Results 1 to 4 of 4

Thread: Dsget group members SID

  1. #1
    Jeremy Smith Guest

    Dsget group members SID

    When I run Dsget on a group to get is members, all of the users that
    are from a trusted domain show as SIDs. I like to get the disaply
    name like I do for users that are local to the domain. If I pull the
    group up in AD users and Computers it auto resolves the name for the
    trusted domain. Only thought I have is to connect to the trusted
    domain and resolve the SID to the name. Any thoughts on what I can do
    that my be easier?

    Thanks

  2. #2
    JPolicelli [MVP-DS] Guest

    Re: Dsget group members SID

    Each time an object from a trusted domain is added to an AD group in your
    domain, a foreign security principal is created in the
    ForeignSecurityPrincipal container in the trusting domain.

    I ran into the same issue a few years back. I was able to get around it by
    dumping the SIDs to a text file, and then using that text file to search for
    the SIDs in the Foreign Security Principal container.

    I suggest you dump the SIDs to a text file, and then use the For command to
    loop through that text file to run ADFind. You can use the SID as the filter
    in AD Find. For example,

    For /f "delims=&" %I in (List.txt) do Adfind -b dc=domain,dc=com -f
    "objectSid=%I" displayName -csv

    I have to admit that it was a few years back that I had to do this, so I am
    going by memory. If you cannot get it to work, let me know and I will bring
    up a VM and find out what I did to get it to work in the past.

    --

    JPolicelli, MVP - Directory Services

    This posting is provided AS IS with no warranties and confers no rights.
    Always plan and test.

    http://johnpolicelli.wordpress.com/
    ----
    "Jeremy Smith" <godtoall@hotmail.com> wrote in message
    news:c8670d93-57b9-4a0a-827b-6d413b7bc016@x14g2000yqk.googlegroups.com...
    > When I run Dsget on a group to get is members, all of the users that
    > are from a trusted domain show as SIDs. I like to get the disaply
    > name like I do for users that are local to the domain. If I pull the
    > group up in AD users and Computers it auto resolves the name for the
    > trusted domain. Only thought I have is to connect to the trusted
    > domain and resolve the SID to the name. Any thoughts on what I can do
    > that my be easier?
    >
    > Thanks



  3. #3
    Marcin Guest

    Re: Dsget group members SID

    Jeremy,
    what syntax are you using? dsget group with the -members switch seems to be
    working for me. Alternatively, you might want to pipe the output to the
    dsget user command to extract whatever parameters you might need...

    hth
    Marcin


    "Jeremy Smith" <godtoall@hotmail.com> wrote in message
    news:c8670d93-57b9-4a0a-827b-6d413b7bc016@x14g2000yqk.googlegroups.com...
    > When I run Dsget on a group to get is members, all of the users that
    > are from a trusted domain show as SIDs. I like to get the disaply
    > name like I do for users that are local to the domain. If I pull the
    > group up in AD users and Computers it auto resolves the name for the
    > trusted domain. Only thought I have is to connect to the trusted
    > domain and resolve the SID to the name. Any thoughts on what I can do
    > that my be easier?
    >
    > Thanks




  4. #4
    Marcin Guest

    Re: Dsget group members SID

    Jeremy,
    to clarify, this works for domains within the same forest. If your trusted
    domain is part of a separate forest, this approach will not work. You can
    use the workaround described by John in his post - or, if you have at least
    one Windows Server 2008 Domain Controller, you can query for the value of
    msDS-PrincipalName attribute (adfind from joeware.net would be able to
    extract this info for you)...

    hth
    Marcin

    "Marcin" <marcin@community.nospam> wrote in message
    news:uO$xbPDTJHA.1184@TK2MSFTNGP03.phx.gbl...
    > Jeremy,
    > what syntax are you using? dsget group with the -members switch seems to
    > be working for me. Alternatively, you might want to pipe the output to the
    > dsget user command to extract whatever parameters you might need...
    >
    > hth
    > Marcin
    >
    >
    > "Jeremy Smith" <godtoall@hotmail.com> wrote in message
    > news:c8670d93-57b9-4a0a-827b-6d413b7bc016@x14g2000yqk.googlegroups.com...
    >> When I run Dsget on a group to get is members, all of the users that
    >> are from a trusted domain show as SIDs. I like to get the disaply
    >> name like I do for users that are local to the domain. If I pull the
    >> group up in AD users and Computers it auto resolves the name for the
    >> trusted domain. Only thought I have is to connect to the trusted
    >> domain and resolve the SID to the name. Any thoughts on what I can do
    >> that my be easier?
    >>
    >> Thanks

    >
    >




Similar Threads

  1. Listing members of Group with >1500 members
    By Umesh Thakur in forum Windows Server Help
    Replies: 11
    Last Post: 03-02-2012, 04:59 AM
  2. Display members of a group with more than 1500 members
    By Simon G in forum Windows Server Help
    Replies: 5
    Last Post: 25-10-2011, 12:05 PM
  3. Replies: 2
    Last Post: 28-02-2010, 08:00 PM
  4. Cleaning up DSGET group command output
    By IT2 Myers, Tyler in forum Active Directory
    Replies: 5
    Last Post: 14-10-2009, 05:56 AM
  5. Export Group Members
    By seankil in forum Windows Server Help
    Replies: 4
    Last Post: 09-04-2008, 08:35 PM

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
Page generated in 1,638,711,113.12443 seconds with 17 queries