Fix Active Directory PowerShell cmdlets Get-ADUser and Get-ADObject error "A referral was returned from the server" using Global Catalogs or chasing referrals.

You can get Active Directory objects using the Active Directory PowerShell module's cmdlets such as Get-ADObject, Get-ADComputer and Get-ADObject etc.

Typically this works fine however when you cross domain boundaries this can become more complicated and you may see the error

Get-ADObject : A referral was returned from the server.

Take for example the following you are in demo2022.int and you're trying to find the display name of a user in europe.demo2022.int with the distinguished name "CN=Terry,DC=europe,DC=2022,DC=int".

The domain controllers in demo2022 do not have this account so it can't be resolved - you can however as a Global Catalog server as they will contain a cut down version of the objects in the forest.

You can get a global catalog by finding one in the forest, you can then use the global catalog by specifying the port 3268 (Global Catalog) or 3269 (Global Catalog over SSL) if SSL is setup.

$globalCatalog = (Get-ADForest).GlobalCatalogs[0];
return Get-ADObject -Server "$($globalCatalog):3268" -Identity $Identity;

But you may still get the referral if the Global Catalog doesn't have the user information - because for example the Global Catalog doesn't contain information from an another domain - in this case the tree.tailspin.int domain.

In this case we need to chase the referral. The error message will actually give us the name of a server in the tree.tailspin.int domain (or at least the FQDN of the domain) in the contents of the exception which will be of type.

Microsoft.ActiveDirectory.Management.ADReferralException

https://learn.microsoft.com/dotnet/api/microsoft.activedirectory.management.adreferralexception

Here's an example of chasing a referral using PowerShell - notice we don't use the Global Catalog this time for one we don't need it the referral contains the actual domain that contains the object and two the exception tells us the domain to use - but this doesn't guarantee the Domain Controller we'll connect to in the tree.tailspin.int domain will be a Global Catalog.

# Gets the Active Directory object with the specified identity.
Function Get-ActiveDirectoryObject
{
    [CmdletBinding()]
    param(

        [Parameter()]
        [String] $Identity    
    )
    process
    {
        $globalCatalog = (Get-ADForest).GlobalCatalogs[0];
        try
        {
            return Get-ADObject -Server "$($globalCatalog):3268" -Identity $Identity;
        }
        catch [Microsoft.ActiveDirectory.Management.ADReferralException]
        {
            $referralHost = $Error[0].Exception.Referral.Host;
            return Get-ADObject -Server $referralHost -Identity $Identity;
        }
    }
}

 

Get-ActiveDirectoryObject -Identity "CN=Administrator,CN=Users,DC=tree,DC=tailspin,DC=int"; 

 While you're here -
Why not check out our Active Directory Documentation Tool?