Trouble enumerating group membership with dsquery/get

Posted on 2010-01-06
Last Modified: 2012-05-08

I am trying to enumerate the users in several domain groups.  The groups contain nested groups, so I need to expand those as well.  The output that I need is the RDN of the user object, but I am running into two issues.

This is the command I am attempting to run:
dsquery group -name "GROUPNAME" | dsget group -members -expand | dsquery user -o rdn

It takes the command fine, but just comes back with a full domain list of everyone's RDN.

If I just run: dsquery group -name "GROUPNAME" | dsget group -members -expand, it works fine, but the output is the full DN.

The other issue I am running into is more minor, but the output of the dsget group -expand command also outputs the nested group name.  Is there anyway to omit this?

I know there are probably tools to handle this type of reporting, but I am interested in seeing it work in the native command line.

Thank you for any assistance!
Question by:omnipower321
    LVL 31

    Accepted Solution

    Change it to be included in a for loop like below.

    for /F %a in ('dsquery group -name "GROUPNAME" ^| dsget group -members -expand') do @dsquery user %a -o rdn

    Author Comment

    Thank you!  Running into some problems though.  I changed the final command to echo the variable (do @echo %a) and am coming up with the following:


    It looks like as soon as it hits the backslash, it is halting because its an escape char.  

    Is there a way to put it all into double quotes?

    Thank you again, so close!

    Author Comment

    I realized that just may be my echo messing up, when I run the full line you sent I receive the following:

    dsquery failed:No superior reference has been configured for the directory servi
    ce. The directory service is therefore unable to issue referrals to objects outs
    ide this forest.

    Author Comment

    Got it, it was the space.  I just got rid of the delims

    for /F "delims="  %a in ('dsquery group -name "GROUPNAME" ^| dsget group -members -expand') do @dsquery user %a -o rdn

    Works great!

    Author Closing Comment

    Thanks again.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Join & Write a Comment

    This is my first article in EE and english is not my mother tongue so any comments you have or any corrections you would like to make, please feel free to speak up :) For those of you working with AD, you already are very familiar with the classi…
    As network administrators; we know how hard it is to track user’s login/logout using security event log (BTW it is harder now in windows 2008 because user name is always “N/A” in the grid), and most of us either get 3rd party tools, or just make our…
    This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

    734 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    23 Experts available now in Live!

    Get 1:1 Help Now