Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

xADGroup: Fails to add members from parent domain #152

Closed
RobBiddle opened this issue Apr 17, 2017 · 3 comments · Fixed by #240
Closed

xADGroup: Fails to add members from parent domain #152

RobBiddle opened this issue Apr 17, 2017 · 3 comments · Fixed by #240
Labels
bug The issue is a bug.

Comments

@RobBiddle
Copy link

xADGroup when run on a domain controller in a child domain is unable to add objects from the parent domain.

I think solving this issue would also solve issue #99

The problem stems from the way Get-ADGroup & Get-ADGroupMember function; neither of these cmdlets return objects from a different domain unless the -Server parameter is used to specify the domain.

The Test portion of xADGroup works properly when verifying group membership containing objects in the parent domain (at least when using MembershipAttribute='DistinguishedName') since it is able to use Get-ADGroupMember to query the group members from the local domain successfully, and that cmdlet returns the proper DistinguishedName of the member object.

The Set portion of xADGroup fails because Get-ADGroup looks in the local domain only and then fails to find the desired member object if that object exists in another domain.

This could be solved (at least when specifying MembershipAttribute='DistinguishedName') by parsing the DN of each item listed in (Members,MembersToInclude,MembersToExclude) and then attempt to query the appropriate domain for the corresponding objects

@RobBiddle
Copy link
Author

RobBiddle commented Apr 17, 2017

@RobBiddle
Copy link
Author

@kwirkykat I've written some forest related functions that may be useful for fixing this issue, possibly without a breaking change:
https://github.com/RobBiddle/ActiveDirectoryForest/blob/master/ActiveDirectoryForest.psm1

RobBiddle added a commit to RobBiddle/xActiveDirectory that referenced this issue Dec 20, 2017
…up membership consisting of AD Objects from multiple AD Domains.

When using a MembershipAttribute of DistinguishedName the Member Objects will now be properly obtained from the Objects' Domain rather than the Domain of the AD Group.
@RobBiddle
Copy link
Author

@johlju johlju added bug The issue is a bug. in progress The issue is being actively worked on by someone. labels May 8, 2018
@johlju johlju changed the title xADGroup fails to add members from parent domain xADGroup: Fails to add members from parent domain May 8, 2018
johlju pushed a commit that referenced this issue Mar 5, 2019
- Updated xADGroup to support group membership from multiple domains (issue #152).
johlju pushed a commit to johlju/ActiveDirectoryDsc that referenced this issue Apr 19, 2019
- Updated xADGroup to support group membership from multiple domains (issue dsccommunity#152).
@johlju johlju removed the in progress The issue is being actively worked on by someone. label Jun 12, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug The issue is a bug.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants