Get group members of large groups via Powershell

Get group members of large groups via Powershell
I have always been aware that getting the group membership of large groups has been a challenge and have always managed to avoid addressing the issue.  (Is that what we call the 'Too Hard' pile???) Well, I have had a reason to find this out again, but this time I have Powershell to help me out!

Why is this such an issue I hear you ask...this link expalins why.  In a nut shell, you will only every return a maximum of 1500 members for a group, 1000 if you are querying Windows 2000. 

I cannot take any credit for the soulution, I can only pass on a now ancient (in poweshell terms that is) Monad link to how to enumerate all the members of a group from /\/\o\/\/.  As you will see, this link refers to Monad, the pre-release name for powershell.  Please follow the link above or more from /\/\o\/\/ can be found at thepowershellguy.com

meanwhile, I have added my own comments to his script below...

#get the group
$group = [adsi]("LDAP://CN=groupname,OU=Groups,DC=domain,DC=com")

#set the inital from value
$from = 0

#escape trigger when the $ds.findall() errors
$all = $false

#array for the members of the group
$members = @()


while (! $all) {
   #catch an error and set all to $true to escape
   trap{$script:all = $True;continue}

   #top end of the range so initally 0-999. a Range of 1000 is used to make sure it works on all versions of AD
   $to = $from + 999

   #Query the group object for members using "member;range=$from-$to" to just return the range of objects for this pass.
   #This will generate an error with an invalid range
   $DS = New-Object DirectoryServices.DirectorySearcher($Group,"(objectClass=*)","member;range=$from-$to",'Base')

   #as the variable name for the group name is not member, but member;range=0-999 etc, the $_.PropertyNames -like 'member;*' catches all instances
   $members += $ds.findall() | foreach {$_.properties | foreach {$_.item($_.PropertyNames -like 'member;*')}}

   #set up the next search range
   $from += 1000
}

#dislay the count
$members | measure-object

#dislay the member list
$members

Cheers!