Get-ADGroupMember limitations

Question

Hi All,
I am trying to run the following query:
get-adgroup -Filter * -SearchBase "OU=Test,dc=domain,dc=com" | get-adgroupmember | get-aduser -Properties * | Select Name,postalCode
and get the following error: Get-ADUser : A referral was returned from the server
Test OU contains Universal Distribution Groups with memebers from different domains in the same forest.
So I've figured running agains GC server should fix it but I've hit a limitation:
get-adgroup -Server dcgc01.domain.com:3268 -Filter * -SearchBase "OU=Test,dc=domain,dc=com" | get-adgroupmember | get-aduser -Properties * | Select Name,postalCode
and got the following error: Get-ADGroupMember : The operation is not supported on Global Catalog port.
It's Server 2008R2 with PS version 2
Thank you,
Naz

Answer 1

Not being able to control referral chasing behavior is my biggest gripe with the AD module right now.  If you're in a multi-domain environment, you may find it better to either use the Quest cmdlets, or write your own code using the System.DirectoryServices
namespace.
In this case, though, I'd just grab the Member attribute of each group, and make individual calls to Get-ADUser in a foreach loop.  This sidesteps the problem and allows you to keep using the simpler AD cmdlets:
Get-ADGroup -Properties member -Filter * -SearchBase "OU=Test,dc=domain,dc=com" |
ForEach-Object {
$group = $_
foreach ($dn in $group.member)
Get-ADUser $dn -Properties Name,postalCode |
Select-Object Name,postalCode
Or, alternatively:
Get-ADGroup -Properties member -Filter * -SearchBase "OU=Test,dc=domain,dc=com" |
Select-Object -ExpandProperty member |
ForEach-Object {
$dn = $_
Get-ADUser $dn -Properties Name,postalCode |
Select-Object Name,postalCode