Get-ADUser 和嵌套组问题

Question

When I run the command below on a nested group, I get the error below.

$properties = 'SamAccountName','GivenName'
(Get-ADGroup -identity $group -properties members).members | Get-ADUser -property $properties | select-object $properties

The setup is such that $group is a parent of all other groups, for example $group = 'All_USA', there are other groups all under $group such as NY_Group and TX_Group to name a few.

Get-ADUSer cannot find object with identity 'CN=DG NY_Group,OU=Messaging...

This issue only happens where the group is a parent group which has other child groups inside it.

Answer 1

The members from Get-ADGroup can also be other groups or computer objects, not only users.

Try

Get-ADGroupMember -Identity $group -Recursive |
    Where-Object { $_.objectClass -eq 'user' } |
    Get-ADUser |
    Select-Object SamAccountName, GivenName

You may want to add switch -Unique to the Select-Object cmdlet so you don't listy users that were found in nested groups aswell.

^{'SamAccountName' and 'GivenName' properties are returned by default with Get-ADUser}