Domain Users is the Primary Group only by default, it can be changed. I have been known to change it when I want to give an outside vendor access to specific resources, but not to everything that Domain Users has rights to. There might be some reason to change primary group, but still have a user be a member of domain users. I can't think of one off the top of my head, but I'm sure it exists. Unfortunately I can't give a better answer because dsget group "CN=Domain Users,CN=Users,DC=blah,DC=com" does not work, the membership of Domain Users does not appear to be backlinked, at least with DFL=2003 FFL=2000.
Thanks, Andrew Fidel Michael B Allen <[EMAIL PROTECTED]> Sent by: [EMAIL PROTECTED] 01/02/2007 02:17 PM Please respond to ActiveDir@mail.activedir.org To ActiveDir@mail.activedir.org cc [EMAIL PROTECTED] Subject Re: [ActiveDir] how to get ALL users in "Domain Users" On Tue, 2 Jan 2007 11:34:31 -0600 "Thommes, Michael M." <[EMAIL PROTECTED]> wrote: > I am trying to get a list of all of the users in the builtin group > "Domain Users". I am using the following commands, but get incomplete > results. Can someone tell me why? Thanks! And Happy New Year to > everyone! > > > > dsquery group -name "domain users" | dsget group -members > > c:\temp\domain_users.txt Domain Users is the primary group for all users so maintaining a membership list is redundant. Simply enumerate all users (or perhaps filter on primaryGroupID 513). dsquery * -filter (primaryGroupID=513) Mike -- Michael B Allen PHP Active Directory SSO http://www.ioplex.com/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx
