Table of Content > Extended Handling of AD Objects > LDAP Search Factory > How to find all members of an Active Directory group

How to find all members of an Active Directory group

In Active Directory Scripts the members of a group are searched often by binding to the regarding group object and evaluating it's API property members or LDAP attribute member - or by evaluating the 'opposite' user attribute memberOf. However, this is not exactly the same, because group memberships can be implemented not only through this attribute pair, but also in the form of 'primary groups', this is set in the user attribute primaryGroupID. So the actual group membership of a directory object consists always of two attributes! The mentioned property of the primary group is actually only needed if Mac or Posix clients log onto the domain.

By default, for new users the primary group property is set to 'domain users', so it is often not important that this group membership is missing in the basic evaluation of the member values. However, if other groups are registered as a primary group, this traditional way of membership evaluation is not accurate enough! Therefore, this article describes next to the qick-and-dirty method also how to determine a complete list of the members of a group.

To find the members of a group, we must first identify the full LDAP Distinguished Name (DN) of the regarding group object. The necessary steps for this are described in detail in the SelfADSI article 'Name Translation: How to identify the LDAP path of a user'.

For the actual search, we use the Active Directory memberOf attribute with an appropriate LDAP filter. To really find all users that you have to pay attention to the attribute primaryGroupID also. This is the relative ID (RID) of the primary group for that user - and this primary group doesn't appears in the memberOf attribute list! Fortunately, you don't have to perform a complete SID evaluation and calculation (SelfADSI article 'Microsoft Security Descriptor (SID) attributes') - you can search for the appropriate primaryGroupToken attribute of that group instead. By the way: This attribute is an operational attribute and must be requested explicitly when reading the group object.

Search Group Members - quick and dirty

First, we consider a script that evaluates the membership on the basis of a given group distinguished name (DN), the property "Primary group" is ignored - in many cases a complete list of group members can be obtained:

Download Script

Search Group Members in the own Domain

And now the careful method involving the primary group membership. This script finds all members of a group in the domain in which the current user (which the script is running) is a member. It also assumes that only the group name itself and not the distinguished name is known:

Download Script

Search Group Members in the entire Forest

This script finds all members of a group in the entire forest in which the current user (which the script is running) is a member. The group itself has to be in the same domain as the user who runs this script. We have to do two separate searches for memberOf (performed in the entire forest) and primaryGroupID (only in the own domain). The primary group of a user must in fact always be a group of its own domain.

Download Script

Gruppenmitglieder suchen in einem fremden Forest (mit Anmeldung)

This script finds all members of a specified group in the entire forest. Use the matching data for your desired Forest, or the domain where the regarding group. For this search, we need a global catalog server which is DC for the domain where the group is located. You could also use other credentials for the search (username and password):

Download Script