Exchange 2007 - Find Distribution Group Memberships Across Domains?
I have a need to enumerate distribution group memberships via script (too time consuming and painful to do by hand). The only problem? We have Exchange 2007, and our AD organizational structure, though hierarchical, simple, and clean, has always caused EMS to be difficult to work with. Our AD is structured as shown below (all domains have direct two-way trust with the TLD.local domain though that should be irrelevant):
TLD.local (Exchange servers here)|---- domain1.TLD.local (Distibution groups are all here)|---- domain2.TLD.local (Some group MEMBERS are here)
All Distribution groups are located in our corporate AD domain. The users for one particular DG are all located in a different domain. Other DGs have mixed members from various domains in our AD forest. The script below is what I have come up with that gets about half of the users I am expecting to see (missing ALL of those outside of domain1.TLD.local).
# Use a list of distribution groups (their SMTP addresses) we have been requested to report on.$list = Get-Content "C:\TEMP\dgroups.txt"# Put the list of found distribution groups (all present in a single domain) into an array.$groups = Foreach ($item in $list) { Get-DistributionGroup $item -DomainController DC-DOMAIN1.domain1.TLD.local }# Actually find group members.$MembershipList = Foreach ( $group in $groups ) { Get-DistributionGroupMember $group -DomainController DC-DOMAIN1.domain1.TLD.local | Select @{Label="Group";Expression={$group.Name}},@{Label="User";Expression={$_.Name}},SamAccountName,PrimarySMTPAddress }$MembershipList | Sort Group,User | Export-CSV "C:\TEMP\dgmembers.csv" -NoTypeInformation
If I change "DC-DOMAIN1.domain1.local" to "DC-DOMAIN2.domain2.local" in either of the above commands, then I either get an error telling me I cannot find my distribution groups (obvious), or I can only find SOME of the members of the groups (those in the same domain as the DG itself). I fail to understand what the "-ReadFromDomainController" parameter is for on the Get-DistributionGroupMember cmdlet in this case, as it appears to have no effect, no matter how I structure my script.
In short, I cannot enumerate complete group memberships using EMS *unless* all of the the MEMBER objects happen to exist on the same domain controller as the DISTRIBUTION GROUP itself. Does anyone have any ideas on how I can modify the above (or use different commands) to get a list of the MEMBERS of various distribution groups, when those MEMBERS may exist in a different AD domain than the GROUP?
My thanks in advance for any assistance.
ExchangeDomain Controller
Last Comment
synaptix
8/22/2022 - Mon
Systech Admin
you can use the Get-DistributionGroup Command to get the details. Refer below link with Script might help you.
Thanks, but that doesn't get me anywhere. Because our Exchange server sits in TLD.local, and our distribution groups reside in domain1.TLD.local, we must use the "-DomainController" parameter with both Get-DistributionGroup and Get-DistributionGroupMember. The problem is this
Exchange server - exists in TLD.local
Sales (distribution group) - exists in domain1.TLD.local
User1 (user / member) - exists in domain2.TLD.local
This returns an error, because Get-DistributionGroupMember, although pointing to the correct domain for MEMBERS, cannot find the group itself because it does not exist in domain2.
The problem appears to be that both EMS commands are expecting everything to be in a single domain. Our distribution groups are all in DOMAIN1, but our users (group members) can exist in any domain.
synaptix
ASKER
Surely I can't be the only Exchange admin with users and distribution groups in different domains. How does everyone else get reports on group memberships across different domains?
https://community.spiceworks.com/scripts/show/1388-export-distribution-list-members
or
http://www.careexchange.in/how-to-export-all-distribution-group-and-all-members-of-it-exchange-2010/