Resolved Listing members of AD groups...

Greetings---- I've got some pieces of this puzzle, but not 100%, so I thought I'd ask here. It's audit-time at work, and we need to examine the members of every group in our AD. The only trick, is that everyone's Account Name is their employee ID number, like "123456 ", which is not really human-readable. Of course their Friendly Name is "Smith, Joe ". Here's what I do so far:

1.) The group members show up as SIDs only because the members are in a trusted domain, not the same domain as the group itself. This produces the "SID" of all the members of group "Accounting ":

----->dsget group "CN=Accounting,OU=Groups,DC=xxx,DC=YYYYY,DC=ZZZZZ" -members | findstr ForeignSecurity

2.)This resolves the SID to the Account Name of "123456 "

----> ([System.Security.Principal.SecurityIdentifier]( "PUT-SID-HERE ")).Translate([System.Security.Principal.NTAccount])

3.) I need the 3rd step which resolves the Account Name of 123456 to the equivalent Friendly Name of "Smith, Joe "

OR........ If someone can show me a totally different method, or a tool that can be used to do this, it will save huge amounts of time for us!

Thanks!

 

is this group dead? the last post was almost 6 months ago....