Skip to main content

Get group members of large groups via Powershell

Get group members of large groups via Powershell
I have always been aware that getting the group membership of large groups has been a challenge and have always managed to avoid addressing the issue.  (Is that what we call the 'Too Hard' pile???) Well, I have had a reason to find this out again, but this time I have Powershell to help me out!

Why is this such an issue I hear you ask...this link expalins why.  In a nut shell, you will only every return a maximum of 1500 members for a group, 1000 if you are querying Windows 2000. 

I cannot take any credit for the soulution, I can only pass on a now ancient (in poweshell terms that is) Monad link to how to enumerate all the members of a group from /\/\o\/\/.  As you will see, this link refers to Monad, the pre-release name for powershell.  Please follow the link above or more from /\/\o\/\/ can be found at

meanwhile, I have added my own comments to his script below...

#get the group
$group = [adsi]("LDAP://CN=groupname,OU=Groups,DC=domain,DC=com")

#set the inital from value
$from = 0

#escape trigger when the $ds.findall() errors
$all = $false

#array for the members of the group
$members = @()

while (! $all) {
   #catch an error and set all to $true to escape
   trap{$script:all = $True;continue}

   #top end of the range so initally 0-999. a Range of 1000 is used to make sure it works on all versions of AD
   $to = $from + 999

   #Query the group object for members using "member;range=$from-$to" to just return the range of objects for this pass.
   #This will generate an error with an invalid range
   $DS = New-Object DirectoryServices.DirectorySearcher($Group,"(objectClass=*)","member;range=$from-$to",'Base')

   #as the variable name for the group name is not member, but member;range=0-999 etc, the $_.PropertyNames -like 'member;*' catches all instances
   $members += $ds.findall() | foreach {$ | foreach {$_.item($_.PropertyNames -like 'member;*')}}

   #set up the next search range
   $from += 1000

#dislay the count
$members | measure-object

#dislay the member list



Popular posts from this blog

PowerShell 3 behavioural change

It's taken me way too long to get into PowerShell 3, I guess opportunity hasn't shown it's self until now and so, here, my V3 journey begins.

I was asked to debug a script that would run fine in PS v2 and not in v3.  The issue was a that a variable length was being checked and was failing in v3.  This is why...

In v2 if a variable is undefined, this test returns false

PS C:\windows\system32> $var.length -eq 0

In v3 the same test returns true....

PS C:\windows\system32> $var.length -eq 0

Not a biggie, but as in this case, a script has broken so something to consider!



Enable Powershell Remoting (WinRM) via Group Policy

I have been doing some testing on enabling WinRM via group policy, being that WinRM is the service that Powershell v2 sets up it remoting capabilities. Here are the GPO settings that you need to configure WinRM ....

set the winrm service to auto start

Computer Configuration \ Policies \ Windows Settings \ Security Settings \ System Services

Windows Remote Management (WS-Management)  set Startup Mode to Automatic

start the service

incorporated in to the above - you may need a restart.

create a winrm listener

Computer Configuration / Policies / Administrative Templates / Windows Components / Windows Remote Management (WinRM) / WinRM Service / Allow automatic configuration of listeners

IPv4 filter: *

* is listen on all addresses, or if you only want a particular IP address to respond use an iprange eg - don't forget that this IP range has to be valid for all hosts that fall in the scope of the GPO you are creating.  You can use -, - …

compare-object in Powershell - comparing mulitple values

I'm starting to use compare-object more and more, and one thing I noticed, is that you can compare 2 objects based on multiple attributes. here is how it is constructed...
Compare-Object -ReferenceObject $object1 -DifferenceObject $object2 -Property a,b,c,d,eIf a,b,c and d are the same, but e is different, compare object will return a difference. In the following example, I use "-eq $null" as a check because by default compare-object returns $null if the objects are the same.
#create an array of objects to check against

$collection = @()
foreach ($entry in ("aaaaa","bbbbb","ccccc","ddddd")){
   $store = "" | select "a","b","c","d","e"
   $store.a = $entry*1
   $store.b = $entry*2
   $store.c = $entry*3
   $store.d = $entry*4
   $store.e = $entry*5
   $collection += $store

#create an object similar to those in the array
$object = "" | select "a","b…