Otdfbt

Network latencies between opposite ends of the Earth

Is my test coverage up to snuff?

Will there be more tax deductions if I put the house completely under my name, versus doing a joint ownership?

Were any of the books mentioned in this scene from the movie Hackers real?

c++ conditional uni-directional iterator

Is random forest for regression a 'true' regression?

Why did Varys remove his rings?

How could it be that 80% of townspeople were farmers during the Edo period in Japan?

Will the volt, ampere, ohm or other electrical units change on May 20th, 2019?

Could there be something like aerobatic smoke trails in the vacuum of space?

Understanding Deutch's Algorithm

labelled end points on logic diagram

With today's technology, could iron be smelted at La Rinconada?

How will the lack of ground stations affect navigation?

Single word that parallels "Recent" when discussing the near future

Given 0s on Assignments with suspected and dismissed cheating?

What dog breeds survive the apocalypse for generations?

Why did the soldiers of the North disobey Jon?

How to continually let my readers know what time it is in my story, in an organic way?

Formal Definition of Dot Product

Can my American children re-enter the USA by International flight with a passport card? Being that their passport book has expired

​Cuban​ ​Primes

Does the wearer know what items are in which patch in the Robe of Useful items?

How to handle professionally if colleagues has referred his relative and asking to take easy while taking interview

Inconsistent information in Active Directory Members and Member Of properties

SquidGuard and Active Directory groupsActive Directory, Linux, and User Private GroupsActive Directory Group membership inheritanceDynamic group membership to work around no nested security group support for Active DirectoryWhy are my active directory groups not showing up when querying the user?Active Directory write permissions let edit users information but not administrator-users informationIncomplete results when querying Active Directory for group members in a situation with trust relationshipsHow to export a detailed list of Active Directory users' “Member of” tab?Active Directory Users and Computers does not list Members of a Global GroupHow to allow security group members to manage other group membership in Active Directory

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

1

I'm trying to get a list of the members of a group in Active Directory. I'm using LDAP queries, but I think that's not relevant. I've found what I believe to be an inconsistency in Active Directory's group membership information:

A security group G has been created with Global scope. Viewing G's properties using the AD Users and Computers MMC Snap-in shows three users, A B C on the Members tab.

However, on viewing the User properties of A B and C, only A and B have G listed on the 'Member Of' tab - G is not present on the 'Member Of' tab of user C.

How can it be that a user is in the Members list of a group, but that group is not in the 'Member Of' list for that user?

_{(note that the group G is not any user's primary group)}

(I originally thought this was an LDAP querying problem, but it isn't: the queries accurately report the information in Active Directory, and it's that that's inconsistent)

active-directory users groups

share|improve this question

edited Feb 9 '12 at 10:01

AakashM

asked Feb 8 '12 at 17:50

AakashMAakashM

1166

• 
  
  
  

  
  2
  

  
  
  
  
  
  

  
  
  Is it the user's primary group?
  
  – Shane Madden♦
  Feb 8 '12 at 18:29
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Just for grins - which is correct according to the AD toolset? (like ADUC)
  
  – uSlackr
  Feb 8 '12 at 18:45
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @uSlackr thanks, that tipped me off that it's actually AD giving me the results I don't understand, rather than LDAP as such. Updated the q.
  
  – AakashM
  Feb 9 '12 at 10:02
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Shane no, it's a freshly created group. I've updated the q to be about AD rather than LDAP, since that seems to be the root of it.
  
  – AakashM
  Feb 9 '12 at 10:05
  

  
  
  
  

add a comment | 

1

I'm trying to get a list of the members of a group in Active Directory. I'm using LDAP queries, but I think that's not relevant. I've found what I believe to be an inconsistency in Active Directory's group membership information:

A security group G has been created with Global scope. Viewing G's properties using the AD Users and Computers MMC Snap-in shows three users, A B C on the Members tab.

However, on viewing the User properties of A B and C, only A and B have G listed on the 'Member Of' tab - G is not present on the 'Member Of' tab of user C.

How can it be that a user is in the Members list of a group, but that group is not in the 'Member Of' list for that user?

_{(note that the group G is not any user's primary group)}

(I originally thought this was an LDAP querying problem, but it isn't: the queries accurately report the information in Active Directory, and it's that that's inconsistent)

active-directory users groups

share|improve this question

edited Feb 9 '12 at 10:01

AakashM

asked Feb 8 '12 at 17:50

AakashMAakashM

1166

• 
  
  
  

  
  2
  

  
  
  
  
  
  

  
  
  Is it the user's primary group?
  
  – Shane Madden♦
  Feb 8 '12 at 18:29
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Just for grins - which is correct according to the AD toolset? (like ADUC)
  
  – uSlackr
  Feb 8 '12 at 18:45
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @uSlackr thanks, that tipped me off that it's actually AD giving me the results I don't understand, rather than LDAP as such. Updated the q.
  
  – AakashM
  Feb 9 '12 at 10:02
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Shane no, it's a freshly created group. I've updated the q to be about AD rather than LDAP, since that seems to be the root of it.
  
  – AakashM
  Feb 9 '12 at 10:05
  

  
  
  
  

add a comment | 

I'm trying to get a list of the members of a group in Active Directory. I'm using LDAP queries, but I think that's not relevant. I've found what I believe to be an inconsistency in Active Directory's group membership information:

A security group G has been created with Global scope. Viewing G's properties using the AD Users and Computers MMC Snap-in shows three users, A B C on the Members tab.

However, on viewing the User properties of A B and C, only A and B have G listed on the 'Member Of' tab - G is not present on the 'Member Of' tab of user C.

How can it be that a user is in the Members list of a group, but that group is not in the 'Member Of' list for that user?

_{(note that the group G is not any user's primary group)}

(I originally thought this was an LDAP querying problem, but it isn't: the queries accurately report the information in Active Directory, and it's that that's inconsistent)

active-directory users groups

share|improve this question

edited Feb 9 '12 at 10:01

AakashM

asked Feb 8 '12 at 17:50

AakashMAakashM

1166

share|improve this question

edited Feb 9 '12 at 10:01

AakashM

asked Feb 8 '12 at 17:50

AakashMAakashM

1166

share|improve this question

edited Feb 9 '12 at 10:01

AakashM

asked Feb 8 '12 at 17:50

AakashMAakashM

1166

asked Feb 8 '12 at 17:50

AakashMAakashM

1166

asked Feb 8 '12 at 17:50

AakashMAakashM

1166

1 Answer
1

active

oldest

votes

2

There can be an issue getting complete results if you are querying a group that contains entries from multiple AD domains (global vs universal groups). There is more on the topic here

(Note: on the linked page, I see wingding fonts in the middle of the post from Che. Here they are converted to a real font:

• At a DC for the domain that contains the user, memberOf for the user is complete with respect to group membership in that domain; however, memberOf does not contain the user's membership in domain local and global groups in other domains.


• At a GC server, memberOf for the user is complete with respect to all universal group memberships.

)

share|improve this answer

edited May 4 at 11:09

InteXX

387627

answered Feb 8 '12 at 18:57

uSlackruSlackr

6,0941531

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying on memberOf - does that seem reasonable?
  
  – AakashM
  Feb 9 '12 at 10:05
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f358102%2finconsistent-information-in-active-directory-members-and-member-of-properties%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

2

There can be an issue getting complete results if you are querying a group that contains entries from multiple AD domains (global vs universal groups). There is more on the topic here

(Note: on the linked page, I see wingding fonts in the middle of the post from Che. Here they are converted to a real font:

• At a DC for the domain that contains the user, memberOf for the user is complete with respect to group membership in that domain; however, memberOf does not contain the user's membership in domain local and global groups in other domains.


• At a GC server, memberOf for the user is complete with respect to all universal group memberships.

)

share|improve this answer

edited May 4 at 11:09

InteXX

387627

answered Feb 8 '12 at 18:57

uSlackruSlackr

6,0941531

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying on memberOf - does that seem reasonable?
  
  – AakashM
  Feb 9 '12 at 10:05
  

  
  
  
  

add a comment | 

2

There can be an issue getting complete results if you are querying a group that contains entries from multiple AD domains (global vs universal groups). There is more on the topic here

(Note: on the linked page, I see wingding fonts in the middle of the post from Che. Here they are converted to a real font:

• At a DC for the domain that contains the user, memberOf for the user is complete with respect to group membership in that domain; however, memberOf does not contain the user's membership in domain local and global groups in other domains.


• At a GC server, memberOf for the user is complete with respect to all universal group memberships.

)

share|improve this answer

edited May 4 at 11:09

InteXX

387627

answered Feb 8 '12 at 18:57

uSlackruSlackr

6,0941531

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for that link, although I am slightly getting out of my depth I think :) I'm getting the feeling the best thing to do is just find the group and read its members, rather than relying on memberOf - does that seem reasonable?
  
  – AakashM
  Feb 9 '12 at 10:05
  

  
  
  
  

add a comment | 

There can be an issue getting complete results if you are querying a group that contains entries from multiple AD domains (global vs universal groups). There is more on the topic here

(Note: on the linked page, I see wingding fonts in the middle of the post from Che. Here they are converted to a real font:

• At a DC for the domain that contains the user, memberOf for the user is complete with respect to group membership in that domain; however, memberOf does not contain the user's membership in domain local and global groups in other domains.


• At a GC server, memberOf for the user is complete with respect to all universal group memberships.

)

share|improve this answer

edited May 4 at 11:09

InteXX

387627

answered Feb 8 '12 at 18:57

uSlackruSlackr

6,0941531

share|improve this answer

edited May 4 at 11:09

InteXX

387627

answered Feb 8 '12 at 18:57

uSlackruSlackr

6,0941531

edited May 4 at 11:09

InteXX

387627

edited May 4 at 11:09

InteXX

387627

answered Feb 8 '12 at 18:57

uSlackruSlackr

6,0941531

answered Feb 8 '12 at 18:57

uSlackruSlackr

6,0941531