Advanced Windows PowerShell Scripting Video Training

Advanced Windows PowerShell Scripting Video Training
Advanced Windows PowerShell Scripting Video Training

Thursday, March 19, 2015

Active Directory Module Cmdlets will not Work

On today, I noticed an IT pro that was not able to get the Get-ADGroupMember cmdlet to work, but was able to utilized an [ADSI] query.  He recently acquired his first Windows Server 2008 R2 Domain Controllers.  My first thoughts went to the Active Directory Web Services. This is service is what the Active Directory Module for PowerShell uses and must be running on at least one of your Domain Controllers.  When I shut down this service and then attempted to access a groups membership, I received the following:

PS C:\> Get-ADGroupMember -Identity "Domain Admins"


Get-ADGroupMember : Unable to find a default server with Active Directory Web Services running.

At line:1 char:1

+ Get-ADGroupMember -Identity "Domain Admins"

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : ResourceUnavailable: (Domain Admins:ADGroup) [Get-ADGroupMember], ADServerDownException

    + FullyQualifiedErrorId : ActiveDirectoryServer:1355,Microsoft.ActiveDirectory.Management.Commands.GetADGroupMember


He did not provide the full error message, but the last line matched what he provided.  Since it appears that the Service is not running, I asked him to go to each DC to verify it and if so, start it.

A good safety for you is to make sure that multiple Domain Controllers are running this service so that any scheduled tasks that rely on it will always be able to access the Active Directory database.  To get an idea who which on your Domain Controllers are running this service, try this command:




Get-ADDomainController |

    Select-Object -ExpandProperty Name |

    ForEach-Object {Get-Service -Name ADWS -ComputerName $_}

No comments: