Using DSQUERY to get the members of a Group in AD

Bob Randall

unread,

Apr 6, 2005, 9:09:01 AM4/6/05

to

Can anyone give the the correct syntax (if it exists) to use the DSQUERY
command line tool to query the members of a specific group in AD? I have
tried many combonations and I cant seem to figure it out. I tried:

dsquery user OU=xxx, DC=yyy,DC=ZZZ

but I don't know what should go after that. I also tried the dsquery group
method with no luck. Does anyone know the correct way??

Thanks!

Bob Randall

ptwilliams

unread,

Apr 6, 2005, 9:53:02 AM4/6/05

to

C:\>dsget group "CN=GroupName,DC=domain-name,DC=com" -members

If you need to specify a server and/ or credentials, append the following on
the end:

-s dc01 -u userName -p *

--
Paul Williams

http://www.msresource.net/
http://forums.msresource.net/

Bob Randall

unread,

Apr 6, 2005, 10:13:03 AM4/6/05

to

Perfect - thanks a lot!

ptwilliams

unread,

Apr 6, 2005, 12:26:36 PM4/6/05

to

No problem! :-)

Mik

unread,

Feb 6, 2006, 4:29:14 PM2/6/06

to

I am trying the same thing but I keep getting this error:

dsget failed:A referral was returned from the server.

Any ideas what this is?

Paul Williams [MVP]

unread,

Feb 7, 2006, 1:52:23 AM2/7/06

to

What command are you typing?

--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net

Paul Williams [MVP]

unread,

Feb 8, 2006, 8:05:15 AM2/8/06

to

I don't understand that. DSGET will chase referrals. I just used that same
command to output the members of a group in the root domain from a child
domain.

What else can you tell me about your environment?

Paul Williams [MVP]

unread,

Feb 10, 2006, 3:20:53 AM2/10/06

to

Weird. I can't see why that command won't work. Unless the domain you are
using is different to your DNS domain?

Try the same thing with adfind (download from www.joeware.net)

adfind -b cn=group,cn=users,dc=domain-name,dc=com member -nodn

DA

unread,

Jun 22, 2006, 11:23:01 AM6/22/06

to

I get that with scripts that enumerate object in AD when I run the script
logged on to a domain different from that I'm trying to search. Try it first
making sure you're logged on to the domain you're searching and you might
have it work doing the command as a batch file and doing "run as" and
specifying creds in the search domain.

ntumanguil@hotmail

unread,

Nov 11, 2009, 3:23:28 AM11/11/09

to

Hi Paul,

Sorry, Can you help me to give a dsquery command to get all inactive
domain clients from specific OU?

Thanks,
Nap

--
ntumanguil@hotmail
------------------------------------------------------------------------
ntumanguil@hotmail's Profile: http://forums.techarena.in/members/153755.htm
View this thread: http://forums.techarena.in/active-directory/76662.htm

http://forums.techarena.in

Richard Mueller [MVP]

unread,

Nov 11, 2009, 12:09:22 PM11/11/09

to

"ntumanguil@hotmail" <ntumanguilho...@DoNotSpam.com> wrote in
message news:ntumanguilho...@DoNotSpam.com...

>
> Hi Paul,
>
> Sorry, Can you help me to give a dsquery command to get all inactive
> domain clients from specific OU?
>
> Thanks,
> Nap
>

After checking the dsquery syntax help at a command prompt, I got:

dsquery user "ou=Sales,ou=West,dc=MyDomain,dc=com" -inactive 4

This queries for users in the specified OU that have not logged on in the
last 4 weeks. However, the domain must be at Windows 2003 functional level
for this to work. Otherwise you can use:

dsquery user "ou=Sales,ou=West,dc=MyDomain,dc=com" -stalepwd 30

to find users that have not changed their password in the specified number
of days. Or, if your domain does not support -inactive and you don't want to
use -stalepwd, you can run a VBScript program that retrieves the lastLogon
attribute for all users. Such a program must query every Domain Controller
in the domain. See this link:

http://www.rlmueller.net/Last%20Logon.htm

--
Richard Mueller
MVP Directory Services
Hilltop Lab - http://www.rlmueller.net
--