跨域Get-AdPrincipalGroupMembership是否需要最小权限？

Question

Forest 1

Parent Domain A

|___Child Domain A

Forest 2

Parent Domain B

Two Way trust between Forest 1 Child Domain A and Forest 2 Parent Domain B

User is in Parent Domain B

Group is in Child Domain A

Credentials are in Child Domain A

Get-ADPrincipalGroupMembership -Identity 'Parent Domain B User' -server 'Parent Domain B DC' -ResourceContextServer 'Child Domain A DC' -Credential 'Child Domain A User Creds'

This returns the following error:

Get-ADPrincipalGroupMembership : An operations error occurred

I can't figure out which domain the credentials need to be in and what the minimum permissions needed are.

Answer 1

"An operations error occurred" usually indicates that some of the inputs you have given are wrong. It does not indicate a permissions issue.

I tried it in our environment since we do have a similar setup, and I was able to run the command without error.

For 'Parent Domain B User' I used only the sAMAccountName , and for the two DC's, I used the DNS names of the domains. You should need to specify exact DCs - just the domain names.

Get-ADPrincipalGroupMembership -Identity 'username' -server 'domain1.com' -ResourceContextServer 'domain2.com'