Powershell – Some groups show no members in Get-ADGroup

powershell

So I have a question about strange PowerShell behavior with Get-ADGroup. If I use it on a group I created, I can get members just fine. But on some (not all) built in groups, including Domain Users, it returns nothing. See:

PS C:\> Get-ADGroup -Filter * -Properties * | Where {$_.name -eq "Iron Throne"} | Select -ExpandProperty members
CN=robert,OU=Baratheons,DC=seven-kingdoms,DC=local
CN=daenerys,OU=Targaryens,DC=seven-kingdoms,DC=local
CN=margaery,OU=Tyrells,DC=seven-kingdoms,DC=local
CN=joffrey,OU=Baratheons,DC=seven-kingdoms,DC=local
CN=Cersei Lannister,OU=Lannisters,DC=seven-kingdoms,DC=local

PS C:\> Get-ADGroup -Filter * -Properties * | Where {$_.name -eq "Domain Users"} | Select -ExpandProperty members

PS C:\>

They show up fine in Active Directory Users and Computers. This is on a Win2012R2 DC as Administrator. Anyone knows why?

Best Answer

A user's primary group will not be listed when querying member or memberOf with many utilities. As "Domain Users" is the default primary group for domain users, often this group will appear empty to queries. You may consider querying the primaryGroupId attribute as well.

See: Setting Primary Group Excludes the User from the Group Membership in Active Directory

Related Solutions

Active Directory – How to List All Active Directory Users and Their Group Membership

Install the Quest CMDlets and then run this code:

Add-PSSnapin Quest.ActiveRoles.ADManagement
$memberships = @()

Get-QADGroup -SizeLimit 0 | Foreach-Object {
        $NameGroup = $_.Name
        Write-Host "Working with $NameGroup"
        $membership = Get-QADGroupMember $_.DN -Enabled -SizeLimit 0
        if ($membership -ne $null ) {
        $membership | Add-Member -type NoteProperty -name AuditGroupUserIsMemberOf -value $_.Name
        $memberships += $membership
        }
    }

$memberships | Select-Object AuditGroupUserIsMemberOf, NTAccountname | Export-Csv "GroupsWithUsers.csv"

This will give you a 1 record per group-user connection so expect multiple occurrences of users and groups. If you wan't other fields, you can just edit the Select-Object statement. Use $memberships | gm to see all the possibilities for the users. If you want more fields for the groups, use Get-QADGroup | gm, you will then need to add these by adding a new NoteProperty.

If you don't really care about more options, here is a one-liner you can just mash in the terminal:

Get-QADGroup -sizeLimit 0 | select @{name="Group";expression={$_.name}} -expand members | select Group,@{n='User';e={ (Get-QADObject $_).NTAccountName}} | Export-Csv "MyUsersAndGroups.csv"

Powershell Get-Process cannot connect to remote computer

Well, I'm afraid you're giving away the answer yourself.

Your admin account on the local machine, does not have admin privileges on the remote machine.

Get-Process doesn't accept credentials, so when you run

Get-Process -ComputerName remoteMachine

you're authenticating as localMachine\Administrator, but when you invoke it and supply credentials, you're authenticating as remoteMachine\Administrator

Best Answer

Related Solutions

Active Directory – How to List All Active Directory Users and Their Group Membership

Powershell Get-Process cannot connect to remote computer

Related Topic