5

I've been tasked with exporting the members of a few AD groups to .csv which I've always done in the past using the Get-ADGroupMember command in powershell, specifying the group name, selecting the property I need, and using export-csv.
I seem to run into an issue with one group though which appears to be related to the fact that the AD group has members that belong to an external domain in a different forest. Essentially I run the following command below, but the output file comes out blank.

Get-ADGroupMember -identity "VPN Users" | select name | Export-csv -path c:\vpnuserslist.csv -NoTypeInformation

The output is the following:

PS C:\Windows> Get-ADGroupMember -identity "VPN Users" | select name | Export-Csv -Path c:\vpnuserstest.csv -NoTypeInformation

Get-ADGroupMember : The operation completed successfully

At line:1 char:18

+ Get-ADGroupMember <<<<  -identity "VPN Users" | select name | Export-Csv -Path c:\vpnuserstest.csv -NoTypeInformation
    + CategoryInfo          : NotSpecified: (VPN Users:ADGroup) [Get-ADGroupMember], ADException
    + FullyQualifiedErrorId : The operation completed successfully,Microsoft.ActiveDirectory.Management.Commands.GetADGroupMember

I also noticed that when going to the group in Active Directory Users and Computers, I receive a message:

Active Directory Domain Services

Some of the object names cannot be shown in their user-friendly form. This can happen if the object is from an external domain and that domain is not available to translate the object's name.

Is there any way I can get the members successfully exported, regardless of if a few names aren't formatted properly, etc...? Thanks in advance for the help!

JosefZ
  • 1,514
  • 1
  • 10
  • 18
NoobAdmin
  • 51
  • 1
  • 1
  • 2
  • 1
    are your [global catalogs](https://technet.microsoft.com/en-us/library/cc977998.aspx) available from where you are running the query? – the-wabbit Sep 11 '15 at 20:40
  • If a user in the source domain was deleted, that may result in a SID that can no longer be translated for the other domains group members. Do you have any S-1-5... "names" shown in the GUI member list? If so, removing that SID is probably safe, and removing it may resolve your problem. – Clayton Sep 14 '15 at 15:22

1 Answers1

3

I found using get-adgroup -properties member to be more reliable for returning all objects.

To get objects from different domains I do the following:

get-adgroup -properties member | select -expand member | get-adobject

From this get the distinguished name of the object, this will tell you what domain to search, so in the end you should have something like:

get-aduser $user -server $foundDomainDC
smwk
  • 570
  • 2
  • 4
  • 14