Get-ADGroupMember -identity "Applications" -recursive|
Where-Object {$_.distinguishedName -like "*OU=Apps,OU=Security*" }| 
Select Name,SamAccountName |
Sort -Property Name |
Export-csv -path C:\Members.csv -NoTypeInformation

Purpose: I'm attempting to list users accounts who belong to a specific group but only those users from a specified OU.

The script above ran perfectly yesterday when I wrote it, producing exactly what I need.  However, when I came into work today, and working in the same session of Powershell, I received the following:

Get-ADGroupMember : The size limit for this request was exceeded
At line:1 char:1

I then closed the session and attempted to run this script again but keep receiving the same error.  I don't want to change the ADWS settings to extend the size, is there an alternative or some modification I can do to achieve the same result?

Please advise.  Thanks.

Hi,

You may need to use DirectorySearcher methods instead. Here's some information and a sample script from the repository:

https://blogs.technet.com/b/heyscriptingguy/archive/2010/08/23/use-the-directorysearcher-net-class-and-powershell-to-search-active-directory.aspx?Redirected=true

http://technet.microsoft.com/en-us/library/ff730967.aspx

http://gallery.technet.microsoft.com/scriptcenter/List-Members-of-Large-Group-0eea0132

Yes that's one of the annoying limitations of AD cmdlets, which don't seem to be very size friendly.

However, I'm able to list all 21,000 members of one of my groups using Get-ADObject:

$searchRoot = 'OU=Apps,OU=Security,DC=CONTOSO,DC=LOCAL'
if ($groupDN = Get-ADGroup -Filter:{ name -eq 'MyGroup' } -ResultSetSize:1 | Select-Object -ExpandProperty 'DistinguishedName')
{
	$ldapFilter = '(&(objectclass=user)(objectcategory=person)(memberof:1.2.840.113556.1.4.1941:={0}))' -f $groupDN
	Get-ADObject -LDAPFilter:$ldapFilter -SearchBase:$searchRoot -ResultSetSize:$null -ResultPageSize:1000 -Properties:@('samAccountName') | Select-Object 'Name', 'samAccountName' | Sort-Object -Property 'Name' | Export-Csv -Path:'C:\Members.csv' -NoTypeInformation
}

This method bypasses the MaxGroupOrMemberEntries limitation.

• Marked as answer by Pigtaru Monday, July 29, 2013 4:02 PM

Thanks Mike and Averjoe, Get-ADObject is the way to go.

This works for me: 

$Members = Get-ADGroup "YourLargeGroup" -Properties Member | Select-Object -ExpandProperty Member

This works for me: 

$Members = Get-ADGroup "YourLargeGroup" -Properties Member | Select-Object -ExpandProperty Member

You haven't hit the limit yet then.

Get-ADGroup doesn't have the same limitation, it's Get-ADGroupMember that has the issue.

The only problem is that Get-ADGroup doesn't include any friendly user information, only the distinguished names.

A popular workaround is to pipe the results of Get-ADGroup into Get-ADUser to provide more friendly information.

(Get-ADGroup "TestGroup" -properties members).members |
Get-ADUser -properties displayName | Select-Object displayName

• Proposed as answer by xxjergerxx Thursday, October 02, 2014 8:49 PM

That's what I get for not reading closely enough. =]

Thank you all this helped resolve my issues with comparing larger groups!

Thank you. This works like a charm!

In our case, the one "large group" simply has several other smaller groups as members, so I was able to use your same logic and pipe this back into the Get-ADGroupMember cmdlet such as this:

PS C:\> $SDComm = Get-ADGroup "sd communications" -Properties Member | Select-Object -ExpandProperty Member | Get-ADGroupMember -Recursive

PS C:\> $SDComm.Count
5971

The $SDComm variable contains an array of all the Group Members that you could then do something else with, if needed.

U can go this way as well

get-aduser -filter * -searchBase "ou=users,dc=contoso,dc=com" -properties memberof |
?{$_.memberof -match "groupname"} |
select samaccountname

• Edited by Mekac 24 minutes ago