Active Directory Querying with PowerShell

Question

I am building a report on our active directory groups and am having a hard time when it comes to different forests.

We have groups from forestA with users inside from forestB. I was able to pull those groups using Quest AD:

 $GroupUsers = Get-QADGroupMember $GroupName -Type 'user' -Indirect

The only problem is that even though the users inside are from forest B, they come up showing they are from forestA. They do exist in both forests, don't know if that's a problem.

Any clue on why this happens?

Thanks in advance.

Can you use Powershell AD module bundled with Windows? Maybe that one doesn't have these issues. Just in case. — Vesper
– Vesper, Commented May 29, 2017 at 15:23
I tried but with the windows module I couldn't even find the group of a different forest. — ranbo
– ranbo, Commented May 29, 2017 at 15:29

Igor · Accepted Answer · 2017-05-29 17:07:28Z

1

There is -Server parameter of Get-ADGroupMember cmdlet where you may specify domain controller from another domain/forest. Something like:

Get-ADGroupMember -Identity $GroupName -Server DC.AnotherDomain.com

answered May 29, 2017 at 17:07

Igor

1,4551 gold badge16 silver badges27 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

ranbo Over a year ago

Whenever I use this parameter I get the same error: Unable to contact the server. This may be because this server does not exist, it is currently down, o r it does not have the Active Directory Web Services running. Which is funny because I can connect using the QAD-getmember

Igor Over a year ago

Hm, you need to identify domain controller in that other forest. I don't see any other way for Quest to get that info, except from domain services in another forest. Try running this Get-ADDomainController -DomainName AnotherDomain.com and then query server which is returned.

ranbo Over a year ago

all I get is this: Domain : ttbb.bb-group.com Forest : bb-group.com HostName : {ttao10p00053.ttbb.bb-group.com} IPv4Address : 199.xx.xx.28 IPv6Address : Name : TTAO10P00053 Site : TAO01 But querying with this information doesn't work to

gsky · Accepted Answer · 2017-05-30 10:14:25Z

0

you can query forest for domains or all global catalogs: get-adforest (properties GlobalCatalogs,Domains) - I often did something like this: I pulled the list of all SIDs in the group then checked which one belongs to my domain/forest, the rest was searched in external forest.

answered May 30, 2017 at 10:14

gsky

1115 bronze badges

Collectives™ on Stack Overflow

Active Directory Querying with PowerShell

2 Answers 2

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related