This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(310.4, 12%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETA%3C/text%3E%3C/svg%3E)
Using Powershell, why does Get-ADObject not return gMSAs? ADUC lists them as 'computer' objects, but Get-ADComputer also will not return them. Get-ADGroup and Get-ADGroupMember will both show them as members. But you'd have to already know what they are ahead of time to identify them in a script, and say, retrieve their properties. You must use Get-ADService Account to retrieve their properties.
I am extracting members of a specific group, which may contain users, nested groups, Foreign Security Principals, or gMSAs. I use Get-ADObject on each member to identify what 'type' of object they are, then take different actions depending on which. I'm using Windows 2016 and PS v5.1.
The reason that Get-ADObject and Get-ADComputer do not return gMSAs is because gMSAs (Group Managed Service Accounts) are not traditional user or computer accounts. They are a type of service account specifically designed for applications running on multiple servers, and are managed by Active Directory rather than individual servers.
To retrieve information about gMSAs, you can use the Get-ADServiceAccount cmdlet. This cmdlet is specifically designed to work with gMSAs, and can be used to retrieve information such as the account name, description, and group memberships.
In your scenario, you could modify your script to first use Get-ADObject to retrieve the type of each member, and then use the appropriate cmdlet (e.g. Get-ADUser, Get-ADGroup, Get-ADServiceAccount, etc.) to retrieve the properties for that specific type of object. This way, you can handle all types of objects within the same script.
Please mark as helpful answer if it helps you :-)
The problem is, I cannot get Get-ADObject to 'get' a gMSA in the first place.
Get-ADObject -identity CN=SomegMSA,OU=GMSA/MSA/SvcAccts,DC=Company,DC=com
Get-ADObject : Cannot convert 'System.Object[]' to the type 'Microsoft.ActiveDirectory.Management.ADObject' required
by parameter 'Identity'. Specified method is not supported.
At line:1 char:24
+ get-adobject -identity CN=SomegMSA,OU= ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [Get-ADObject], ParameterBindingException
+ FullyQualifiedErrorId : CannotConvertArgument,Microsoft.ActiveDirectory.Management.Commands.GetADObject
Ah. If i provide Get-ADObject -Identity with the GUID rather than the DN, it retrieves the gMSA. Both (Get-ADGroup).members and Get-ADGroupMember return a list of DNs, not GUIDs. So the problem is till, how to return a list (or the objects) of the members of a group which can can then identify each member as user, group, fsp or gMSA? I guess i can do process of elimination: if its not one of the 3, it must be a gMSA? That stinks. :-)
Yes, if you have a list of DNs of the members of the group, you can use Get-ADObject cmdlet to retrieve each object by its DN and then determine its object class to identify whether it's a user, group, fsp, or gMSA.
Here's an example code snippet that retrieves the objects for each member in the group, identifies its object class, and stores the objects in corresponding arrays:
$members = (Get-ADGroupMember -Identity "GroupName").DN
$userObjects = @()
$groupObjects = @()
$fspObjects = @()
$gmsaObjects = @()
foreach ($member in $members) {
$object = Get-ADObject -Identity $member
switch ($object.ObjectClass) {
"user" {$userObjects += $object}
"group" {$groupObjects += $object}
"foreignSecurityPrincipal" {$fspObjects += $object}
"msDS-GroupManagedServiceAccount" {$gmsaObjects += $object}
}
}
This code retrieves the DNs of all members in the group and stores them in the $members array. Then it creates four empty arrays, $userObjects, $groupObjects, $fspObjects, and $gmsaObjects, to store the objects of each object class.
In the foreach loop, the code retrieves the object for each member using Get-ADObject and identifies its object class using the ObjectClass property. Depending on the object class, the code adds the object to the corresponding array using the += operator.
At the end of the loop, you should have four arrays ($userObjects, $groupObjects, $fspObjects, and $gmsaObjects) containing the objects of each object class.
Please know that i'm grateful for your help here, but you didn't address why I'm getting that error I pasted when I attempt to use Get-ADObject -Identiry <DN>. That makes it appear that for the gMSA, Get-ASObject does not consider its DN as a proper value for -Identity. In other words, your scriptlet fails on a gMSA.