AD 2003 list group members

Jay Thomas
Jay Thomas used Ask the Experts™
on
HI all,

probably a no brainer this one. I need to know how to get a list of users from a domain based group. Preferably one which does not include the entire distiguished name for each user as I need to send the list of users to onother department.

Many thanks
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Krzysztof PytkoSenior Active Directory Engineer
Top Expert 2012

Commented:
Try with DSTools on a DC in command-line

dsquery group -name "GroupName" | dsget group -members -expand | dsget user -samid -fn -ln -display -desc >>c:\users.txt

Open in new window


EDIT: are you able to install Quest PowerShell module for AD (it's free)?
http://www.quest.com/powershell/activeroles-server.aspx

then you can use this syntax:

Get-QADGroup "GroupName" | Get-QADGroupMember -Indirect | Get-QADUser | Select SamAccountName,givenName,sn,Decription | Export-CSV c:\users.csv

Open in new window


Regards,
Krzysztof

Author

Commented:
Hi, can you explain the fn and ln switches please? Also, probably being dumb but where do i specify the OU?

Author

Commented:
Hi Krzysztof. Would that need to be installed on a DC? If so I'd never get it signed off in the time that i need the results but thanks anyway.
How to Generate Services Revenue the Easiest Way

This Tuesday! Learn key insights about modern cyber protection services & gain practical strategies to skyrocket business:

- What it takes to build a cloud service portfolio
- How to determine which services will help your unique business grow
- Various use-cases and examples

Question : Hi, can you explain the fn and ln switches please? Also, probably being dumb but where do i specify the OU?

   fn= First name
   ln= Last name

You need to specify any OU path, As Group name is sufficient to query the AD
Krzysztof PytkoSenior Active Directory Engineer
Top Expert 2012

Commented:
fn attribute means First Name
ln attribute means Last Name

you don't have to specify OU because you need to only provide GroupName in a syntax and it will be discovered. Then all group members you will get into text file on C-Drive.

When you have DC then you don't have to install anything, DSTools are available. You need to only install RSAT/Administrative Tools on local workstation to use DS commands.

Quest tool you can install on any workstation and then use it

Krzysztof
Would that need to be installed on a DC? If so I'd never get it signed off in the time that i need the results but thanks anyway.?

 Dsquery is Inbuilt tool No need to install on DC.

Author

Commented:
Hi, when i run the dsquery i get an error:

deget failed: value for "target object for this command" has incorrect format

Mean anything. I've tried group name with and without quotes but same error. Didn't know if quotes were required.
Krzysztof PytkoSenior Active Directory Engineer
Top Expert 2012
Commented:
No, probably that group has group nesting and result contains another groups inside, so dsget user fails :/

Try without the last DSGET USER part

dsquery group -name "GroupName" | dsget group -members -expand >>c:\users.txt

Open in new window


but you will get the output with Distinguished Names :/

or download and install Quest PowerShell. DSTools are limited

Krzysztof

Author

Commented:
HI, running the new query just creates a blank document. There is a microsft header but the last line says "no files specified"
Krzysztof PytkoSenior Active Directory Engineer
Top Expert 2012

Commented:
Have you replaced "GroupName" with your own group name to query ?

Krzysztof

Author

Commented:
Yep. HAve included qotes but no change, same output blank file.
Krzysztof PytkoSenior Active Directory Engineer
Top Expert 2012

Commented:
Type command without redirection to file and see what do you see on the screen

dsquery group -name "GroupName" | dsget group -members -expand

Open in new window


or skip -expand switch which may cause this error

dsquery group -name "GroupName" | dsget group -members >>c:\users.txt

Open in new window


however, I would recommend using for that Quest PowerShell :)

Krzysztof

Author

Commented:
Forget that, Had an extra | in there for good measure :)   That has worked except I have some 1500 users each showing distinguished name.

Back to the POwershell. Does this need installing on a DC?
Senior Active Directory Engineer
Top Expert 2012
Commented:
No, on any workstation and it is REALLY good tool in these days :D

In that text file you have now, please remove all DNs of groups and remove blank lines and headers. You can get users info this way (after doing mentioned things)

for /f "tokens=*" %i in (c:\users.txt) do dsget user %i -fn -ln -samid -desc -c >>c:\newusers.txt

Open in new window


Krzysztof

Author

Commented:
Thank you very much guy's. Hope that teh points split seems fair.
Krzysztof PytkoSenior Active Directory Engineer
Top Expert 2012

Commented:
You're welcome :)

Krzysztof

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial