It's weird - I don't see that we have tons and tons of nested groups. I've found out that in this domain most users I've tried aren't returning any groups except for domain users, even though they are in other groups. But I've tried against other user objects (domain administrator accounts) and they do return groups. But those are all built-in groups - I'm going to have to try to add one of those users to a different group and see if it shows up.
On Mon, Apr 24, 2017 at 3:12 PM, Michael B. Smith <[email protected]> wrote: > Try this out: > > > > http://theessentialexchange.com/blogs/michael/archive/ > 2012/05/04/processing-large-and-embedded-groups-in-powershell.aspx > > > > > > *From:* [email protected] [mailto:listsadmin@lists. > myitforum.com] *On Behalf Of *Russ > *Sent:* Monday, April 24, 2017 5:32 PM > *To:* [email protected] > *Subject:* [NTSysADM] Get group membership through powershell > > > > I've often used powershell to get the groups that a user is a member of by > using get-adprincipalgroupmembership. It's always worked to my > knowledge. > > > > However, I've found one group which doesn't show up for anyone - so I was > curious if anyone has run into this before. If I run get-adgroupmember for > the group, everyone shows up who should be there, but if I try to run the > reverse on any of the users who are a member of the group, it doesn't show > up - it just returns "domain users". > > > > If I try get-aduser with -properties "memberof", nothing shows up for that > property at all. (not even domain users, but I think that's normal?). > > > > If you go into ADUC and look up the user, the two groups (this one, and > domain users) show up just fine. > > > > Does anyone know of a circumstance why this wouldn't return a value? >
