Inconsistent information in Active Directory Members and Member Of propertiesSquidGuard and Active Directory groupsActive Directory, Linux, and User Private GroupsActive Directory Group membership inheritanceDynamic group membership to work around no nested security group support for Active DirectoryWhy are my active directory groups not showing up when querying the user?Active Directory write permissions let edit users information but not administrator-users informationIncomplete results when querying Active Directory for group members in a situation with trust relationshipsHow to export a detailed list of Active Directory users' “Member of” tab?Active Directory Users and Computers does not list Members of a Global GroupHow to allow security group members to manage other group membership in Active Directory
Network latencies between opposite ends of the Earth
Is my test coverage up to snuff?
Will there be more tax deductions if I put the house completely under my name, versus doing a joint ownership?
Were any of the books mentioned in this scene from the movie Hackers real?
c++ conditional uni-directional iterator
Is random forest for regression a 'true' regression?
Why did Varys remove his rings?
How could it be that 80% of townspeople were farmers during the Edo period in Japan?
Will the volt, ampere, ohm or other electrical units change on May 20th, 2019?
Could there be something like aerobatic smoke trails in the vacuum of space?
Understanding Deutch's Algorithm
labelled end points on logic diagram
With today's technology, could iron be smelted at La Rinconada?
How will the lack of ground stations affect navigation?
Single word that parallels "Recent" when discussing the near future
Given 0s on Assignments with suspected and dismissed cheating?
What dog breeds survive the apocalypse for generations?
Why did the soldiers of the North disobey Jon?
How to continually let my readers know what time it is in my story, in an organic way?
Formal Definition of Dot Product
Can my American children re-enter the USA by International flight with a passport card? Being that their passport book has expired
Cuban Primes
Does the wearer know what items are in which patch in the Robe of Useful items?
How to handle professionally if colleagues has referred his relative and asking to take easy while taking interview
Inconsistent information in Active Directory Members and Member Of properties
SquidGuard and Active Directory groupsActive Directory, Linux, and User Private GroupsActive Directory Group membership inheritanceDynamic group membership to work around no nested security group support for Active DirectoryWhy are my active directory groups not showing up when querying the user?Active Directory write permissions let edit users information but not administrator-users informationIncomplete results when querying Active Directory for group members in a situation with trust relationshipsHow to export a detailed list of Active Directory users' “Member of” tab?Active Directory Users and Computers does not list Members of a Global GroupHow to allow security group members to manage other group membership in Active Directory
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I'm trying to get a list of the members of a group in Active Directory. I'm using LDAP queries, but I think that's not relevant. I've found what I believe to be an inconsistency in Active Directory's group membership information:
A security group G
has been created with Global scope. Viewing G
's properties using the AD Users and Computers MMC Snap-in shows three users, A
B
C
on the Members tab.
However, on viewing the User properties of A
B
and C
, only A
and B
have G
listed on the 'Member Of' tab - G
is not present on the 'Member Of' tab of user C
.
How can it be that a user is in the Members list of a group, but that group is not in the 'Member Of' list for that user?
(note that the group G
is not any user's primary group)
(I originally thought this was an LDAP querying problem, but it isn't: the queries accurately report the information in Active Directory, and it's that that's inconsistent)
active-directory users groups
add a comment |
I'm trying to get a list of the members of a group in Active Directory. I'm using LDAP queries, but I think that's not relevant. I've found what I believe to be an inconsistency in Active Directory's group membership information:
A security group G
has been created with Global scope. Viewing G
's properties using the AD Users and Computers MMC Snap-in shows three users, A
B
C
on the Members tab.
However, on viewing the User properties of A
B
and C
, only A
and B
have G
listed on the 'Member Of' tab - G
is not present on the 'Member Of' tab of user C
.
How can it be that a user is in the Members list of a group, but that group is not in the 'Member Of' list for that user?
(note that the group G
is not any user's primary group)
(I originally thought this was an LDAP querying problem, but it isn't: the queries accurately report the information in Active Directory, and it's that that's inconsistent)
active-directory users groups
2
Is it the user's primary group?
– Shane Madden♦
Feb 8 '12 at 18:29
Just for grins - which is correct according to the AD toolset? (like ADUC)
– uSlackr
Feb 8 '12 at 18:45
@uSlackr thanks, that tipped me off that it's actually AD giving me the results I don't understand, rather than LDAP as such. Updated the q.
– AakashM
Feb 9 '12 at 10:02
@Shane no, it's a freshly created group. I've updated the q to be about AD rather than LDAP, since that seems to be the root of it.
– AakashM
Feb 9 '12 at 10:05
add a comment |
I'm trying to get a list of the members of a group in Active Directory. I'm using LDAP queries, but I think that's not relevant. I've found what I believe to be an inconsistency in Active Directory's group membership information:
A security group G
has been created with Global scope. Viewing G
's properties using the AD Users and Computers MMC Snap-in shows three users, A
B
C
on the Members tab.
However, on viewing the User properties of A
B
and C
, only A
and B
have G
listed on the 'Member Of' tab - G
is not present on the 'Member Of' tab of user C
.
How can it be that a user is in the Members list of a group, but that group is not in the 'Member Of' list for that user?
(note that the group G
is not any user's primary group)
(I originally thought this was an LDAP querying problem, but it isn't: the queries accurately report the information in Active Directory, and it's that that's inconsistent)
active-directory users groups
I'm trying to get a list of the members of a group in Active Directory. I'm using LDAP queries, but I think that's not relevant. I've found what I believe to be an inconsistency in Active Directory's group membership information:
A security group G
has been created with Global scope. Viewing G
's properties using the AD Users and Computers MMC Snap-in shows three users, A
B
C
on the Members tab.
However, on viewing the User properties of A
B
and C
, only A
and B
have G
listed on the 'Member Of' tab - G
is not present on the 'Member Of' tab of user C
.
How can it be that a user is in the Members list of a group, but that group is not in the 'Member Of' list for that user?
(note that the group G
is not any user's primary group)
(I originally thought this was an LDAP querying problem, but it isn't: the queries accurately report the information in Active Directory, and it's that that's inconsistent)
active-directory users groups
active-directory users groups
edited Feb 9 '12 at 10:01
AakashM
asked Feb 8 '12 at 17:50
AakashMAakashM
1166
1166
2
Is it the user's primary group?
– Shane Madden♦
Feb 8 '12 at 18:29
Just for grins - which is correct according to the AD toolset? (like ADUC)
– uSlackr
Feb 8 '12 at 18:45
@uSlackr thanks, that tipped me off that it's actually AD giving me the results I don't understand, rather than LDAP as such. Updated the q.
– AakashM
Feb 9 '12 at 10:02
@Shane no, it's a freshly created group. I've updated the q to be about AD rather than LDAP, since that seems to be the root of it.
– AakashM
Feb 9 '12 at 10:05
add a comment |
2
Is it the user's primary group?
– Shane Madden♦
Feb 8 '12 at 18:29
Just for grins - which is correct according to the AD toolset? (like ADUC)
– uSlackr
Feb 8 '12 at 18:45
@uSlackr thanks, that tipped me off that it's actually AD giving me the results I don't understand, rather than LDAP as such. Updated the q.
– AakashM
Feb 9 '12 at 10:02
@Shane no, it's a freshly created group. I've updated the q to be about AD rather than LDAP, since that seems to be the root of it.
– AakashM
Feb 9 '12 at 10:05
2
2
Is it the user's primary group?
– Shane Madden♦
Feb 8 '12 at 18:29
Is it the user's primary group?
– Shane Madden♦
Feb 8 '12 at 18:29
Just for grins - which is correct according to the AD toolset? (like ADUC)
– uSlackr
Feb 8 '12 at 18:45
Just for grins - which is correct according to the AD toolset? (like ADUC)
– uSlackr
Feb 8 '12 at 18:45
@uSlackr thanks, that tipped me off that it's actually AD giving me the results I don't understand, rather than LDAP as such. Updated the q.
– AakashM
Feb 9 '12 at 10:02
@uSlackr thanks, that tipped me off that it's actually AD giving me the results I don't understand, rather than LDAP as such. Updated the q.
– AakashM
Feb 9 '12 at 10:02
@Shane no, it's a freshly created group. I've updated the q to be about AD rather than LDAP, since that seems to be the root of it.
– AakashM
Feb 9 '12 at 10:05
@Shane no, it's a freshly created group. I've updated the q to be about AD rather than LDAP, since that seems to be the root of it.
– AakashM
Feb 9 '12 at 10:05
add a comment |
1 Answer
1
active
oldest
votes
There can be an issue getting complete results if you are querying a group that contains entries from multiple AD domains (global vs universal groups). There is more on the topic here
(Note: on the linked page, I see wingding fonts in the middle of the post from Che. Here they are converted to a real font:
- At a DC for the domain that contains the user, memberOf for the user is complete with respect to group membership in that domain; however, memberOf does not contain the user's membership in domain local and global groups in other domains.
- At a GC server, memberOf for the user is complete with respect to all universal group memberships.
)
Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying onmemberOf
- does that seem reasonable?
– AakashM
Feb 9 '12 at 10:05
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f358102%2finconsistent-information-in-active-directory-members-and-member-of-properties%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
There can be an issue getting complete results if you are querying a group that contains entries from multiple AD domains (global vs universal groups). There is more on the topic here
(Note: on the linked page, I see wingding fonts in the middle of the post from Che. Here they are converted to a real font:
- At a DC for the domain that contains the user, memberOf for the user is complete with respect to group membership in that domain; however, memberOf does not contain the user's membership in domain local and global groups in other domains.
- At a GC server, memberOf for the user is complete with respect to all universal group memberships.
)
Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying onmemberOf
- does that seem reasonable?
– AakashM
Feb 9 '12 at 10:05
add a comment |
There can be an issue getting complete results if you are querying a group that contains entries from multiple AD domains (global vs universal groups). There is more on the topic here
(Note: on the linked page, I see wingding fonts in the middle of the post from Che. Here they are converted to a real font:
- At a DC for the domain that contains the user, memberOf for the user is complete with respect to group membership in that domain; however, memberOf does not contain the user's membership in domain local and global groups in other domains.
- At a GC server, memberOf for the user is complete with respect to all universal group memberships.
)
Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying onmemberOf
- does that seem reasonable?
– AakashM
Feb 9 '12 at 10:05
add a comment |
There can be an issue getting complete results if you are querying a group that contains entries from multiple AD domains (global vs universal groups). There is more on the topic here
(Note: on the linked page, I see wingding fonts in the middle of the post from Che. Here they are converted to a real font:
- At a DC for the domain that contains the user, memberOf for the user is complete with respect to group membership in that domain; however, memberOf does not contain the user's membership in domain local and global groups in other domains.
- At a GC server, memberOf for the user is complete with respect to all universal group memberships.
)
There can be an issue getting complete results if you are querying a group that contains entries from multiple AD domains (global vs universal groups). There is more on the topic here
(Note: on the linked page, I see wingding fonts in the middle of the post from Che. Here they are converted to a real font:
- At a DC for the domain that contains the user, memberOf for the user is complete with respect to group membership in that domain; however, memberOf does not contain the user's membership in domain local and global groups in other domains.
- At a GC server, memberOf for the user is complete with respect to all universal group memberships.
)
edited May 4 at 11:09
InteXX
387627
387627
answered Feb 8 '12 at 18:57
uSlackruSlackr
6,0941531
6,0941531
Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying onmemberOf
- does that seem reasonable?
– AakashM
Feb 9 '12 at 10:05
add a comment |
Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying onmemberOf
- does that seem reasonable?
– AakashM
Feb 9 '12 at 10:05
Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying on
memberOf
- does that seem reasonable?– AakashM
Feb 9 '12 at 10:05
Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying on
memberOf
- does that seem reasonable?– AakashM
Feb 9 '12 at 10:05
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f358102%2finconsistent-information-in-active-directory-members-and-member-of-properties%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
Is it the user's primary group?
– Shane Madden♦
Feb 8 '12 at 18:29
Just for grins - which is correct according to the AD toolset? (like ADUC)
– uSlackr
Feb 8 '12 at 18:45
@uSlackr thanks, that tipped me off that it's actually AD giving me the results I don't understand, rather than LDAP as such. Updated the q.
– AakashM
Feb 9 '12 at 10:02
@Shane no, it's a freshly created group. I've updated the q to be about AD rather than LDAP, since that seems to be the root of it.
– AakashM
Feb 9 '12 at 10:05