Inconsistent information in Active Directory Members and Member Of propertiesSquidGuard and Active Directory groupsActive Directory, Linux, and User Private GroupsActive Directory Group membership inheritanceDynamic group membership to work around no nested security group support for Active DirectoryWhy are my active directory groups not showing up when querying the user?Active Directory write permissions let edit users information but not administrator-users informationIncomplete results when querying Active Directory for group members in a situation with trust relationshipsHow to export a detailed list of Active Directory users' “Member of” tab?Active Directory Users and Computers does not list Members of a Global GroupHow to allow security group members to manage other group membership in Active Directory

Network latencies between opposite ends of the Earth

Is my test coverage up to snuff?

Will there be more tax deductions if I put the house completely under my name, versus doing a joint ownership?

Were any of the books mentioned in this scene from the movie Hackers real?

c++ conditional uni-directional iterator

Is random forest for regression a 'true' regression?

Why did Varys remove his rings?

How could it be that 80% of townspeople were farmers during the Edo period in Japan?

Will the volt, ampere, ohm or other electrical units change on May 20th, 2019?

Could there be something like aerobatic smoke trails in the vacuum of space?

Understanding Deutch's Algorithm

labelled end points on logic diagram

With today's technology, could iron be smelted at La Rinconada?

How will the lack of ground stations affect navigation?

Single word that parallels "Recent" when discussing the near future

Given 0s on Assignments with suspected and dismissed cheating?

What dog breeds survive the apocalypse for generations?

Why did the soldiers of the North disobey Jon?

How to continually let my readers know what time it is in my story, in an organic way?

Formal Definition of Dot Product

Can my American children re-enter the USA by International flight with a passport card? Being that their passport book has expired

​Cuban​ ​Primes

Does the wearer know what items are in which patch in the Robe of Useful items?

How to handle professionally if colleagues has referred his relative and asking to take easy while taking interview



Inconsistent information in Active Directory Members and Member Of properties


SquidGuard and Active Directory groupsActive Directory, Linux, and User Private GroupsActive Directory Group membership inheritanceDynamic group membership to work around no nested security group support for Active DirectoryWhy are my active directory groups not showing up when querying the user?Active Directory write permissions let edit users information but not administrator-users informationIncomplete results when querying Active Directory for group members in a situation with trust relationshipsHow to export a detailed list of Active Directory users' “Member of” tab?Active Directory Users and Computers does not list Members of a Global GroupHow to allow security group members to manage other group membership in Active Directory






.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;








1















I'm trying to get a list of the members of a group in Active Directory. I'm using LDAP queries, but I think that's not relevant. I've found what I believe to be an inconsistency in Active Directory's group membership information:



A security group G has been created with Global scope. Viewing G's properties using the AD Users and Computers MMC Snap-in shows three users, A B C on the Members tab.



However, on viewing the User properties of A B and C, only A and B have G listed on the 'Member Of' tab - G is not present on the 'Member Of' tab of user C.



How can it be that a user is in the Members list of a group, but that group is not in the 'Member Of' list for that user?




(note that the group G is not any user's primary group)



(I originally thought this was an LDAP querying problem, but it isn't: the queries accurately report the information in Active Directory, and it's that that's inconsistent)










share|improve this question



















  • 2





    Is it the user's primary group?

    – Shane Madden
    Feb 8 '12 at 18:29











  • Just for grins - which is correct according to the AD toolset? (like ADUC)

    – uSlackr
    Feb 8 '12 at 18:45











  • @uSlackr thanks, that tipped me off that it's actually AD giving me the results I don't understand, rather than LDAP as such. Updated the q.

    – AakashM
    Feb 9 '12 at 10:02











  • @Shane no, it's a freshly created group. I've updated the q to be about AD rather than LDAP, since that seems to be the root of it.

    – AakashM
    Feb 9 '12 at 10:05

















1















I'm trying to get a list of the members of a group in Active Directory. I'm using LDAP queries, but I think that's not relevant. I've found what I believe to be an inconsistency in Active Directory's group membership information:



A security group G has been created with Global scope. Viewing G's properties using the AD Users and Computers MMC Snap-in shows three users, A B C on the Members tab.



However, on viewing the User properties of A B and C, only A and B have G listed on the 'Member Of' tab - G is not present on the 'Member Of' tab of user C.



How can it be that a user is in the Members list of a group, but that group is not in the 'Member Of' list for that user?




(note that the group G is not any user's primary group)



(I originally thought this was an LDAP querying problem, but it isn't: the queries accurately report the information in Active Directory, and it's that that's inconsistent)










share|improve this question



















  • 2





    Is it the user's primary group?

    – Shane Madden
    Feb 8 '12 at 18:29











  • Just for grins - which is correct according to the AD toolset? (like ADUC)

    – uSlackr
    Feb 8 '12 at 18:45











  • @uSlackr thanks, that tipped me off that it's actually AD giving me the results I don't understand, rather than LDAP as such. Updated the q.

    – AakashM
    Feb 9 '12 at 10:02











  • @Shane no, it's a freshly created group. I've updated the q to be about AD rather than LDAP, since that seems to be the root of it.

    – AakashM
    Feb 9 '12 at 10:05













1












1








1








I'm trying to get a list of the members of a group in Active Directory. I'm using LDAP queries, but I think that's not relevant. I've found what I believe to be an inconsistency in Active Directory's group membership information:



A security group G has been created with Global scope. Viewing G's properties using the AD Users and Computers MMC Snap-in shows three users, A B C on the Members tab.



However, on viewing the User properties of A B and C, only A and B have G listed on the 'Member Of' tab - G is not present on the 'Member Of' tab of user C.



How can it be that a user is in the Members list of a group, but that group is not in the 'Member Of' list for that user?




(note that the group G is not any user's primary group)



(I originally thought this was an LDAP querying problem, but it isn't: the queries accurately report the information in Active Directory, and it's that that's inconsistent)










share|improve this question
















I'm trying to get a list of the members of a group in Active Directory. I'm using LDAP queries, but I think that's not relevant. I've found what I believe to be an inconsistency in Active Directory's group membership information:



A security group G has been created with Global scope. Viewing G's properties using the AD Users and Computers MMC Snap-in shows three users, A B C on the Members tab.



However, on viewing the User properties of A B and C, only A and B have G listed on the 'Member Of' tab - G is not present on the 'Member Of' tab of user C.



How can it be that a user is in the Members list of a group, but that group is not in the 'Member Of' list for that user?




(note that the group G is not any user's primary group)



(I originally thought this was an LDAP querying problem, but it isn't: the queries accurately report the information in Active Directory, and it's that that's inconsistent)







active-directory users groups






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Feb 9 '12 at 10:01







AakashM

















asked Feb 8 '12 at 17:50









AakashMAakashM

1166




1166







  • 2





    Is it the user's primary group?

    – Shane Madden
    Feb 8 '12 at 18:29











  • Just for grins - which is correct according to the AD toolset? (like ADUC)

    – uSlackr
    Feb 8 '12 at 18:45











  • @uSlackr thanks, that tipped me off that it's actually AD giving me the results I don't understand, rather than LDAP as such. Updated the q.

    – AakashM
    Feb 9 '12 at 10:02











  • @Shane no, it's a freshly created group. I've updated the q to be about AD rather than LDAP, since that seems to be the root of it.

    – AakashM
    Feb 9 '12 at 10:05












  • 2





    Is it the user's primary group?

    – Shane Madden
    Feb 8 '12 at 18:29











  • Just for grins - which is correct according to the AD toolset? (like ADUC)

    – uSlackr
    Feb 8 '12 at 18:45











  • @uSlackr thanks, that tipped me off that it's actually AD giving me the results I don't understand, rather than LDAP as such. Updated the q.

    – AakashM
    Feb 9 '12 at 10:02











  • @Shane no, it's a freshly created group. I've updated the q to be about AD rather than LDAP, since that seems to be the root of it.

    – AakashM
    Feb 9 '12 at 10:05







2




2





Is it the user's primary group?

– Shane Madden
Feb 8 '12 at 18:29





Is it the user's primary group?

– Shane Madden
Feb 8 '12 at 18:29













Just for grins - which is correct according to the AD toolset? (like ADUC)

– uSlackr
Feb 8 '12 at 18:45





Just for grins - which is correct according to the AD toolset? (like ADUC)

– uSlackr
Feb 8 '12 at 18:45













@uSlackr thanks, that tipped me off that it's actually AD giving me the results I don't understand, rather than LDAP as such. Updated the q.

– AakashM
Feb 9 '12 at 10:02





@uSlackr thanks, that tipped me off that it's actually AD giving me the results I don't understand, rather than LDAP as such. Updated the q.

– AakashM
Feb 9 '12 at 10:02













@Shane no, it's a freshly created group. I've updated the q to be about AD rather than LDAP, since that seems to be the root of it.

– AakashM
Feb 9 '12 at 10:05





@Shane no, it's a freshly created group. I've updated the q to be about AD rather than LDAP, since that seems to be the root of it.

– AakashM
Feb 9 '12 at 10:05










1 Answer
1






active

oldest

votes


















2














There can be an issue getting complete results if you are querying a group that contains entries from multiple AD domains (global vs universal groups). There is more on the topic here



(Note: on the linked page, I see wingding fonts in the middle of the post from Che. Here they are converted to a real font:




  • At a DC for the domain that contains the user, memberOf for the user is complete with respect to group membership in that domain; however, memberOf does not contain the user's membership in domain local and global groups in other domains.

  • At a GC server, memberOf for the user is complete with respect to all universal group memberships.



)






share|improve this answer

























  • Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying on memberOf - does that seem reasonable?

    – AakashM
    Feb 9 '12 at 10:05











Your Answer








StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);













draft saved

draft discarded


















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f358102%2finconsistent-information-in-active-directory-members-and-member-of-properties%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown

























1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes









2














There can be an issue getting complete results if you are querying a group that contains entries from multiple AD domains (global vs universal groups). There is more on the topic here



(Note: on the linked page, I see wingding fonts in the middle of the post from Che. Here they are converted to a real font:




  • At a DC for the domain that contains the user, memberOf for the user is complete with respect to group membership in that domain; however, memberOf does not contain the user's membership in domain local and global groups in other domains.

  • At a GC server, memberOf for the user is complete with respect to all universal group memberships.



)






share|improve this answer

























  • Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying on memberOf - does that seem reasonable?

    – AakashM
    Feb 9 '12 at 10:05















2














There can be an issue getting complete results if you are querying a group that contains entries from multiple AD domains (global vs universal groups). There is more on the topic here



(Note: on the linked page, I see wingding fonts in the middle of the post from Che. Here they are converted to a real font:




  • At a DC for the domain that contains the user, memberOf for the user is complete with respect to group membership in that domain; however, memberOf does not contain the user's membership in domain local and global groups in other domains.

  • At a GC server, memberOf for the user is complete with respect to all universal group memberships.



)






share|improve this answer

























  • Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying on memberOf - does that seem reasonable?

    – AakashM
    Feb 9 '12 at 10:05













2












2








2







There can be an issue getting complete results if you are querying a group that contains entries from multiple AD domains (global vs universal groups). There is more on the topic here



(Note: on the linked page, I see wingding fonts in the middle of the post from Che. Here they are converted to a real font:




  • At a DC for the domain that contains the user, memberOf for the user is complete with respect to group membership in that domain; however, memberOf does not contain the user's membership in domain local and global groups in other domains.

  • At a GC server, memberOf for the user is complete with respect to all universal group memberships.



)






share|improve this answer















There can be an issue getting complete results if you are querying a group that contains entries from multiple AD domains (global vs universal groups). There is more on the topic here



(Note: on the linked page, I see wingding fonts in the middle of the post from Che. Here they are converted to a real font:




  • At a DC for the domain that contains the user, memberOf for the user is complete with respect to group membership in that domain; however, memberOf does not contain the user's membership in domain local and global groups in other domains.

  • At a GC server, memberOf for the user is complete with respect to all universal group memberships.



)







share|improve this answer














share|improve this answer



share|improve this answer








edited May 4 at 11:09









InteXX

387627




387627










answered Feb 8 '12 at 18:57









uSlackruSlackr

6,0941531




6,0941531












  • Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying on memberOf - does that seem reasonable?

    – AakashM
    Feb 9 '12 at 10:05

















  • Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying on memberOf - does that seem reasonable?

    – AakashM
    Feb 9 '12 at 10:05
















Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying on memberOf - does that seem reasonable?

– AakashM
Feb 9 '12 at 10:05





Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying on memberOf - does that seem reasonable?

– AakashM
Feb 9 '12 at 10:05

















draft saved

draft discarded
















































Thanks for contributing an answer to Server Fault!


  • Please be sure to answer the question. Provide details and share your research!

But avoid


  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f358102%2finconsistent-information-in-active-directory-members-and-member-of-properties%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

Club Baloncesto Breogán Índice Historia | Pavillón | Nome | O Breogán na cultura popular | Xogadores | Adestradores | Presidentes | Palmarés | Historial | Líderes | Notas | Véxase tamén | Menú de navegacióncbbreogan.galCadroGuía oficial da ACB 2009-10, páxina 201Guía oficial ACB 1992, páxina 183. Editorial DB.É de 6.500 espectadores sentados axeitándose á última normativa"Estudiantes Junior, entre as mellores canteiras"o orixinalHemeroteca El Mundo Deportivo, 16 setembro de 1970, páxina 12Historia do BreogánAlfredo Pérez, o último canoneiroHistoria C.B. BreogánHemeroteca de El Mundo DeportivoJimmy Wright, norteamericano do Breogán deixará Lugo por ameazas de morteResultados de Breogán en 1986-87Resultados de Breogán en 1990-91Ficha de Velimir Perasović en acb.comResultados de Breogán en 1994-95Breogán arrasa al Barça. "El Mundo Deportivo", 27 de setembro de 1999, páxina 58CB Breogán - FC BarcelonaA FEB invita a participar nunha nova Liga EuropeaCharlie Bell na prensa estatalMáximos anotadores 2005Tempada 2005-06 : Tódolos Xogadores da Xornada""Non quero pensar nunha man negra, mais pregúntome que está a pasar""o orixinalRaúl López, orgulloso dos xogadores, presume da boa saúde económica do BreogánJulio González confirma que cesa como presidente del BreogánHomenaxe a Lisardo GómezA tempada do rexurdimento celesteEntrevista a Lisardo GómezEl COB dinamita el Pazo para forzar el quinto (69-73)Cafés Candelas, patrocinador del CB Breogán"Suso Lázare, novo presidente do Breogán"o orixinalCafés Candelas Breogán firma el mayor triunfo de la historiaEl Breogán realizará 17 homenajes por su cincuenta aniversario"O Breogán honra ao seu fundador e primeiro presidente"o orixinalMiguel Giao recibiu a homenaxe do PazoHomenaxe aos primeiros gladiadores celestesO home que nos amosa como ver o Breo co corazónTita Franco será homenaxeada polos #50anosdeBreoJulio Vila recibirá unha homenaxe in memoriam polos #50anosdeBreo"O Breogán homenaxeará aos seus aboados máis veteráns"Pechada ovación a «Capi» Sanmartín e Ricardo «Corazón de González»Homenaxe por décadas de informaciónPaco García volve ao Pazo con motivo do 50 aniversario"Resultados y clasificaciones""O Cafés Candelas Breogán, campión da Copa Princesa""O Cafés Candelas Breogán, equipo ACB"C.B. Breogán"Proxecto social"o orixinal"Centros asociados"o orixinalFicha en imdb.comMario Camus trata la recuperación del amor en 'La vieja música', su última película"Páxina web oficial""Club Baloncesto Breogán""C. B. Breogán S.A.D."eehttp://www.fegaba.com

Vilaño, A Laracha Índice Patrimonio | Lugares e parroquias | Véxase tamén | Menú de navegación43°14′52″N 8°36′03″O / 43.24775, -8.60070

Cegueira Índice Epidemioloxía | Deficiencia visual | Tipos de cegueira | Principais causas de cegueira | Tratamento | Técnicas de adaptación e axudas | Vida dos cegos | Primeiros auxilios | Crenzas respecto das persoas cegas | Crenzas das persoas cegas | O neno deficiente visual | Aspectos psicolóxicos da cegueira | Notas | Véxase tamén | Menú de navegación54.054.154.436928256blindnessDicionario da Real Academia GalegaPortal das Palabras"International Standards: Visual Standards — Aspects and Ranges of Vision Loss with Emphasis on Population Surveys.""Visual impairment and blindness""Presentan un plan para previr a cegueira"o orixinalACCDV Associació Catalana de Cecs i Disminuïts Visuals - PMFTrachoma"Effect of gene therapy on visual function in Leber's congenital amaurosis"1844137110.1056/NEJMoa0802268Cans guía - os mellores amigos dos cegosArquivadoEscola de cans guía para cegos en Mortágua, PortugalArquivado"Tecnología para ciegos y deficientes visuales. Recopilación de recursos gratuitos en la Red""Colorino""‘COL.diesis’, escuchar los sonidos del color""COL.diesis: Transforming Colour into Melody and Implementing the Result in a Colour Sensor Device"o orixinal"Sistema de desarrollo de sinestesia color-sonido para invidentes utilizando un protocolo de audio""Enseñanza táctil - geometría y color. Juegos didácticos para niños ciegos y videntes""Sistema Constanz"L'ocupació laboral dels cecs a l'Estat espanyol està pràcticament equiparada a la de les persones amb visió, entrevista amb Pedro ZuritaONCE (Organización Nacional de Cegos de España)Prevención da cegueiraDescrición de deficiencias visuais (Disc@pnet)Braillín, un boneco atractivo para calquera neno, con ou sen discapacidade, que permite familiarizarse co sistema de escritura e lectura brailleAxudas Técnicas36838ID00897494007150-90057129528256DOID:1432HP:0000618D001766C10.597.751.941.162C97109C0155020