powershell - Get-ADGroupMember : The size limit for this request was exceeded

Question

I am trying to pull groups in from a text file and one of my groups is too large, 80,000 people.

How do I get this to work l, it outputs how I want it.

$groups = Get-Content c:empADGroups.txt

foreach($group in $groups) {
    @(Get-ADGroup $group -Properties Member| Select-Object -ExpandProperty Member).Count
    Get-ADGroupMember -Identity $group |
        Get-ADObject -Properties Name, DisplayName |
        Select-Object -Property @{n="Username";e={$_.Name}}, DisplayName,
            @{n="AD Group";e={$group}} |
        Export-Csv C:UsersDesktopGroupsInfo.CSV -NoTypeInformation -Append
}

Answer 1

The number of objects that Get-ADGroupMember can return is restricted by a limit in the ADWS (Active Directory Web Services):

MaxGroupOrMemberEntries

5000

Specifies the maximum number of group members (recursive or non-recursive), group memberships, and authorization groups that can be retrieved by the Active Directory module Get-ADGroupMember, Get-ADPrincipalGroupMembership, and Get-ADAccountAuthorizationGroup cmdlets. Set this parameter to a higher value if you anticipate these cmdlets to return more than 5000 results in your environment.

According to this thread you should be able to work around it by querying group objects and expanding their member property (if you can't increase the limit on the service):

Get-ADGroup $group -Properties Member |
    Select-Object -Expand Member |
    Get-ADUser -Property Name, DisplayName

Beware, though, that this is likely to be slow, because you'll be sending thousands of requests. It might be better to build a hashtable of all users:

$users = @{}
Get-ADUser -Filter '*' -Property Name, DisplayName | ForEach-Object {
    $users[$_.DistinguishedName] = $_
}

so that you can look them up by their distinguished name:

Get-ADGroup $group -Properties Member |
    Select-Object -Expand Member |
    ForEach-Object { $users[$_] }