Comments on: Recursively Listing Security Group Members with PowerShell, Version 2

By: Leo

Leo — Thu, 24 Feb 2011 17:27:04 +0000

I’m just now learning how to script because of a forced need at work.

I’m having to perform audits on group membership for active directory groups. I have yet to find a script that works for me to do this but from what i can tell, this is the closest one yet.

I am however, getting the exact same error as mentioned above. I also tried the link that was posted without any success. Has anyone come up with a solution to this yet?

Thanks.

By: Leo

Leo — Thu, 24 Feb 2011 17:20:35 +0000

I’m new to scripting. For my job, I sometimes have to do audits on Domain Group memberships and have been searching for a script that would make this easier for me.

I’m getting the exact same error as mentioned above. Has anyone firgured this out yet?

I’m restricted to PowerShell v1. Could this be part of the cause?

By: Chuck Lathrope

Chuck Lathrope — Thu, 07 Jan 2010 18:57:45 +0000

Check out this ScriptingGuys link: http://gallery.technet.microsoft.com/ScriptCenter/zh-TW/1228cdfa-9c04-4bc7-a016-11b492c704d2

By: Script_newb

Script_newb — Mon, 26 Oct 2009 22:05:18 +0000

Hey Kris,

Any luck on figuring out the enumeration issue.

Thanks.

By: Script_newb

Script_newb — Tue, 20 Oct 2009 22:15:30 +0000

It correctly identifies the object as a user, then attempts to mistakenly recurse the user object as though it were a group.

By: Kristopher Bash

Kristopher Bash — Mon, 19 Oct 2009 23:51:22 +0000

This is interesting. When it lists the members of the parent group does it list:
Group Domain\first.last
or does it list
User Domain\first.last

In short, can you tell if the script is mistaking users for groups when it enumerates them as members, or is it mistakingly trying to enumerate an object that it initially listed as a user? If that makes sense. I tested the script in quite a number of scenarios, but obviously haven’t seen this. I appreciate you bringing this to my attention, and I’m sure the issue is easily fixable, once we figure out what the issue is exactly.

By: Script_newb

Script_newb — Mon, 19 Oct 2009 17:37:58 +0000

Hey Kris.

Thanks for the updated script. It now correctly enumerates groups in AD.

I have run into another small issue with the script.

When I run the script on certain groups, using 3 levels or more of recursion I get this error. ( I have changed the domain\user info for security reasons.)

Members of the Group: OMAIN\first.last
———————————————–
Exception calling “Invoke” with “2″ argument(s): “The network path was not found.
”
At C:\listusers-1.ps1:64 char:36
+ $Members = @($Group.psbase.Invoke <<<< ("Members"))
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : DotNetMethodException

Essentially what happens is that in one of the nested groups, the script will run against the user accounts in the group, it parses the domain\username but drops the first letter of the domain name, reading them as though they were groups and try to enumerate the user account. The above error is the result. The script will try all members of one group and then move on per normal.

* I removed the 'D' intentionally from the 'DOMAIN' to show you what the script does as it parses the name.

Any ideas are welcome.

Thanks.