Solved

Powershell - Pulling nested group members

Posted on 2013-12-17
6
1,557 Views
Last Modified: 2014-01-06
Hi EE

Can someone help me modify this script so it also pulls the nested group members ?

If I enter a group in the groups.txt file that also has nested groups , it does not pull those members into the output file .

Import-Module Activedirectory
[array]$Members=$null
GC groups.txt | % {
$Group = Get-ADGroup $_  -ErrorAction SilentlyContinue
If ($Group){
$members += Get-ADGroup $Group.Name -Properties Members |
            Select-Object -ExpandProperty Members |
            Get-ADObject -properties Samaccountname |
            ?{$_.ObjectClass -eq "user"}  | Get-aduser -Properties * |
      Select @{L='GroupName';e={$Group.Name}},Name,Samaccountname,CanonicalName
 }
}
$Members | Select * | Export-Csv Members.csv -NoTypeInformation
0
Comment
Question by:MilesLogan
  • 3
  • 2
6 Comments
 
LVL 39

Expert Comment

by:footech
ID: 39725498
Get-ADGroupMember has a -recursive parameter which makes this easy.
Get-Content groups.txt | ForEach `
{
    $group = Get-ADGroup $_ -ErrorAction SilentlyContinue | Select -ExpandProperty Name
    If ($Group)
    {
        Get-ADGroupMember $group -Recursive |
         Get-ADUser -Properties canonicalname | 
         Select @{n="GroupName";e={$group}},Name,Samaccountname,Canonicalname
    }
} | Export-Csv Members.csv -NoTypeInformation

Open in new window

If you didn't need the CanonicalName, you wouldn't even need to pipe to Get-ADUser.
0
 
LVL 2

Author Comment

by:MilesLogan
ID: 39725512
Hi footech .. thank you .. it worked on a small group but not on a group with more then 5k users .. can this be tweaked so I can ?
0
 
LVL 39

Expert Comment

by:footech
ID: 39725563
It's not actually a problem with the script, but with limits that AD Web Services has.  See about the "MaxGroupOrMemberEntries" parameter in this link
http://technet.microsoft.com/en-us/library/dd391908%28WS.10%29.aspx

You can try changing the parameter so it works.
You could also the following substitutes [adsisearcher] type accelerator for the Get-ADGroupMember cmdlet, but I wouldn't be able to test how it works with >5K members.
Get-Content groups.txt | ForEach `
{
    $group = Get-ADGroup $_ -ErrorAction SilentlyContinue | Select -ExpandProperty Name
    If ($Group)
    {
        ([ADSISearcher]"(&(ObjectClass=Group)(samaccountname=$group))").FindOne() |
         % {$_.Properties.member} |
         Get-ADUser -Properties canonicalname | 
         Select @{n="GroupName";e={$group}},Name,Samaccountname,Canonicalname
    }
} | Export-Csv Members.csv -NoTypeInformation

Open in new window


EDIT: found a problem with the code, so don't bother with it.  I'll see if I can correct it.
0
Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

 
LVL 39

Accepted Solution

by:
footech earned 500 total points
ID: 39725607
Can't say I really like what I've come up with, but it appears to work.  From an efficiency standpoint I think there are too many queries to AD.  It may be possible to optimize it more, but by far my preferred route would be to change the AD WS parameter.
function groupmember ($group)
{
    $groupname = Get-ADGroup $group | Select -expand Name
    ([ADSISearcher]"(&(ObjectClass=Group)(samaccountname=$groupname))").FindOne() |
     % {$_.Properties.member} |
     Get-ADobject | % `
    {
        If ($_.objectclass -eq "group")
        { groupmember $_ }
        Else
        { $_ }
    }
}
Get-Content groups.txt | ForEach `
{
    $group = Get-ADGroup $_ -ErrorAction SilentlyContinue | Select -ExpandProperty Name
    If ($Group)
    {
        groupmember $group |
         Get-ADUser -Properties canonicalname |
         Select @{n="GroupName";e={$group}},Name,Samaccountname,Canonicalname
    }
} | Export-Csv Members.csv -NoTypeInformation

Open in new window

0
 
LVL 40

Expert Comment

by:Subsun
ID: 39726408
Probably need  to add Select * -Unique to get the unique members..
0
 
LVL 2

Author Closing Comment

by:MilesLogan
ID: 39760882
thanks footech ! sorry for the late closing on this .. Holidays and Flu caught up ..
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
This article explains how to install and use the NTBackup utility that comes with Windows Server.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

786 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question