fetch AD groups and members in it

Question

I found a script to fetch AD groups and its members in it. I was working fine but all a sudden it stopped working and gives an error.

List All Groups and Their Members with PowerShell on Win2008r2

$Groups = Get-ADGroup -Properties * -Filter * -SearchBase "OU=Groups,DC=corp,DC=ourcompany,DC=Com" 
Foreach($G In $Groups)
{
    Write-Host $G.Name
    Write-Host "-------------"
    $G.Members
}

Error

Get-ADGroup : The supplied distinguishedName must belong to one of the following partition(s): 'DC=AIA,DC=BIZ , CN=Configuration,DC=AIA,DC=BIZ , CN=Schema,CN=Configuration,DC=AIA,DC=BIZ , DC=ForestDnsZon
es,DC=AIA,DC=BIZ , DC=DomainDnsZones,DC=AIA,DC=BIZ'.
At C:\Users\zai_shanda\Desktop\adgroup.ps1:1 char:22
+ $Groups = Get-ADGroup <<<<  -Properties * -Filter * -SearchBase "AIA.BIZ/AIA/New Zealand/ZAI/Groups/General" 
    + CategoryInfo          : InvalidArgument: (:) [Get-ADGroup], ArgumentException
    + FullyQualifiedErrorId : The supplied distinguishedName must belong to one of the following partition(s): 'DC=AIA,DC=BIZ , CN=Configuration,DC=AIA,DC=BIZ , CN=Schema,CN=Configuration,DC=AIA,DC=BIZ  
   , DC=ForestDnsZones,DC=AIA,DC=BIZ , DC=DomainDnsZones,DC=AIA,DC=BIZ'.,Microsoft.ActiveDirectory.Management.Commands.GetADGroup

can you please help what is wrong?

score 1 · Answer 1 · answered Aug 17 '16 at 07:48

1

Seeing the error you are not using a distuingished name for the searchbase command, you need to replace "AIA.BIZ/AIA/New Zealand/ZAI/Groups/General" With a distinguishedname path. So something like "DC=AIA,DC=BIZ,OU=AIA,OU=New Zealand,OU=ZAI,OU=Groups,OU=General"

Please do note that my DistinguishedName might be wrong and you should check yourself by finding the OU you are basing your searchbase of and copy it directly to make sure you dont get any errors.

answered Aug 17 '16 at 07:48

Jakodns

236
1
6
14

You got that right, but it needs to be in reverse. "OU=General,OU=Groups,OU=ZAI,OU=New Zealand,OU=AIA,DC=AIA,DC=BIZ" . It starts from the inner OU,going up until the domain name , and domain name parts in the end. – Mer Aug 17 '16 at 20:33
@Mer Ah, thanks! Never been good with Distinguished names and always dread using them. I'll edit the answer to reflect it – Jakodns Aug 18 '16 at 05:45
Use single quotes to reduce cycles used to evaluate what's in the double quotes. Single quotes for literal strings. Double quotes for string expressions that need to be evaluated before use. – Jeter-work Aug 24 '16 at 16:24

fetch AD groups and members in it

1 Answers1