Get-ADGroupMember : The size limit for this request was exceeded

The number of objects that Get-ADGroupMember can return is restricted by a limit in the ADWS (Active Directory Web Services):

MaxGroupOrMemberEntries

5000

Specifies the maximum number of group members (recursive or non-recursive), group memberships, and authorization groups that can be retrieved by the Active Directory module Get-ADGroupMember, Get-ADPrincipalGroupMembership, and Get-ADAccountAuthorizationGroup cmdlets. Set this parameter to a higher value if you anticipate these cmdlets to return more than 5000 results in your environment.

According to this thread you should be able to work around it by querying group objects and expanding their member property (if you can’t increase the limit on the service):

Get-ADGroup $group -Properties Member |
    Select-Object -Expand Member |
    Get-ADUser -Property Name, DisplayName

Beware, though, that this is likely to be slow, because you’ll be sending thousands of requests. It might be better to build a hashtable of all users:

$users = @{}
Get-ADUser -Filter '*' -Property Name, DisplayName | ForEach-Object {
    $users[$_.DistinguishedName] = $_
}

so that you can look them up by their distinguished name:

Get-ADGroup $group -Properties Member |
    Select-Object -Expand Member |
    ForEach-Object { $users[$_] }

Leave a Comment