Don't return all direct members of the AD group

García Tarifa, Mario 21 Reputation points
2020-09-18T08:28:40.563+00:00

When I run the following select it doesn't return all direct members of the group. There are 7 members but it only returns 3. Any suggestions?

SELECT sAMaccountname,useraccountcontrol
FROM OPENQUERY
(ASDI,'SELECT sAMaccountname,UserAccountControl FROM ''LDAP://XXX/DC=XX,DC=XX'' WHERE objectcategory=''User''
and memberof=''CN=XX,CN=XX,DC=XX,DC=XX''')

Thanks.

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,645 questions
Transact-SQL
Transact-SQL
A Microsoft extension to the ANSI SQL language that includes procedural programming, local variables, and various support functions.
4,656 questions
0 comments
Accepted answer
  1. Hannah Xiong 6,276 Reputation points
    2020-09-21T02:24:43.297+00:00

    Hello,

    Thank you so much for posting here.

    According to our description, it could show all the members of AD groups using AD Users and Computers, but it only shows parts of members using Softerra. So sorry that we are not familiar with Softerra. Have we tried ldp.exe?

    25996-1.png

    25997-2.png

    Besides, according to my reseach, Most methods do not reveal membership in the "primary" group. For most users, the "primary" group would be "Domain Users". Specifically, the memberOf attribute of user objects, and the member attribute of group objects, never reveals "primary" group membership.

    For more information, we could refer to:
    https://social.technet.microsoft.com/Forums/Sharepoint/en-US/373febac-665c-494d-91f7-834541c74bee/cant-get-all-member-objects-from-domain-users-in-ldap?forum=winserverDS

    Hope the information is helpful. For any question, please feel free to contact us.

    Best regards,
    Hannah Xiong

    0 comments

3 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Stefan Hoffmann 621 Reputation points
    2020-09-18T14:25:36.343+00:00

    Test your LDAP query using ADExplorer..

    0 comments
  2. García Tarifa, Mario 21 Reputation points
    2020-09-20T10:23:21.123+00:00

    Using Softerra, it shows 3 members but using the AD console it shows 7 members.

    0 comments
  3. García Tarifa, Mario 21 Reputation points
    2020-09-21T06:16:03.81+00:00

    Using the PrimaryGroupID combined with the memberOf I have gotten it to show all.
    Thank you very much for your help.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.