79

I am on Windows 8 connected to domain.

I wish to view the users and groups of an AD Security group. I am not the owner of the group. The command:

net group /domain TheGroupName

shows the direct users of that group but does not show the groups within the group.

As an alternative to the Windows 8, I also have remote access to a Windows Server 2008 R2 and am an admin for that machine but not an admin for the domain. The program "dsget" does not appear to be installed.

This question is expanding on this one (511715)

8
  • If you want a better answer to an already existing question. The proper procedure is to offer a bounty to that existing question.
    – Ramhound
    Aug 21, 2014 at 18:13
  • 1
    That question has been answered as it was phased. This is a new but very related question.
    – crokusek
    Aug 21, 2014 at 18:15
  • What makes you think you should have access to obtain the lists of users and groups if you aren't a domain administrator (or have the appropriate specific permission, whatever that might be, on your domain account)? To me the opposite would seem intuitive.
    – user
    Aug 21, 2014 at 18:15
  • That command works for me now, and as far as I know I am not a Domain Admin. Are you saying I must be? I don't think I am the owner of the group either.
    – crokusek
    Aug 21, 2014 at 18:15
  • 1
    The 'Search Active Directory' function from My Computer->Network will grant you the access to view groups and basic user information without special permissions.
    – Abraxas
    Aug 21, 2014 at 18:37

3 Answers 3

106

Go to 'Computer', click on 'Network' from the left menu, in the top bar select 'Search Active Directory'

You should be able to search for groups and view membership here, even if not an admin.

Access 'Search Active Directory'

8
  • 5
    "So easy a non-domain admin can do it." I didn't realize 'Computer' meant within explorer or Alt-Q 'Network'. Can even double click to drill down. Thanks. Don't know why this was not an answer to the linked question, because its only for Windows 8?
    – crokusek
    Aug 21, 2014 at 18:41
  • 1
    This dialog has been around forever. IIRC Windows 2000 contains it, too.
    – Daniel B
    Aug 22, 2014 at 7:15
  • 17
    Command line (or Run) equivalent: "C:\Windows\System32\rundll32.exe" dsquery.dll,OpenQueryWindow
    – Trisped
    Aug 7, 2015 at 17:43
  • 2
    Where is the equivalent in Windows 10?
    – flickerfly
    Jan 4, 2017 at 17:11
  • 3
    @flickerfly in W10, just click on the top of the window on Network (File Network View) and you'll see the "Search Active Directory" thing. seems that "ribbon" (is that what it's called ?) is hidden by default. I've added another answer with a more straightforward way to call this program, and I have a handy shortcut to that command now. Feb 2, 2017 at 10:21
44

Run this from a command prompt to get the complete membership of an AD group (users AND groups). Tested on Windows 10.

Rundll32 dsquery.dll OpenQueryWindow

There's a handy Advanced Tab in there that supports partial string searches (starting with, ending with).

5
  • 2
    Works on Windows 7 as well. Cheers.
    – xhafan
    Nov 22, 2017 at 10:42
  • Less clicking, same results +1
    – Randolph
    May 22, 2018 at 21:10
  • 1
    To make this more accessible: Add a "start" infront, put this in userq.bat in system32. Then open the dialog via the Run-dialog (WINDOWS + R) and userq.
    – Panki
    Jun 27, 2019 at 10:37
  • This doesn't seem to list the members of a group. It only lists the groups. Feb 4, 2020 at 15:40
  • How can I query other domain objects. With this command I can query only object of the domain to which my laptop is connected.
    – sagar
    Jun 12, 2020 at 9:52
13

Sysinternals offers AD Explorer, a utility for listing the complete LDAP structure of an AD forest. It’s slighty overkill for your intended use, though.

I don’t know which permissions exactly are necessary for querying this data, but I guess any logged-in user can do it. I never had any problems querying just about everything, but maybe the domain at work isn’t secured properly.

Usability note: You need not enter your credentials if you’re logged on as a domain user.

You do, however, need the IP address or host name of a Domain Controller. It’s likely this is the same as your DNS server, so just fire up nslookup and try the address displayed there.

2
  • 2
    You can open up a command prompt and do "echo %LOGONSERVER%" to see the AD server the computer used for authentication. In addition, you should be able to do "nslookup my.domain.name" to list all the AD servers. So if you login using "mydomain\myuser" try "nslookup mydomain"
    – nijave
    Aug 26, 2016 at 0:15
  • 1
    leaving all fields (IP, User, Pw) blank worked for me
    – trykyn
    May 9, 2021 at 12:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .