port 3268 (instead of 389). Not all domain controllers have to hold the Global Catalog - it's up to your admins to decide. You can query for GC servers with 

(Get-ADForest).GlobalCatalogs

I only have a single domain, so i can't test this but I believe you'll want something like:

Get-ADGroupMember "All Supervisors" -server dc1.east.ad.company.com:3268 -SearchBase ad.company.com

assuming your forest root is ad.company.com.

Related questions

Is there a way to check AD group membership for a computer?

I am trying to check computer group membership through Powershell. I want to be able to specify a certain computer name and find which groups that computer is in but from a Powershell script. I am planning on running the …

Read More
Add multiple users to multiple groups from one import csv

I have a csv with 2 columns, one column is AD group names and one is user account names. I am trying to read the csv and import the users into their corresponding group. Here is what i have to so …

Read More
Listing users in ad group recursively with powershell script without CmdLets

I'm trying to list everyone in a security group in an active directory without using CmdLets in PowerShell. The weird thing with my script is that it works if I list the entire directory but if I try and specify …

Read More