Link to home
Start Free TrialLog in
Avatar of namerg
namergFlag for United States of America

asked on

How to export members from Domain Local Security group ?

This "COMPANY-RDSPortal-TSUsers-LGRP"  has more than 100 internal users, groups and from other domains.
I have the followin line
(Get-ADGroup "COMPANY-RDSPortal-TSUsers-LGRP" -Properties *).members

Open in new window

after execution i get whole records but in this format:
CN=Lastname\, Firstname,OU=organizationunit,OU=organizationunit,DC=domain,DC=local

Open in new window


I do not want that pattern, i want just the name.

Thanks for your help,
Avatar of Chris Dent
Chris Dent
Flag of United Kingdom of Great Britain and Northern Ireland image

Use Get-ADGroupMember instead.
Get-ADGroupMember group | Select-Object -ExpandProperty Name

Open in new window

Or
(Get-ADGroupMember group).Name

Open in new window

Avatar of namerg

ASKER

Nada

PS C:\scripts> Get-ADGroupMember COMPANY-RDSPortal-TSUsers-LGRP | Select-Object -ExpandProperty Name
Get-ADGroupMember : An unspecified error has occurred
At line:1 char:1
+ Get-ADGroupMember COMPANY-RDSPortal-TSUsers-LGRP | Select-Object -ExpandProperty Nam ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (COMPANY-RDSPortal-TSUsers-LGRP:ADGroup) [Get-ADGroupMember], ADException
    + FullyQualifiedErrorId : ActiveDirectoryServer:0,Microsoft.ActiveDirectory.Management.Commands.GetADGroupMember

PS C:\scripts> Get-ADGroupMember (COMPANY-RDSPortal-TSUsers-LGRP).Name
COMPANY-RDSPortal-TSUsers-LGRP : The term 'COMPANY-RDSPortal-TSUsers-LGRP' is not recognized as the name of a cmdlet, function, script file, or operable prog
verify that the path is correct and try again.
At line:1 char:20
+ Get-ADGroupMember (COMPANY-RDSPortal-TSUsers-LGRP).Name
+                    ~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (COMPANY-RDSPortal-TSUsers-LGRP:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

Open in new window

Apologies... Mobile posting. The group name should be in quotes.
Avatar of namerg

ASKER

same thing

PS C:\scripts> Get-ADGroupMember "COMPANY-RDSPortal-TSUsers-LGRP" | Select-Object -ExpandProperty Name
Get-ADGroupMember : An unspecified error has occurred
At line:1 char:1
+ Get-ADGroupMember "COMPANY-RDSPortal-TSUsers-LGRP" | Select-Object -ExpandProperty N ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (COMPANY-RDSPortal-TSUsers-LGRP:ADGroup) [Get-ADGroupMember], ADException
    + FullyQualifiedErrorId : ActiveDirectoryServer:0,Microsoft.ActiveDirectory.Management.Commands.GetADGroupMember
Bleh, no reason for that to fail. Two more ways.
Get-ADGroup "COMPANY-RDSPortal-TSUsers-LGRP" | Get-ADGroupMember | Select-Object -ExpandProperty Name

Open in new window

And
$groupDN = (Get-ADGroup "COMPANY-RDSPortal-TSUsers-LGRP").DistinguishedName
Get-ADUser -Filter { memberOf -eq $groupDN } | Select-Object -ExpandProperty Name

Open in new window

Avatar of namerg

ASKER

It worked the second one but inconsistent results, remember that group contains internal users, groups and external people. If you open AD and through the Attribute Editor tab and select Member then the other window comes up...see attachment
Capture00.PNG
That's likely because our second search is limited to user objects. If you need everything, and Get-ADGroupMember isn't playing we can try this one:
$groupDN = (Get-ADGroup "COMPANY-RDSPortal-TSUsers-LGRP").DistinguishedName
Get-ADObject -Filter { memberOf -eq $groupDN } | Select-Object -ExpandProperty Name

Open in new window

MemberOf is back-linked to the member attribute so the two searches are mostly the same thing (mostly because not everything has memberOf, even if it can be a member, edge cases).

We can also drop all the way back to your original and adapt that one and ensure we have exactly the same thing.
(Get-ADGroup "COMPANY-RDSPortal-TSUsers-LGRP" -Properties *).members | ForEach-Object {
    $DN = $_.DistinguishedName
    Get-ADObject -Filter { DistinguishedName -eq $DN }
} | Select-Object -ExpandProperty Name

Open in new window

It's a bit longer, that really wouldn't have worked on my mobile :)
Avatar of namerg

ASKER

Hmm, i like the first one. How do i sort the list ? "| Sort Name" did not work.

$groupDN = (Get-ADGroup "COMPANY-RDSPortal-TSUsers-LGRP").DistinguishedName
Get-ADObject -Filter { memberOf -eq $groupDN } | Select-Object -ExpandProperty Name

Open in new window

ASKER CERTIFIED SOLUTION
Avatar of Chris Dent
Chris Dent
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of namerg

ASKER

Bingo. Thank you sir