Dimitri's Wanderings

Get-ADDomainController, Get-ADUser, Get-ADComputer, Get-ADObject: A referral was returned from the server

 
  • Your Name
  • Jul 12, 2021

When you are using Active Directory Powershell cmdlets such as Get-ADDomainController, Get-ADUser, Get-ADComputer, Get-ADObject, you may receive the following error message:

<pre class="wp-block-code">```
A referral was returned from the server


Such an exception is linked to the difficulty those commands have to work in a multi-domain environment, whether that multi-domain be a single forest with multiple child domains, various trust relationships.

Let’s imagine you have a forest with domains called Top, Child1 and Child2. If your user is Top\\myadmin and your trying to get information for the domain controller dc1child1 in the child domain child1, you may want to issue the following command from a machine in the “Top” domain


$MyDCInfo = Get-ADDomainController dc1child1
```

The answer will be:

```

TerminatingError(Get-ADDomainController): "A referral was returned from the server"
Get-ADDomainController : A referral was returned from the server
At line:1 char:94
+ ... oryServers | % { $domaincontrollers[$_]=Get-ADDomainController $_  }}
+                                             ~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (dc1child1.child1.com:ADDomainController) [Get-ADDomainController], ADException
    + FullyQualifiedErrorId : 
ActiveDirectoryServer:8235,Microsoft.ActiveDirectory.Management.Commands.GetADDomainController
Get-ADDomainController : A referral was returned from the server
```

To circumvent this, you must specify a target server from the domain you want the object from. In our case, you will have to type,:

```

$MyDCInfo = Get-ADDomainController dc1child1 -Server dc1child1
```

Here the name is repeated twice, as the object we are searching for is also the name of the server you’re asking to answer. But in such a case as a domain user, this would be:

```

$myuser = Get-ADUser mychilduser -Server dc1child1
```

Note that to find a correct Domain Controller for a given domain, Get-ADDomainController with the discover switch may be very helpful.
Search