Comments on: Powershell – Recursive Group Membership

By: Prem

Prem — Tue, 16 Aug 2011 20:15:04 +0000

@Mark A. Weaver No Problem Mark. The FSP's come back as SID's. I included some code to convert the SID's to Security group and then use the same function to recurse through it. WOrks well. But got a new problem, this recursive script does not work on large groups having more than 1500 members as the member attribute on them is empty. I believe range retrieval needs to be used...working on it. Thanks for the reply.

By: Mark A. Weaver

Mark A. Weaver — Sat, 13 Aug 2011 00:23:23 +0000

@Prem
I think the FSPs (Foreign Security Principals) come back as just SIDs, no?
Modifying my script would probably be a near rewrite, I think.
I am not sure how the Quest AD Tools snapin would handle them, but it may be best to see how those FSPs come back.
You could use a similar recursive function (one calling itself) to walk the group structure, though.
Let me noodle on this a bit and see if I can come up with something.
– Mark

By: Prem

Prem — Wed, 10 Aug 2011 14:06:26 +0000

Hi Mark – Nice script. I have a requirement where I need to walk through a Domain Local Group which contains trusted domain Global groups as members which are represented as FSPs. Is there a way to walk through such groups and display their members.

By: Dan Caseley

Dan Caseley — Fri, 21 Jan 2011 12:09:02 +0000

Finding a good AD script that doesn’t rely the QAD extensions is pretty tricky. This is a marvellous script, and saved me a lot of effort! Thankyou very very much!

Now if only it de-duped as well…

By: Mark A. Weaver

Mark A. Weaver — Thu, 30 Dec 2010 01:53:39 +0000

Glad you found it useful and many greetings to you too!

– Mark

By: Rafael

Rafael — Wed, 22 Dec 2010 17:08:40 +0000

Cool script, just what I was looking for, you saved me a lot of trouble
Greetings!

By: Mark A. Weaver

Mark A. Weaver — Thu, 22 Jul 2010 20:54:26 +0000

Thanks for the correction. I will update this to force typing on this parameter.
– Mark

By: DK-Stefan

DK-Stefan — Thu, 22 Jul 2010 13:52:47 +0000

There is an error in the script:
…[System.DirectoryServices.PropertyValueCollection] doesn’t contain a method named ‘Split’.

The function Convert-DNtoDNS ($DN) should be function Convert-DNtoDNS ([String]$DN), otherwise PowerShell thinks that the .split on the first line of the function is a method of the System.Dire….bla…bla thingy

By: Mark A. Weaver

Mark A. Weaver — Thu, 24 Jun 2010 14:51:08 +0000

Thanks very much. I hope to be posting more AD-related stuff soon, so stay tuned!
— Mark

By: Chris Clemson

Chris Clemson — Thu, 24 Jun 2010 14:15:28 +0000

Very handy script, and a useful intro to PowerShell, thank you!