Solved

Powershell - Pulling nested group members

Posted on 2013-12-17
6
1,595 Views
Last Modified: 2014-01-06
Hi EE

Can someone help me modify this script so it also pulls the nested group members ?

If I enter a group in the groups.txt file that also has nested groups , it does not pull those members into the output file .

Import-Module Activedirectory
[array]$Members=$null
GC groups.txt | % {
$Group = Get-ADGroup $_  -ErrorAction SilentlyContinue
If ($Group){
$members += Get-ADGroup $Group.Name -Properties Members |
            Select-Object -ExpandProperty Members |
            Get-ADObject -properties Samaccountname |
            ?{$_.ObjectClass -eq "user"}  | Get-aduser -Properties * |
      Select @{L='GroupName';e={$Group.Name}},Name,Samaccountname,CanonicalName
 }
}
$Members | Select * | Export-Csv Members.csv -NoTypeInformation
0
Comment
Question by:MilesLogan
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
6 Comments
 
LVL 40

Expert Comment

by:footech
ID: 39725498
Get-ADGroupMember has a -recursive parameter which makes this easy.
Get-Content groups.txt | ForEach `
{
    $group = Get-ADGroup $_ -ErrorAction SilentlyContinue | Select -ExpandProperty Name
    If ($Group)
    {
        Get-ADGroupMember $group -Recursive |
         Get-ADUser -Properties canonicalname | 
         Select @{n="GroupName";e={$group}},Name,Samaccountname,Canonicalname
    }
} | Export-Csv Members.csv -NoTypeInformation

Open in new window

If you didn't need the CanonicalName, you wouldn't even need to pipe to Get-ADUser.
0
 
LVL 2

Author Comment

by:MilesLogan
ID: 39725512
Hi footech .. thank you .. it worked on a small group but not on a group with more then 5k users .. can this be tweaked so I can ?
0
 
LVL 40

Expert Comment

by:footech
ID: 39725563
It's not actually a problem with the script, but with limits that AD Web Services has.  See about the "MaxGroupOrMemberEntries" parameter in this link
http://technet.microsoft.com/en-us/library/dd391908%28WS.10%29.aspx

You can try changing the parameter so it works.
You could also the following substitutes [adsisearcher] type accelerator for the Get-ADGroupMember cmdlet, but I wouldn't be able to test how it works with >5K members.
Get-Content groups.txt | ForEach `
{
    $group = Get-ADGroup $_ -ErrorAction SilentlyContinue | Select -ExpandProperty Name
    If ($Group)
    {
        ([ADSISearcher]"(&(ObjectClass=Group)(samaccountname=$group))").FindOne() |
         % {$_.Properties.member} |
         Get-ADUser -Properties canonicalname | 
         Select @{n="GroupName";e={$group}},Name,Samaccountname,Canonicalname
    }
} | Export-Csv Members.csv -NoTypeInformation

Open in new window


EDIT: found a problem with the code, so don't bother with it.  I'll see if I can correct it.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 40

Accepted Solution

by:
footech earned 500 total points
ID: 39725607
Can't say I really like what I've come up with, but it appears to work.  From an efficiency standpoint I think there are too many queries to AD.  It may be possible to optimize it more, but by far my preferred route would be to change the AD WS parameter.
function groupmember ($group)
{
    $groupname = Get-ADGroup $group | Select -expand Name
    ([ADSISearcher]"(&(ObjectClass=Group)(samaccountname=$groupname))").FindOne() |
     % {$_.Properties.member} |
     Get-ADobject | % `
    {
        If ($_.objectclass -eq "group")
        { groupmember $_ }
        Else
        { $_ }
    }
}
Get-Content groups.txt | ForEach `
{
    $group = Get-ADGroup $_ -ErrorAction SilentlyContinue | Select -ExpandProperty Name
    If ($Group)
    {
        groupmember $group |
         Get-ADUser -Properties canonicalname |
         Select @{n="GroupName";e={$group}},Name,Samaccountname,Canonicalname
    }
} | Export-Csv Members.csv -NoTypeInformation

Open in new window

0
 
LVL 40

Expert Comment

by:Subsun
ID: 39726408
Probably need  to add Select * -Unique to get the unique members..
0
 
LVL 2

Author Closing Comment

by:MilesLogan
ID: 39760882
thanks footech ! sorry for the late closing on this .. Holidays and Flu caught up ..
0

Featured Post

The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Previously, on our Nano Server Deployment series, we've created a new nano server image and deployed it on a physical server in part 2. Now we will go through configuration.
A company’s centralized system that manages user data, security, and distributed resources is often a focus of criminal attention. Active Directory (AD) is no exception. In truth, it’s even more likely to be targeted due to the number of companies …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question