Some groups show no members in Get-ADGroup

so have question strange powershell behavior get-adgroup. if use on group created, can members fine. on (not all) built in groups, including domain users, returns nothing. see:

ps c:\> get-adgroup -filter * -properties * | {$_.name -eq "iron throne"} | select -expandproperty members  cn=robert,ou=baratheons,dc=seven-kingdoms,dc=local  cn=daenerys,ou=targaryens,dc=seven-kingdoms,dc=local  cn=margaery,ou=tyrells,dc=seven-kingdoms,dc=local  cn=joffrey,ou=baratheons,dc=seven-kingdoms,dc=local  cn=cersei lannister,ou=lannisters,dc=seven-kingdoms,dc=local    ps c:\> get-adgroup -filter * -properties * | {$_.name -eq "domain users"} | select -expandproperty members    ps c:\> 

they show fine in active directory users , computers. on win2012r2 dc administrator. knows why?

if interested, "primary" group membership in ad determined primarygrouptoken attribute of group object, , primarygroupid attribute of user (or computer) object. powershell get-adgroup , aduc not reveal value of primarygrouptoken attribute because operational (also called constructed). integer, equal last digits (after final dash) in value of sid property (or objectsid attribute in attribute editor). or can retrieve value using dsquery *. user object has attribute primarygroupid, integer. value matches primarygrouptoken attribute of group user has designated "primary".

the primarygrouptoken of "domain users" 513, , "domain computers 515 (because rid values "well-known"). if need check "primary" group of user, retrieve value of primarygroupid attribute. if value 513, "primary" group of user "domain users". same computer objects , if primarygroupid equals 515, "primary" group "domain computers".

to find users have "domain users" "primary" group, use:

get-aduser -ldapfilter "(primarygroupid=513)" | select distinguishedname

to check individual user:

get-aduser -identity jsmith -properties primarygroupid | select name, primarygroupid

unfortunately, cannot filter on primarygrouptoken because operational. special code techniques required find group has given value assigned primarygrouptoken attribute. following isn't efficient (since retrieve groups), works find group primarygrouptoken 514:

get-adgroup -filter * | where-object {$_.sid -like "*-514"}

result "domain guests", has well-known rid.

---

richard mueller - mvp directory services

Windows Server  >  Windows PowerShell