Solved

Is it possible to export AD group members from another domain, not just the local domain?

Posted on 2011-09-27
15
829 Views
Last Modified: 2012-05-12
Two domains in one forest.
Getting ready for domain merge, but wanted to export AD group members for backup.
Using AD Powershell on 2008 Server R2 in target domain.
Success in running get-adgroupmember but only shows local members, not members from the other domain
0
Comment
Question by:mdb1008
  • 6
  • 5
  • 3
15 Comments
 
LVL 16

Assisted Solution

by:Dale Harris
Dale Harris earned 250 total points
ID: 36713807
mdb1008,

With Quest Powershell CMDlets, you can use this command:

Get-QADGroupMember -Service "domain.name" if you want to connect to a different domain.

HTH,

Dale Harris
0
 

Author Comment

by:mdb1008
ID: 36714006
mkline71,
Thanks for the added zone.  I tried to find the powershell zone to add myself, but probably just didn't look in the right places.

Daleharris,
I saw the Quest Powershell CMDlets today when I googled this, but did not get the chance to download and try it yet.  I just downloaded the free Quest zip file and will take it to work in the morning to test it out.  I'll post and let you know the results.  It really looks pretty simple...
0
 
LVL 16

Expert Comment

by:Dale Harris
ID: 36714078
Quest CMDLets are the preferred method of dealing with AD even with the AD CMDlets Microsoft put out with the newest version of Powershell.  I'm looking forward to seeing if it works as easy as advertised :)

Dale Harris
0
 
LVL 39

Accepted Solution

by:
Krzysztof Pytko earned 250 total points
ID: 36714851
Syntax for Quest PowerShell (Quest PS can be downloaded from http://www.quest.com/powershell/activeroles-server.aspx)

 
Get-QADGroup -SearchRoot "dc=domain,dc=local" "GroupName" | Get-QADGroupMember -Indirect | Get-QADUser | select givenName,sn,sAMAccountName

Open in new window


for 2008 R2 I cannot provide syntax because I have no access to 2008R2/Win7, now and I'm not expert in PS to get from memory ;)

Regards,
Krzysztof
0
 

Author Comment

by:mdb1008
ID: 36716570
Okay, the Quest software is as simple as it looks.  I was able to connect to the other domain on the first try using Dale Harris suggested CMDlet.  I still have the problem I originally had though.  I need to be able to export to csv or text file ALL members of the group in one domain (including members from the other domain).  Connecting to the other domain doesn't help with this since the group is not in the other domain.  Does this make sense?
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 36716627
Try this

 
Get-QADGroup -SearchRoot "dc=domain,dc=local" "GroupName" | Get-QADGroupMember -Indirect | Get-QADUser | select givenName,sn,sAMAccountName | Export-CSV c:\members.csv

Open in new window


Krzysztof
0
 
LVL 16

Expert Comment

by:Dale Harris
ID: 36716629
Yes, that makes sense now that I've read it a couple times :)

So when you do a full get-qadgroupmember on the group and look at the results, you're saying none of the people from the other domain are even showing up as contacts?

Please let me know how they are being seen by your group.

If you have SOMETHING from the other domain, but it's not an exact user account, then we can do a search on referenced account with a subsequent command.

Or if that approach doesn't work, we can go through each user account in the other domain and look for a group membership pointing back to your 1st domain.

Are you following so far?

Lastly, exporting to a text file is the easiest part of the problem, so no issues there once we can find all the users.

HTH,

Dale Harris
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 

Author Comment

by:mdb1008
ID: 36716723
Thanks to both of you.  The exporting to .csv file I already figured out while waiting for a reply.

Krzysztof's command only showed members from local domain, not the other domain.

To answer Dale's question:  In AD there is an OU for this other domain but members are listed with "@otherdomain.com" after their username.  They show up on security or distribution group "Members" tab in that format - "username@otherdomain.com".

Does this help?

0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 36716787
Command should display all users :) (in my env shows people from different domains )

@domain.name is a UPN (User Principla Name) Maybe you want to add it to display?

then in after select sAMAccountName,givenName,sn,UserPrincipalName

Krzysztof
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 36716793
It should show users from all domains, because Get-QADUser uses user's Distinguished Name to get specified data in the output :]

Krzysztof
0
 

Author Comment

by:mdb1008
ID: 36716985
Krzysztof,
The problem is not that the UserPrincipalName is not displayed.
The problem is the other domain members in the group are not displayed.
This might not be something Quest Powershell can do since the other domain users are only in the group as contacts.
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 36717087
OK then :) wait for PS expert :]
I don't know how to get contact in PS

That syntax works only for user's accounts

Wish you luck

Krzysztof
0
 

Author Comment

by:mdb1008
ID: 36717352
Okay, I found software that does this stuff for me.  ADManagerPlus actually listed everyone in all Distribution Groups and Security Groups and let me export to .csv or .pdf.  I downloaded the 30 day trial version.  The only thing I cannot do is connect to the other domain, but that is not necessary now as I can remote to the other domain and run the trial software from there as well.

Thanks to both of you for your help with this.  If I did not have contacts both of you would have resolved my issue.  I am splitting the points between you both.
0
 

Author Closing Comment

by:mdb1008
ID: 36717413
The solution provided here did not work for me due to there being contacts in the group rather than users, but this solution will work for anyone that has multiple domains with members of groups being users.

Thanks for all the help!
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

"Migrate" an SMTP relay receive connector to a new server using info from an old server.
Create and license users in Office 365 in bulk based on a CSV file. A step-by-step guide with PowerShell script examples.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now