-
Notifications
You must be signed in to change notification settings - Fork 141
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
xADGroup: Fails to add members from parent domain #152
Comments
This MSDN article from 2010 explains root of the problem: |
@kwirkykat I've written some forest related functions that may be useful for fixing this issue, possibly without a breaking change: |
…up membership consisting of AD Objects from multiple AD Domains. When using a MembershipAttribute of DistinguishedName the Member Objects will now be properly obtained from the Objects' Domain rather than the Domain of the AD Group.
I have fixed this issue!!! |
- Updated xADGroup to support group membership from multiple domains (issue #152).
- Updated xADGroup to support group membership from multiple domains (issue dsccommunity#152).
xADGroup when run on a domain controller in a child domain is unable to add objects from the parent domain.
I think solving this issue would also solve issue #99
The problem stems from the way Get-ADGroup & Get-ADGroupMember function; neither of these cmdlets return objects from a different domain unless the -Server parameter is used to specify the domain.
The Test portion of xADGroup works properly when verifying group membership containing objects in the parent domain (at least when using MembershipAttribute='DistinguishedName') since it is able to use Get-ADGroupMember to query the group members from the local domain successfully, and that cmdlet returns the proper DistinguishedName of the member object.
The Set portion of xADGroup fails because Get-ADGroup looks in the local domain only and then fails to find the desired member object if that object exists in another domain.
This could be solved (at least when specifying MembershipAttribute='DistinguishedName') by parsing the DN of each item listed in (Members,MembersToInclude,MembersToExclude) and then attempt to query the appropriate domain for the corresponding objects
The text was updated successfully, but these errors were encountered: