Use the get_pending_zone_groups command to check Active Directory and return a Tcl list of pending import groups for the currently selected zone. Pending import groups are group profiles that have been imported from Linux or UNIX computers, but not yet mapped to any Active Directory group. If executed in a script, this command does not output its list to stdout, and no output appears in the shell where the script is executed. Use list_pending_zone_groups to output the list to stdout.

Zone type

Classic and hierarchical






This command takes no options.


This command takes no arguments.

Return value

This command returns a Tcl list of pending import group profiles that have been imported into the currently selected zone. Each entry in the list contains the following fields, separated by colons (:):

  • Distinguished name (DN) of the pending import group as it is stored in Active Directory. The distinguished name for each pending import group includes a prefix that consists of “PendingGroup” and the globally unique identifier (GUID) for the group.
  • UNIX group name.
  • Numeric group identifier (GID).



The command returns output in the form of:


This sample command might return output similar to the following:

CN=PendingGroup_573135e7-edd9-46b9-9cbd-c839570a90c8,CN=Groups, CN=bean_pz,CN=Zones,CN=Centrify,DC=win2k3,DC=test:root:0
CN=PendingGroup_7878065a-4d2f-4749-8f3b-6ffe24303f6a,CN=Groups, CN=bean_pz,CN=Zones,CN=Centrify,DC=win2k3,DC=test:unixgrp:5000

Related commands

Before you use this command, you must have a currently selected zone stored in memory. The following command performs actions related to this command:

  • select_object retrieves the specified Active Directory object and its attributes from Active Directory and stores the object in memory.
  • get_object_field enables you to view and work with the pending import group.