# Get AD Group users?

**URL:** <https://forum.inductiveautomation.com/t/get-ad-group-users/51893>\
**Category:** Ignition\
**Tags:** perspective, ignition81\
**Created:** [October 13, 2021, 1:56pm UTC](https://forum.inductiveautomation.com/t/get-ad-group-users/51893 "2021-10-13T13:56:37Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![iceberg](https://avatars.discourse-cdn.com/v4/letter/i/e99b99/32.png) [@iceberg](https://forum.inductiveautomation.com/u/iceberg)\
**Post date:** [October 13, 2021, 1:56pm UTC](https://forum.inductiveautomation.com/t/get-ad-group-users/51893/1 "2021-10-13T13:56:37Z")

</div>

Does anyone know how to get a list of users in an AD group within ignition? It seems like this should be possible, but I can’t find a built in function that does this. My user source is a full active directory setup.

---

<div class="post-metadata">

**Author:** ![zacht](https://avatars.discourse-cdn.com/v4/letter/z/ea5d25/32.png) [@zacht](https://forum.inductiveautomation.com/u/zacht)\
**Post date:** [October 13, 2021, 2:23pm UTC](https://forum.inductiveautomation.com/t/get-ad-group-users/51893/2 "2021-10-13T14:23:21Z")

</div>

[system.user.getUsers](https://docs.inductiveautomation.com/display/DOC81/system.user.getUsers)(userSource)

---

<div class="post-metadata">

**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\
**Post date:** [October 13, 2021, 2:24pm UTC](https://forum.inductiveautomation.com/t/get-ad-group-users/51893/3 "2021-10-13T14:24:50Z")

</div>

You could potentially build in a script like this:

```auto
usersInGroup = [user for user in system.user.getUsers('YourUserSource') if 'YourRole' in user.getRoles()]

```

---

<div class="post-metadata">

**Author:** ![iceberg](https://avatars.discourse-cdn.com/v4/letter/i/e99b99/32.png) [@iceberg](https://forum.inductiveautomation.com/u/iceberg)\
**Post date:** [October 13, 2021, 3:37pm UTC](https://forum.inductiveautomation.com/t/get-ad-group-users/51893/4 "2021-10-13T15:37:45Z")

</div>

@zacht @lrose The system.user.getUsers function doesn’t appear to actually get users from our active directory. It just pulls some ignition users that were setup to show for all user sources.

When I go into the user source that I working with, no users show.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/7/1763dc38eef4ca17826d468837b188d2f4ee0cca.png)

---

<div class="post-metadata">

**Author:** ![zacht](https://avatars.discourse-cdn.com/v4/letter/z/ea5d25/32.png) [@zacht](https://forum.inductiveautomation.com/u/zacht)\
**Post date:** [October 13, 2021, 3:51pm UTC](https://forum.inductiveautomation.com/t/get-ad-group-users/51893/5 "2021-10-13T15:51:06Z")

</div>

In that case, I think your user source connection is setup incorrectly. You probably shouldn’t show the settings for the connection to the internet, but I would double check those. Maybe have support help.

---

<div class="post-metadata">

**Author:** ![chandler](https://avatars.discourse-cdn.com/v4/letter/c/e9a140/32.png) [@chandler](https://forum.inductiveautomation.com/u/chandler)\
**Post date:** [October 13, 2021, 4:11pm UTC](https://forum.inductiveautomation.com/t/get-ad-group-users/51893/6 "2021-10-13T16:11:09Z")

</div>

You can query a list of users from active directory using an ldap query. You will need to set up the AD server as a linked server though, I think. This works for me on SQL Server:

```auto
select * from OpenQuery (AD_Linked_Server_Name,
'SELECT mail, mobile, telephoneNumber, title, sn, givenName, SAMAccountName, department
FROM ''LDAP://OU=YourOrganizationalUnit,DC=YourDC,DC=YourDC''
WHERE objectClass = ''user''
)

```

---

<div class="post-metadata">

**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\
**Post date:** [October 20, 2021, 9:54pm UTC](https://forum.inductiveautomation.com/t/get-ad-group-users/51893/7 "2021-10-20T21:54:39Z")

</div>

@chandler, that sounds interesting and would save adding Python LDAP libraries.

> You will need to set up the AD server as a linked server though, I think.

How do you do that? ODBC connection? What driver? SQL Server?

---

<div class="post-metadata">

**Author:** ![chandler](https://avatars.discourse-cdn.com/v4/letter/c/e9a140/32.png) [@chandler](https://forum.inductiveautomation.com/u/chandler)\
**Post date:** [October 20, 2021, 10:59pm UTC](https://forum.inductiveautomation.com/t/get-ad-group-users/51893/8 "2021-10-20T22:59:17Z")

</div>

@Transistor If you are using SQL Server and SQL Server Management Studio you can add them under a server connection. Expand `Server Objects`, then right click `Linked Servers` and click `New Linked Server`. Once you get it configured, you can reference the name you gave the linked server in the query I showed above.

---

<div class="post-metadata">

**Author:** ![iceberg](https://avatars.discourse-cdn.com/v4/letter/i/e99b99/32.png) [@iceberg](https://forum.inductiveautomation.com/u/iceberg)\
**Post date:** [January 28, 2022, 12:56pm UTC](https://forum.inductiveautomation.com/t/get-ad-group-users/51893/9 "2022-01-28T12:56:45Z")

</div>

Just to close the loop on this thread, the issue for this ended up being the username and password that our admin had used to setup the user source were incorrect. I was able to get them to switch to an appropriately setup username and password, and now the functionality works.