• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1664
  • Last Modified:

Trouble enumerating group membership with dsquery/get


I am trying to enumerate the users in several domain groups.  The groups contain nested groups, so I need to expand those as well.  The output that I need is the RDN of the user object, but I am running into two issues.

This is the command I am attempting to run:
dsquery group -name "GROUPNAME" | dsget group -members -expand | dsquery user -o rdn

It takes the command fine, but just comes back with a full domain list of everyone's RDN.

If I just run: dsquery group -name "GROUPNAME" | dsget group -members -expand, it works fine, but the output is the full DN.

The other issue I am running into is more minor, but the output of the dsget group -expand command also outputs the nested group name.  Is there anyway to omit this?

I know there are probably tools to handle this type of reporting, but I am interested in seeing it work in the native command line.

Thank you for any assistance!
  • 4
1 Solution
Henrik JohanssonSystems engineerCommented:
Change it to be included in a for loop like below.

for /F %a in ('dsquery group -name "GROUPNAME" ^| dsget group -members -expand') do @dsquery user %a -o rdn
omnipower321Author Commented:
Thank you!  Running into some problems though.  I changed the final command to echo the variable (do @echo %a) and am coming up with the following:


It looks like as soon as it hits the backslash, it is halting because its an escape char.  

Is there a way to put it all into double quotes?

Thank you again, so close!
omnipower321Author Commented:
I realized that just may be my echo messing up, when I run the full line you sent I receive the following:

dsquery failed:No superior reference has been configured for the directory servi
ce. The directory service is therefore unable to issue referrals to objects outs
ide this forest.
omnipower321Author Commented:
Got it, it was the space.  I just got rid of the delims

for /F "delims="  %a in ('dsquery group -name "GROUPNAME" ^| dsget group -members -expand') do @dsquery user %a -o rdn

Works great!
omnipower321Author Commented:
Thanks again.

Featured Post

Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now