Get-QADGroupMember
From PowerGUI Wiki
Retrieve the members of a group in Active Directory. Supported are both Active Directory Domain Services (AD DS) and Active Directory Lightweight Directory Services (AD LDS).
Contents |
Syntax
Get-QADGroupMember [-Identity] <IdentityParameter> [-Indirect] [-ldapFilter <String>] [-PageSize <Int32>] [-SizeLimit <Int32>] [-WildcardMode <WildcardMode>] [-IncludeAllProperties] [-DontConvertValuesToFriendlyRepresentation] [-SerializeValues] [-DontUseDefaultIncludedProperties] [-UseDefaultExcludedProperties [<Boolean>]] [-ExcludedProperties <String[]>] [-IncludedProperties <String[]>] [-UseDefaultExcludedPropertiesExcept <String[]>] [-Proxy] [-Service <String>] [-ConnectionAccount <String>] [-ConnectionPassword <SecureString>] [-Credential <PSCredential>] [-Connection <ArsConnection>] [-UseGlobalCatalog] [<CommonParameters>]
Detailed Description
Use this cmdlet to retrieve the directory objects that are members of a certain group in Active Directory.
The output of the cmdlet is a collection of objects, with each object representing one of the directory objects found by the cmdlet. You can pipe the output into another cmdlet, such as Set-QADObject, to make changes to the directory objects returned by this cmdlet.
The cmdlet has optional parameters that determine the server and the security context for the operation. Normally, the connection parameters could be omitted so far as a connection to a server is established prior to using the cmdlet. In this case, the server and the security context are determined by the Connect-QADService cmdlet.
If you do not use Connect-QADService and have no connection established prior to using a cmdlet, then the connection settings, including the server and the security context, are determined by the connection parameters of the first cmdlet you use. Subsequent cmdlets will use those settings by default.
Related Commands
Parameters
| Name | Description | Required? | Pipeline Input | Default Value |
|---|---|---|---|---|
| Identity | Specify the DN, SID, GUID, or Domain\Name of the group.
This parameter is optional since you can pipe into this cmdlet the object returned by the Get-QADGroup cmdlet, to have that object identify the group to act upon. | true | true (ByValue) | |
| Indirect | Supply this parameter on the command line if you want the cmdlet to retrieve objects that belong to the specified group because of group nesting, in addition to objects that are direct members of the group. If this parameter is omitted, the cmdlet retrieves only those objects that are direct members of the group. | false | false | |
| ldapFilter | Specify the LDAP search filter that defines your search criteria on the group memberships. Note that the search filter string is case-sensitive.
With the LdapFilter parameter, the cmdlet disregards the attribute-specific parameters on the group members. If you want to define search criteria based on specific attributes, do not supply LdapFilter on the command line. | false | false | |
| PageSize | Set the maximum number of items in each page of the search results that will be returned by the cmdlet. After the directory server has found the number of objects that are specified by this parameter, it will stop searching and return the results to the cmdlet. When the cmdlet requests more data, the server will restart the search where it left off. You can use this setting to adjust the number of requests (network calls) to the directory server issued by the cmdlet during a search.
Normally, the default page size is 50. You can view or modify this default setting by using the Get-QADPSSnapinSettings or Set-QADPSSnapinSettings cmdlet, respectively. | false | false | 50 |
| SizeLimit | Set the maximum number of items to be returned by the cmdlet. Normally, the default size limit is 1000. You can view or modify this default setting by using the Get-QADPSSnapinSettings or Set-QADPSSnapinSettings cmdlet, respectively. | false | false | 1000 |
| WildcardMode | Specify either 'PowerShell' or 'LDAP' as the parameter value. Normally, if this parameter is not supplied, the cmdlet assumes that WildcardMode is set to 'LDAP'. You can view or modify this default setting by using the Get-QADPSSnapinSettings or Set-QADPSSnapinSettings cmdlet, respectively.
The 'PowerShell' value causes the cmdlet to use PowerShell wildcards and quoting rules. Wildcards are processed on the client side, which may result in slow search performance. For information about PowerShell wildcards and quoting rules, type the following commands at the PowerShell command-prompt: help about_wildcard help about_quoting_rule The 'LDAP' value causes the cmdlet to use LDAP wildcards (asterisks only) and LDAP quoting rules (backslash as the escape character). Wildcards are processed on the server side, which enables faster search results. | false | false | LDAP |
| IncludeAllProperties | With this parameter, the cmdlet retrieves all attributes of the respective directory object (such as a User object), and stores the attribute values in the memory cache on the local computer. Attribute values can be read from the memory cache by using properties of the object returned by the cmdlet. Thus, when used in conjunction with the SerializeValues parameter, it allows an entire object to be exported from the directory to a text file. For examples of how to use this parameter, see help on the Get-QADUser or Get-QADObject cmdlet. | false | false | |
| DontConvertValuesToFriendlyRepresentation | This parameter causes the cmdlet to represent the Integer8 and OctetString attribute values “as is,” without converting them to a user-friendly, human-readable form. If this parameter is omitted, the cmdlet performs the following data conversions:
- The values of the Integer8 attributes listed in the Integer8AttributesThatContainDateTimes array (see the parameter descriptions for the Get-QADPSSnapinSettings and Set-QADPSSnapinSettings cmdlets) are converted from IADsLargeInteger to DateTime - The values of the Integer8 attributes listed in the Integer8AttributesThatContainNegativeTimeSpans array (see the parameter descriptions for the Get-QADPSSnapinSettings and Set-QADPSSnapinSettings cmdlets) are converted from IADsLargeInteger to TimeSpan - The values of the other Integer8 attributes are converted from IADsLargeInteger to Int64 - The values of the OctetString attributes are converted from byte[] to BinHex strings Note: This parameter has an effect only on the properties of the output object that have the member type of NoteProperty. Such properties are normally added to the output object in order to provide access to the attribute values of the respective directory object that are loaded to the local memory cache but cannot be accessed by using properties of the base object (the object for which the output object serves as a wrapper). | false | false | |
| SerializeValues | This parameter causes the cmdlet to output an object whose properties store the attribute values of the respective directory object that are loaded to the local memory cache. The value returned by each property of the output object is represented as a string (serialized) so as to facilitate the export of the attribute values to a text file. Thus, when used in conjunction with the IncludeAllProperties parameter, it allows an entire object to be exported from the directory to a text file. For examples of how to use this parameter, see help on the Get-QADUser cmdlet. | false | false | |
| DontUseDefaultIncludedProperties | This parameter causes the cmdlet to load only a small set of attributes from the directory to the local memory cache (normally, this set is limited to objectClass and ADsPath). Other attributes are retrieved from the directory as needed when you use the cmdlet's output objects to read attribute values. Thus, if you want only to count the objects that meet certain conditions (rather than examine values of particular attributes), then you can use this parameter to increase performance of your search. For examples of how to use this parameter, see help on the Get-QADUser cmdlet.
Note: If a cmdlet does not cache a particular attribute, then the output object returned by the cmdlet may not have a property that would provide access to the value of the attribute. | false | false | |
| UseDefaultExcludedProperties | When set to 'true', this parameter causes the cmdlet not to load a certain pre-defined set of attributes from the directory to the local memory cache. This pre-defined set of attributes (referred to as "default excluded properties") can be viewed or modified by using the Get-QADPSSnapinSettings or Set-QADPSSnapinSettings cmdlet, respectively. Normally, this parameter is used in conjunction with IncudeAllProperties to avoid retrieval of unnecessary data from the directory server, thereby increasing performance of the search operation performed by the cmdlet.
Note: If a cmdlet does not cache a particular attribute, then the output object returned by the cmdlet may not have a property that would provide access to the value of the attribute. | false | false | |
| ExcludedProperties | Use this parameter to specify the attributes that you do not want the cmdlet to retrieve from the directory and store in the memory cache on the local computer. Supply a list of the attribute LDAP display names as the parameter value. By default, the cmdlet caches a certain pre-defined set of attributes, which you can view or modify by using the Get-QADPSSnapinSettings or Set-QADPSSnapinSettings cmdlet, respectively. Using the ExcludedProperties parameter you can change this default behavior on an ad-hoc basis, in order to prevent certain attributes from being loaded. Another scenario involves the use of this parameter in conjunction with IncludeAllProperties in order to restrict the set of the cached attributes.
Note: If a cmdlet does not cache a particular attribute, then the output object returned by the cmdlet may not have a property that would provide access to the value of the attribute. | false | false | |
| IncludedProperties | Use this parameter to specify the attributes that you want the cmdlet to retrieve from the directory and store in the memory cache on the local computer. Supply a list of the attribute LDAP display names as the parameter value. By default, the cmdlet caches a certain pre-defined set of attributes, which you can view or modify by using the Get-QADPSSnapinSettings or Set-QADPSSnapinSettings cmdlet, respectively. Using the IncludedProperty parameter you can direct the cmdlet to cache some attributes in addition to the default set.
Note: Caching an attribute guarantees that the value of the attribute can be read by using properties of the output object returned by the cmdlet. | false | false | |
| UseDefaultExcludedPropertiesExcept | This parameter is deprecated, and has no effect. | false | false | |
| Proxy | For parameter description, see help on the Connect-QADService cmdlet. | false | false | |
| Service | For parameter description, see help on the Connect-QADService cmdlet. | false | false | |
| ConnectionAccount | For parameter description, see help on the Connect-QADService cmdlet. | false | false | |
| ConnectionPassword | For parameter description, see help on the Connect-QADService cmdlet. | false | false | |
| Credential | For parameter description, see help on the Connect-QADService cmdlet. | false | false | |
| Connection | For parameter description, see help on the Connect-QADService cmdlet. | false | true (ByValue) | |
| UseGlobalCatalog | For parameter description, see help on the Connect-QADService cmdlet. | false | false |
Examples
Example 1
get-QADGroupMember 'company\administrators'
Connect to any available domain controller with the credentials of the locally logged on user, bind to a specific group by Domain\Name, and display a list of members of the group.
Example 2
get-QADGroupMember '<DN of group>' -Service 'server.domain.local:389'
Connect to the AD LDS instance on 'server.domain.local:389' with the credentials of the locally logged on user, bind to a specific AD LDS group by DN, and display a list of members of the group.
