How do I get the member of the users from the active directory group.

Hi Experts,

I need to get the name of the members from the active directory group. In our active directory we have got lots of group and lots of members. I need to find out which users is in which group.

Is there a way to find out in a table format. Please help me . Our AD has lots of OU as well. Powershell guru please help me.
koala-londonAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
Krzysztof PytkoConnect With a Mentor Active Directory EngineerCommented:
Run this command from command-line on a server or workstation with Administrative Tools installed

dsquery group -name verw_is | dsget group -members -expand |dsget user -fn -ln -samid -email -desc >c:\members.txt

and import it to Excel sheet.

0
SMB Security Just Got a Layer Stronger

WatchGuard acquires Percipient Networks to extend protection to the DNS layer, further increasing the value of Total Security Suite.  Learn more about what this means for you and how you can improve your security with WatchGuard today!

 
Bart-VandyckConnect With a Mentor Commented:


In powershell it is prettey to list all members of group. Feed it a list with group names and export it to a csv, xml file,...


$group = [ADSI]"LDAP://CN=<groupname>,OU=<OU-Name>,DC=<domain>,DC=<domain>"
$group.member

Open in new window

0
 
koala-londonAuthor Commented:
Hi iSiek

I got error "target object for this command is missing". we have lots of DC in our domain. I am abit new to powershell and script. could you provide me a complete command please?
0
 
johnnytankiConnect With a Mentor Commented:
1. Save the below as EnumGroup.vbs.
2. Run cscript //nologo EnumGroup.vbs "cn=Sales,ou=West,dc=MyDomain,dc=com" > Sales.txt where "cn=Sales,ou=West,dc=MyDomain,dc=com"  is your desired group


Option Explicit

Dim objGroup, strDN, objMemberList
Dim adoConnection, adoCommand, objRootDSE, strDNSDomain

' Dictionary object to track group membership.
Set objMemberList = CreateObject("Scripting.Dictionary")
objMemberList.CompareMode = vbTextCompare

' Check for required argument.
If (Wscript.Arguments.Count < 1) Then
    Wscript.Echo "Required argument  " _
        & "of group missing."
    Wscript.Echo "For example:" & vbCrLf _
        & "cscript //nologo EnumGroup.vbs " _
        & """cn=Test Group,ou=Sales,dc=MyDomain,dc=com"""
    Wscript.Quit(0)
End If

' Bind to the group object with the LDAP provider.
strDN = Wscript.Arguments(0)
On Error Resume Next
Set objGroup = GetObject("LDAP://" & strDN)
If (Err.Number <> 0) Then
    On Error GoTo 0
    Wscript.Echo "Group not found" & vbCrLf & strDN
    Wscript.Quit(1)
End If
On Error GoTo 0

' Retrieve DNS domain name from RootDSE.
Set objRootDSE = GetObject("LDAP://RootDSE")
strDNSDomain = objRootDSE.Get("defaultNamingContext")

' Setup ADO.
Set adoConnection = CreateObject("ADODB.Connection")
Set adoCommand = CreateObject("ADODB.Command")
adoConnection.Provider = "ADsDSOObject"
adoConnection.Open "Active Directory Provider"
Set adoCommand.ActiveConnection = adoConnection
adoCommand.Properties("Page Size") = 100
adoCommand.Properties("Timeout") = 30
adoCommand.Properties("Cache Results") = False

' Enumerate group membership.
Wscript.Echo "Members of group " & objGroup.sAMAccountName
Call EnumGroup(objGroup, "  ")

' Clean Up.
adoConnection.Close
Set objGroup = Nothing
Set objRootDSE = Nothing
Set adoCommand = Nothing
Set adoConnection = Nothing

Sub EnumGroup(ByVal objADGroup, ByVal strOffset)
    ' Recursive subroutine to enumerate group membership.
    ' objMemberList is a dictionary object with global scope.
    ' objADGroup is a group object bound with the LDAP provider.
    ' This subroutine outputs a list of group members, one member
    ' per line. Nested group members are included. Users are also
    ' included if their primary group is objADGroup. objMemberList
    ' prevents an infinite loop if nested groups are circular.

    Dim strFilter, strAttributes, adoRecordset, intGroupToken
    Dim objMember, strQuery, strNTName

    ' Retrieve "primaryGroupToken" of group.
    objADGroup.GetInfoEx Array("primaryGroupToken"), 0
    intGroupToken = objADGroup.Get("primaryGroupToken")

    ' Use ADO to search for users whose "primaryGroupID" matches the
    ' group "primaryGroupToken".
    strFilter = "(primaryGroupID=" & intGroupToken & ")"
    strAttributes = "sAMAccountName"
    strQuery = ";" & strFilter & ";" _
        & strAttributes & ";subtree"
    adoCommand.CommandText = strQuery
    Set adoRecordset = adoCommand.Execute
    Do Until adoRecordset.EOF
        strNTName = adoRecordset.Fields("sAMAccountName").Value
        If (objMemberList.Exists(strNTName) = False) Then
            objMemberList.Add strNTName, True
            Wscript.Echo strOffset & strNTName & " (Primary)"
        Else
            Wscript.Echo strOffset & strNTName & " (Primary, Duplicate)"
        End If
        adoRecordset.MoveNext
    Loop
    adoRecordset.Close

    For Each objMember In objADGroup.Members
        If (objMemberList.Exists(objMember.sAMAccountName) = False) Then
            objMemberList.Add objMember.sAMAccountName, True
            If (UCase(Left(objMember.objectCategory, 8)) = "CN=GROUP") Then
                Wscript.Echo strOffset & objMember.sAMAccountName & " (Group)"
                Call EnumGroup(objMember, strOffset & "  ")
            Else
                Wscript.Echo strOffset & objMember.sAMAccountName
            End If
        Else
            Wscript.Echo strOffset & objMember.sAMAccountName & " (Duplicate)"
        End If
    Next
    Set objMember = Nothing
    Set adoRecordset = Nothing
End Sub

0
 
Krzysztof PytkoActive Directory EngineerCommented:
I'm sorry, I didn't remove my group name from command :)
Replace Verw_IS group name please by your own group name which you want to examine :]
0
 
Meir RivkinFull stack Software EngineerCommented:
change $grouName to your required AD group name.
$grouName = "GUI"
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.Filter = "(&(objectCategory=group) (name=$grouName))"
$distName = $objSearcher.FindOne().GetDirectoryEntry().distinguishedName
$ADGroup = [ADSI]"LDAP://$distName"
write-host $ADGroup.member

Open in new window

0
 
koala-londonAuthor Commented:
Thanks Guys. I'm gonna try it and let you know
0
 
Chris DentPowerShell DeveloperCommented:

What do you actually want to see in the output?

There are a number of methods to get information about group members. These are in addition to the approach sedgwick has used.

Chris
# Quest CmdLets
Get-QADGroupMember "Your Group"

# Exchange CmdLets (mail enabled groups only)
Get-DistributionGroupMember "Your Group"

# AD CmdLets
Get-ADGroupMember "Your Group"

Open in new window

0
 
koala-londonAuthor Commented:
all thanks
0
All Courses

From novice to tech pro — start learning today.