Using DSQUERY to get the members of a Group in AD

Can anyone give the the correct syntax (if it exists) to use the DSQUERY
command line tool to query the members of a specific group in AD? I have
tried many combonations and I cant seem to figure it out. I tried:

dsquery user OU=xxx, DC=yyy,DC=ZZZ

but I don't know what should go after that. I also tried the dsquery group
method with no luck. Does anyone know the correct way??

Thanks!

Bob Randall

C:\>dsget group "CN=GroupName,DC=domain-name,DC=com" -members

If you need to specify a server and/ or credentials, append the following on
the end:

-s dc01 -u userName -p *


--
Paul Williams

http://www.msresource.net/
http://forums.msresource.net/

Perfect - thanks a lot!

"ptwilliams" wrote:

> C:\>dsget group "CN=GroupName,DC=domain-name,DC=com" -members
>
> If you need to specify a server and/ or credentials, append the following on
> the end:
>
> -s dc01 -u userName -p *
>
>
> --
> Paul Williams
>
> http://www.msresource.net/
> http://forums.msresource.net/
>

No problem! :-)

--
Paul Williams

http://www.msresource.net/
http://forums.msresource.net/

I am trying the same thing but I keep getting this error:

dsget failed:A referral was returned from the server.

Any ideas what this is?

"ptwilliams" wrote:

> No problem! :-)
>
> --
> Paul Williams
>
> http://www.msresource.net/
> http://forums.msresource.net/
>
>
>

What command are you typing?

--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net

dsget group "CN=Group,CN=users,DC=domain,DC=ca" -members

"Paul Williams [MVP]" wrote:

> What command are you typing?
>
> --
> Paul Williams
> Microsoft MVP - Windows Server - Directory Services
> http://www.msresource.net | http://forums.msresource.net
>
>
>

We are running AD (2003) in native mode and Exchange 2003 in mixed mode with
2 Exch 5.5 servers. It is a simple single domain forest with about 2000
users.

Not sure what else may help?

Thanks,

Mike

"Paul Williams [MVP]" wrote:

> I don't understand that. DSGET will chase referrals. I just used that same
> command to output the members of a group in the root domain from a child
> domain.
>
> What else can you tell me about your environment?
>
> --
> Paul Williams
> Microsoft MVP - Windows Server - Directory Services
> http://www.msresource.net | http://forums.msresource.net
>
>
>

Weird. I can't see why that command won't work. Unless the domain you are
using is different to your DNS domain?

Try the same thing with adfind (download from www.joeware.net)

adfind -b cn=group,cn=users,dc=domain-name,dc=com member -nodn

--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net

I get that with scripts that enumerate object in AD when I run the script
logged on to a domain different from that I'm trying to search. Try it first
making sure you're logged on to the domain you're searching and you might
have it work doing the command as a batch file and doing "run as" and
specifying creds in the search domain.

"Paul Williams [MVP]" wrote:

> Weird. I can't see why that command won't work. Unless the domain you are
> using is different to your DNS domain?
>
> Try the same thing with adfind (download from www.joeware.net)
>
> adfind -b cn=group,cn=users,dc=domain-name,dc=com member -nodn
>
> --
> Paul Williams
> Microsoft MVP - Windows Server - Directory Services
> http://www.msresource.net | http://forums.msresource.net
>
>
>