How to get all groups that a user is a member of

Question

PowerShell s Get-ADGroupMember cmdlet returns members of a specific group  Is there a cmdlet or property to get all the groups that a particular user is a member of      I fixed my mistake  Get-Member should be Get-ADGroupMember

User · Answer

Get-Member is not for getting user s group membership  If you want to get a list of groups a user belongs to on the local system  you can do so by    query    ASSOCIATORS OF  Win32 Account Name  DemoUser1  Domain  DomainName   WHERE ResultRole GroupComponent ResultClass Win32 Account   Get-WMIObject -Query  query   Select Name   In the above query  replace DemoUser1 with the username you want and the DomainName with either your local computer name or domain name

User · Answer

Get-Member is a cmdlet for listing the members of a  NET object   This has nothing to do with user group membership   You can get the current user s group membership like so   PS gt   System Security Principal WindowsIdentity   GetCurrent   Groups             Format-Table -auto  BinaryLength AccountDomainSid    Value ------------ ----------------    -----           28 S-1-5-21-           S-1-5-21-2229937839-1383249143-3977914998-513           12                     S-1-1-0           28 S-1-5-21-           S-1-5-21-2229937839-1383249143-3977914998-1010           28 S-1-5-21-           S-1-5-21-2229937839-1383249143-3977914998-1003           16                     S-1-5-32-545       If you need access to arbitrary users  group info then  tiagoinu suggestion of using the Quest AD cmdlets is a better way to go

User · Answer

Single line  no modules necessary  uses current logged user   New-Object System DirectoryServices DirectorySearcher  quot   amp  objectCategory User  samAccountName    env username    quot    FindOne   GetDirectoryEntry   memberOf  Kudos to this vbs powershell article  http   technet microsoft com en-us library ff730963 aspx

User · Answer

Get group membership for a user    strUserName    Primoz   strUser   get-qaduser -SamAccountName  strUserName  strUser memberof   See Get Group Membership for a User  But also see Quest s Free PowerShell Commands for Active Directory    Edit  Get-ADPrincipalGroupMembership command is included in Powershell since v2 with Windows 2008 R2   See kstrauss  answer below

User · Answer

Get-ADPrincipalGroupMembership USERLOGON   select name

User · Answer

First  import the activedirectory module   import-module activedirectory   Then issue this command   Get-ADGroupMember -Identity  group   foreach-object       Write-Host    SamAccountName     This will display the members of the specified group

User · Answer

I wrote a PowerShell function called Get-ADPrincipalGroupMembershipRecursive  It accepts the DSN of a user  computer  group  or service account  It retrieves an initial list of groups from the account s memberOf attribute  then recursively checks those group s memberships  Abbreviated code is below   Full source code with comments can be found here   function Get-ADPrincipalGroupMembershipRecursive           Param           string   dsn           array  groups                   obj   Get-ADObject  dsn -Properties memberOf      foreach   groupDsn in  obj memberOf               tmpGrp   Get-ADObject  groupDsn -Properties memberOf          if    groups   where      DistinguishedName -eq  groupDsn    Count -eq 0                  groups      tmpGrp                         groups   Get-ADPrincipalGroupMembershipRecursive  groupDsn  groups                      return  groups      Simple Example of how to use the function  username   Read-Host -Prompt  Enter a username   groups     Get-ADPrincipalGroupMembershipRecursive  Get-ADUser  username  DistinguishedName  groups   Sort-Object -Property name   Format-Table

User · Answer

GET-ADUSER    Identity USERNAME    Properties MemberOf   Select-Object MemberOf  MemberOf

User · Answer

This is the simplest way to just get the names   Get-ADPrincipalGroupMembership  YourUserName     Returns distinguishedName   CN users OU test DC SomeWhere GroupCategory       Security GroupScope          Global name                testGroup objectClass         group objectGUID          2130ed49-24c4-4a17-88e6-dd4477d15a4c SamAccountName      testGroup SID                 S-1-5-21-2114067515-1964795913-1973001494-71628  Add a select statement to trim the response or to get every user in an OU every group they are a user of   foreach   user in  get-aduser -SearchScope Subtree -SearchBase  oupath -filter   -Properties samaccountName  MemberOf   select samaccountName    Get-ADPrincipalGroupMembership  user samaccountName   select name

User · Answer

While there are many excellent answers here  there is one which I was personally looking for that was missing   Once I figured it out - I thought I should post it in case I want to find it later  or it actually manages to help someone else at some point   Get-ADPrincipalGroupMembership username   Format-Table -auto   A second approach for presenting this is to specify the individual columns you are interested in eg   Get-ADPrincipalGroupMembership username   select name  GroupScope  GroupCategory   This gives all the AD groups the username belongs to - but also presents all of the default properties of each group formatted nicely as a table   The key benefit this gives you is you can see at a glance which are distribution lists   amp  which are Security groups   You can further see at a glance which are Universal  which are DomainLocal  amp  which are Global  Why would you care about this last bit    Universal group is a security or distribution group that contains users  groups  and computers from any domain in its forest as members  You can give universal security groups rights and permissions on resources in any domain in the forest   Global group is a group that can be used in its own domain  in member servers and in workstations of the domain  and in trusting domains  In all those locations  you can give a global group rights and permissions and the global group can become a member of local groups  However  a global group can contain user accounts that are only from its own domain  Domain local group is a security or distribution group that can contain universal groups  global groups  other domain local groups from its own domain  and accounts from any domain in the forest  You can give domain local security groups rights and permissions on resources that reside only in the same domain where the domain local group is located

User · Answer

I use this simple oneliner to recursively search all the groups a user is member of  Get-ADPrincipalGroupMembership  UserName   foreach-object   Get-ADPrincipalGroupMembership    SamAccountName   select SamAccountName    To filter the groups to find out if user is member of a specific group i use this  if   Get-ADPrincipalGroupMembership  UserName   foreach-object   Get-ADPrincipalGroupMembership    SamAccountName   select SamAccountName     where-object     SamAccountName -like  quot   Groupname  quot       write-host  quot Found quot    else   write-host  quot not a member of group  Groupname quot

User · Answer

If you cannot get Get-ADPrincipalGroupMembership to work for you could try logging in as that user then use    id    Security Principal WindowsIdentity   GetCurrent    groups    id Groups   foreach-object     Translate  Security Principal NTAccount     groups   select

User · Answer

Get-QADUser -SamAccountName LoginID         MemberOf     Get-QADGroup   select name

User · Answer

Use   Get-ADPrincipalGroupMembership username   select name   export-CSV username csv   This pipes output of the command into a CSV file

User · Answer

I couldn t get the following to work for a particular user   Get-ADPrincipalGroupMembership username   It threw an error that I was not willing to troubleshoot   I did however come up with a different solution using Get-ADUser   I like it a bit better because if you don t know the account name then you can get it based off of a wildcard on the user s actual name   Just fill in PartOfUsersName and away it goes    Get the groups that list of users are the member of using a wildcard search   string  UserNameLike     PartOfUsersName    Use   for wildcards here  array  AccountNames     Get-ADUser -Filter  Name -like  UserNameLike   SamAccountName  ForEach   AccountName In  AccountNames    Write-Host   nGETTING GROUPS FOR   AccountName ToUpper        Get-ADUser -Identity  AccountName -Properties MemberOf select MemberOf  MemberOf      Get-ADGroup select Name sort name         Huge props to schmeckendeugler and 8DH for getting me to this solution    1 to both of you

User · Answer

To get it recursive  you can use    lt         SYNOPSIS            Get all the groups that a user is MemberOf        DESCRIPTION         This script retrieves all the groups that a user is MemberOf in a recursive way        PARAMETER SamAccountName         The name of the user you want to check   gt   Param        String  SamAccountName    test        DomainUsersGroup    CN Domain Users CN Users DC domain DC net      Function Get-ADMemberOf       Param            Parameter ValueFromPipeline            PSObject    Group           String  DomainUsersGroup    CN Domain Users CN Users DC grouphc DC net            Process           foreach   G in  Group                 G   Get-ADGroup   Select -ExpandProperty Name             Get-ADGroup  G -Properties MemberOf  Select-Object Memberof   ForEach-Object                   Get-ADMemberOf    Memberof                                    Groups   Get-ADUser  SamAccountName -Properties MemberOf   Select-Object -ExpandProperty MemberOf  Groups     DomainUsersGroup  Groups   Get-ADMemberOf   Select -Unique   Sort-Object

User · Answer

Import-Module ActiveDirectory Get-ADUser -SearchBase  OU Users DC domain DC local  -Filter     foreach-object   write-host  User      Name -foreground green     Get-ADPrincipalGroupMembership    SamAccountName   foreach-object           write-host  Member Of      name           Change the value of -SearchBase to reflect the OU you need to list the users from     This will list all of the users in that OU and show you which groups they are a member of

User · Answer

When you do not have privileges to consult other member groups but you do have the privilege to consult group members  you can do the following to build a map of which user has access to which groups    groups   get-adgroup -Filter     sort name   select Name  users       foreach  group in  groups         groupUsers            groupUsers   Get-ADGroupMember -Identity  group Name   Select-Object SamAccountName      groupUsers               if   users ContainsKey    SamAccountName                 users    SamAccountName                            users    SamAccountName        group Name

User · Answer

This should provide you the details for current user  Powershell not needed   whoami  groups

User · Answer

Get-ADPrincipalGroupMembership will do this   Get-ADPrincipalGroupMembership username   select name  name ---- Domain Users Domain Computers Workstation Admins Company Users Company Developers AutomatedProcessingTeam

User · Answer

It is just one line    get-aduser joe bloggs -properties    memberof   end of

User · Answer

Old school way from CMD    net user mst999  domain

User · Answer

With user input and fancy output formatting    CmdletBinding SupportsShouldProcess  True    Param        Parameter Mandatory    True         String  UserName     Import-Module ActiveDirectory  If   UserName          UserName    UserName ToUpper   Trim         Res    Get-ADPrincipalGroupMembership  UserName   Measure-Object  Count      If   Res -GT 0             Write-Output   n           Write-Output   UserName AD Group Membership            Write-Output                                                                        Get-ADPrincipalGroupMembership  UserName   Select-Object -Property Name  GroupScope  GroupCategory   Sort-Object -Property Name   FT -A

User · Answer

Almost all above solutions used the ActiveDirecotry module which might not be available by default in most cases    I used below method  A bit indirect  but served my purpose    List all available groups  Get-WmiObject -Class Win32 Group  And then list the groups the user belongs to    System Security Principal WindowsIdentity   GetCurrent   Groups  Comparison can then be done via checking through the SIDs  This works for the logged in user  Please correct me if I am wrong  Completely new to PowerShell  but had to get this done for a work commitment

User · Answer

The below works well   get-aduser  username -Properties memberof   select -expand memberof   If you have a list of users    list    administrator   testuser1   testuser2   list                       user                get-aduser  user -Properties memberof             select -expand memberof               new-object PSObject -property   User  user Group

User · Answer

Studying all comments presented gave me a starting point  thanks for such  but left me with several unresolved issues   As result here is my answer   The code snippet provided does a little more than what is asked for but it provides helpful debugging info    array   script groupsdns       function Get-ADPrincipalGroupMembershipRecursive        Param   string   dn   int   level   0   array   groups             if   groupsdns   where      DistinguishedName -eq  dn    Count -ne 0     return  groups     dependency on next statement     groupsdns     Get-ADObject  dn -Properties MemberOf    Get-ADObject cannot find an object with identity   if   script groupsdns Contains  dn     return  groups      script groupsdns     dn    mo    Null    mo   Get-ADObject  dn -Properties MemberOf   Get-ADObject cannot find an object with identity    group     dn           level ToString      if   mo -eq  Null     group             group           groups     group   foreach   groupdn in  mo MemberOf            groups   Get-ADPrincipalGroupMembershipRecursive -dn  groupdn -level   level 1  -groups  groups       if   level -le 0             primarygroupdn    Get-ADUser -Identity  dn -Properties PrimaryGroup  PrimaryGroup       groups   Get-ADPrincipalGroupMembershipRecursive -dn  primarygroupdn -level   level 1  -groups  groups       return  groups    adusergroups   Get-ADPrincipalGroupMembershipRecursive -dn  aduser DistinguishedName  adusergroups   ft -AutoSize                   Out-File -Width 512 Get-ADPrincipalGroupMembershipRecursive txt  -Append  -Wrap     Sort-Object -Property Name

User · Answer

Putting this here for future reference  I m in the midst of an email migration  I need to know each user account and its respective group membership  and also I need to know each group and its respective members   I m using the code block below to output a CSV for each user s group membership   Get-ADUser -Filter        ForEach-Object          FileName      SamAccountName     csv           FileName         Get-ADPrincipalGroupMembership              Select-Object -Property SamAccountName  name  GroupScope  GroupCategory             Sort-Object -Property SamAccountName               Export-Csv -Path  FileName -Encoding ASCII           The export process for the groups and their respective members was a little convoluted  but the below works  The output filenames include the type of group  Therefore  the email distribution groups I need are should be the Universal and Global Distribution groups  I should be able to just delete or move the resulting TXT files I don t need   Get-ADGroup -Filter        Select-Object -Property Name  DistinguishedName  GroupScope  GroupCategory       Sort-Object -Property GroupScope  GroupCategory  Name        Export-Csv -Path ADGroupsNew csv -Encoding ASCII   MyCSV   Import-Csv -Path   ADGroupsNew csv -Encoding ASCII   MyCSV      ForEach-Object        FN      GroupScope             GroupCategory             Name     txt         FN       Get-ADGroupMember -Identity    DistinguishedName        Out-File -FilePath  FN -Encoding ASCII    FN

User · Answer

No need for long scripts when it is a simple one liner    QUEST Command   Get-QADUser -Identity john -IncludedProperties MemberOf   Select-Object MemberOf  MemberOf   MS AD Command   GET-ADUSER    Identity john    Properties MemberOf   Select-Object MemberOf  MemberOf   I find the MS AD cmd is faster but some people like the Quest ones better    Steve

User · Answer

A more concise alternative to the one posted by Canoas  to get group membership for the currently-logged-on user   I came across this method in this blog post  http   www travisrunyard com 2013 03 26 auto-create-outlook-mapi-user-profiles     ADSISEARCHER  samaccountname    env USERNAME    Findone   Properties memberof   An even better version which uses a regex to strip the LDAP guff and leaves the group names only     ADSISEARCHER  samaccountname    env USERNAME    Findone   Properties memberof -replace   CN               1    More details about using the  ADSISEARCHER  type accelerator can be found on the scripting guy blog  http   blogs technet com b heyscriptingguy archive 2010 08 24 use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory aspx

User · Answer

Get-ADUser -Filter   memberOf -RecursiveMatch  CN Administrators CN Builtin DC Fabrikam DC com    -SearchBase  CN Administrator CN Users DC Fabrikam DC com   -SearchScope Base                      NOTE  The above command will return the user object  Administrator in this case  if it finds a match recursively in memberOf attribute

[powershell] How to get all groups that a user is a member of?

Examples related to powershell

Examples related to active-directory

Examples related to powershell-2.0