locked
Getting Get-ADGroupMember to display descriptions in an multi domain environment RRS feed

  • Question

  • Hi,

    I'm building a script to automate audit's. One part is to list users in groups which works fine in my local domain:

    PS C:\scripts> Get-ADGroupMember "Domain Admins" | Select-Object -Property Name,@{name="Description";expression={(Get-ADUser -Identity $_.SamAccountName -Properties Description).Description}}

    Name                                                        Description
    ----                                                        -----------
    UK Operator                                                 Account used for Network Scheduled Tasks
    SCCM 2012                                                   ER: 70145
    uklhsccm2012
    uklecsccm2012
    AGAdmin                                                     Admin account for Aljay De Guzman (USOffice) - ER:86190
    SvcAccountz                                                 Domain Server Service Accounts
    ESAdmin                                                     Admin Account for Eric Smith (USOffice) - ER: 40663
    SQL Service Account                                         Runs the SQL Agent and MSSQL Services
    LDAdmin                                                     Admin Account for Lyle Davis (CANADA) - ER: 40663
    LMAdmin                                                     Admin Account for Lionel Marechal (ER:47674)
    Backup Services                                             Backup Services Account (Veeam)
    JPAdmin                                                     Admin Account for Julian Powell (ER:92870)

    But when I try this on another domain I can't get the descriptions to be displayed:

    PS C:\scripts> Get-ADGroupMember -Server usoffice.xxx.local -Credential usoffice\adminjp -Identity "CN=US-IS-Application-Support,OU=GlobalGroups,OU=Groups,DC=usoffice,DC=xxx,DC=local" | Select-Object -PropertyName,@{name="Description";expression={(Get-ADUser -Identity $_.SamAccountName -Properties Description).Description}}

    Name                                                        Description
    ----                                                        -----------
    Greta Deal
    Pia Mason
    Beth Haden
    webappsvc
    Tim Vatne
    Prathima Anumolu

    The command works on a machine that is within that domain but I can't figure out way I can't do this from my current domain. Spent far to long on this one :).



    • Edited by Julian99 Wednesday, April 11, 2018 2:35 PM
    Wednesday, April 11, 2018 2:33 PM

Answers

  • Hi,

    This one might be easier:
    Get-ADGroupMember -Identity 'Domain Admins' -Server usoffice.xxx.local | Get-ADUser -Properties Description | Select-Object Name, Description

    If you need further help, please feel free to let us know.

    Best Regards,
    Albert

    Please remember to mark the replies as an answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    • Marked as answer by Julian99 Thursday, April 12, 2018 8:12 AM
    Thursday, April 12, 2018 2:29 AM

All replies

  • Perhaps use the -Server parameter of Get-ADUser to specify the DC in the other domain, as you did with the Get-ADGroupMember cmdlet.

    Richard Mueller - MVP Enterprise Mobility (Identity and Access)

    Wednesday, April 11, 2018 2:37 PM
  • Hi,

    This one might be easier:
    Get-ADGroupMember -Identity 'Domain Admins' -Server usoffice.xxx.local | Get-ADUser -Properties Description | Select-Object Name, Description

    If you need further help, please feel free to let us know.

    Best Regards,
    Albert

    Please remember to mark the replies as an answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    • Marked as answer by Julian99 Thursday, April 12, 2018 8:12 AM
    Thursday, April 12, 2018 2:29 AM
  • Many thanks for your answer, worked a charm
    Thursday, April 12, 2018 8:13 AM