LDAP query to get all group members

Question

Hey,

Which LDAP query do I need to use in order to get all members(objectsGUID) of a group(By DN), including cross domain membership (At least on the same forest) ?

I don't have a GC in my organization.

Thanks

Answer 1

Hello

To get all members of a group, including cross-domain membership within the same forest, you can use an LDAP query with the memberOf attribute. The memberOf attribute in Active Directory is stored as a list of distinguished names. Your filter should look something like this:

(& (objectCategory=user) (memberOf=cn=GroupName,ou=ouOfGroup,dc=subdomain,dc=domain,dc=com))

Replace GroupName, ouOfGroup, subdomain, domain, and com with the appropriate values for your environment.

If you don’t have a Global Catalog (GC) in your organization, you may not be able to get results from all subdomains with one query.

I hope this information helps you construct the LDAP query you need.

Answer 2

Hey

I tried this approach,

It does give me group members but only in queried domain. group members from other domains within the forest doesn't appear (even with chase referrals on)

I don't use the member attribute of group because it gives me only the DN of the members, and I need GUID of the group members and the type of the group member.

What should I do?

Thanks.