Wikis - Page Details

First published by Justin Hall MSFT (eMicrosof)
When: 16 Nov 2010 8:30 AM
Last revision by Yagmoth555 (eMicrosoft Community Contributor, Microsoft Partne)
When: 31 May 2012 5:55 PM
Revisions: 8
Comments: 6

Options

Can You Improve This Article?

Positively! Click Sign In to add the tip, solution, correction or comment that will help other users.

Report inappropriate content using these instructions.

How to List Active Directory Group Members (dsforum2wiki)

Here are a few different ways to list members of an Active Directory group:

Using built-in Active Directory command-line tools

Following command will provide you first name and last name of member of a group:

dsquery group domainroot -name groupname | dsget group -members | dsget user -fn -ln
Using a filter

The following filter returns the members of a specific group.
You have to specify the groups distinguishedName.

ldifde -f groupMembers.txt -r "(&(objectClass=User)(memberOf=CN=myGroup,OU=MyContainer,DC=myOrg,DC=local))" -l "sAMAccountName,givenName,sn"
Using Adfind (Adfind is a free tool that you can download from www.joeware.net/freetools/tools/adfind/index.htm)

TO RETRIEVE THE DN OF THE GROUP

adfind -default -f "(&(objectCategory=group)(name=<GROUPNAME>))" -dsq

or

adfind -default -f "(&(objectCategory=group)(name=<GROUPNAME>))" -dn

TO RETRIEVE THE PROPERTIES (givenName=firstname, sn=surname sAMAccountName, pre-w2k logon name, description=description, cn=full name, displayName=displayname) OF THE MEMBERS OF THE GROUP

adfind -b "<DN of group>" -asq member givenName sn sAMAccountName description cn displayName
Use PowerShell with free Quest AD Cmdlets (http://www.quest.com/powershell/activeroles-server.aspx), with the following one-liner query.

                          Get-QADGroupMember GROUPNAME

               You may also use the -indirect switch to retrieve the nested group membership.

                          Get-QADGroupMember GROUPNAME -indirect

              Conversely, you may also look up the user's direct and indirect group membership with
              the Get-QADMemberOf cmdlet.

                            Get-QADMemberOf USERNAME

                            Get-QADMemberOf USERNAME -indirect

          5.    Using PowerShell with native AD Cmdlets i.e ADWS/ADMGS
                 (http://technet.microsoft.com/en-us/library/dd378937%28WS.10%29.aspx)

                             Get-ADGroup GROUPNAME -properties members

                 For #4 and #5 above, use built-in help to learn more about the Cmdlets and the available syntaxes

                  for e.g Help Get-ADGroup -full