Get-ADGroupMember with groups with members on external domains [closed] - powershell

Question

Closed. This question needs debugging details. It is not currently accepting answers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Closed 3 years ago.
Improve this question
I'm trying to build a script identifying all members and nested members of the Administrators group. My company currently has 20+ domains, majority of which are not integrated. Instead, we simply build a trust between domains following acquisition. The problem is the Administrators group for these domains often has members from one of the external but trusted domains. If i run Get-ADGroupMember I have no problem, but if I run Get-ADGroupMember -Recursive it errors our. I'm assuming the issue is PS trying looking for the nested membeship of a group located on one of our trusted domains but looking only on the current domain of the Administrators group.
PowerShell Script (replaced server with example domain):
$ADGroup = Get-ADGroup -identity "administrators" -Server example.domain.com
Get-ADGroupMember -Identity $ADGroup -Server example.domain.com -Recursive | Out-GridView
Resulting Error Message (replaced server with example domain):
PS H:\> $ADGroup = Get-ADGroup -identity "administrators" -Server example.domain.com
Get-ADGroupMember -Identity $ADGroup -Server example.domain.com -Recursive | Out-GridView
Get-ADGroupMember : There is no such object on the server
At line:2 char:1
+ Get-ADGroupMember -Identity $ADGroup -Server example.domain.com -Recursive | Out- ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (CN=Administrato...e,DC=domain,DC=com:ADGroup) [Get-ADGroupMember], ADIdentityNotFoundExc
eption
+ FullyQualifiedErrorId : There is no such object on the server,Microsoft.ActiveDirectory.Management.Commands.GetADGroupMember

Answer 1

From the docs for Get-ADGroupMember:
Notes
This cmdlet does not work when a group has members located in a
different forest, and the forest does not have Active Directory Web
Service running.
Yes your assumption is correct. (Without an exact error message) You can only enumerate membership from one domain at a time. i.e.
Get-ADGroup MyGroup -Server ContosoDC01 | Get-ADGroupMember -Recursive -Server ContosoDC01
Adding -Server highlights that you can only specify one domain that you can enumerate from at a time. Indeed, a straight up Get-ADGroupMember will list the distinguished names and SID's for the users/groups, including the SID's for the users/groups from the other domains. But that is all that AD stores, the SID of the user/group. It does not store the membership.
To get the membership requires another, separate, call to the other domain to enumerate; and most of the time, cross domain permissions are not set up to allow your current account access to the other domain, and you get:
Get-ADGroupMember : The operation being requested was not performed because the user has not been authenticated