Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 14053
  • Last Modified:

Powershell - Get-ADGroupMember : The size limit for this request was exceeded

Hi EE

I have the script below that I need to get data from a group with over 20k acccounts ..
Any idea what I need to modify to make it work ?

Import-Module Activedirectory
[array]$Members=$null
GC groups.txt | % {
$Group = Get-ADGroup $_  -ErrorAction SilentlyContinue
If ($Group){
$members += Get-ADGroupMember $Group.Name | Get-aduser -Properties * |
Select @{L='GroupName';e={$Group.Name}},Name,Samaccountname,Enabled,LastLogonDate,PasswordLastSet,PasswordExpired,PasswordNeverExpires,CanonicalName
 }
}
$Members | Select * | Export-Csv test1027.csv -NoTypeInformation
0
MilesLogan
Asked:
MilesLogan
1 Solution
 
Satish AutiSenior System AdministratorCommented:
Mark,

will keep in mind.. thanks for reminder :)
0
 
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
Based on http://mctexpert.blogspot.in/2013/07/how-to-exceed-maximum-number-of-allowed.html, the ADWS (Active Directory Web Service) cmdlets have server-side limits of
a) the maximum number of objects to retrieve (5000)
b) the allowed time for completing (5 minutes)

The timeout setting is not negotiable, but you can change the object limitation. Though that should only be done in rare cases - most of the time the limit is reasonable, and having to set a bigger one is usually a failure in design.
You'll have to change the file %WinDir%\ADWS\Microsoft.ActiveDirectory.WebServices.exe.config on each ADWS domain controller by searching for <appSettings>, and adding the line
<add key=”MaxGroupOrMemberEntries” value=”25000”/>

Open in new window

(or a higher value).
0
 
SubsunCommented:
Try this workaround..
Import-Module Activedirectory
[array]$Members=$null
GC groups.txt | % {
$Group = Get-ADGroup $_  -ErrorAction SilentlyContinue
If ($Group){
$members += Get-ADGroup $Group.Name -Properties Members | 
		Select-Object -ExpandProperty Members | 
		Get-ADObject -properties Samaccountname | 
		?{$_.ObjectClass -eq "user"}  | Get-aduser -Properties * |
	Select @{L='GroupName';e={$Group.Name}},Name,Samaccountname,Enabled,LastLogonDate,PasswordLastSet,PasswordExpired,PasswordNeverExpires,CanonicalName
 }
}
$Members | Select * | Export-Csv test1027.csv -NoTypeInformation

Open in new window

0
 
MilesLoganAuthor Commented:
Thak you Subsun this worked ..

Thank you all for the other info as well ..
0
 
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
It might work, but seems to be ineffective for that much objects, as the AD is queried many, many times instead of having single calls. It depends on the focus - getting it to work at all, or being able to do without much workload and in reasonable time.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Tackle projects and never again get stuck behind a technical roadblock.
Join Now