Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have several local groups on a Server 2008 instance. In this group are several members from our AD domain.

Is there a way to determine all of the local groups a given AD domain user belongs to by checking on the server, and not in one of the AD components? Something like:

Company\JSMITH John Smith is a member of:
Prod support
Report users
Backup operators
share|improve this question

1 Answer 1

up vote 1 down vote accepted

JSMITH's security token is generated when JSMITH logs on to a computer, so JSMITH needs to run "whoami /groups" to see his effective group membership on a given computer.

Other than that, you can get the MemberOf collection from the user principal in AD, however, that's only going to list AD security groups, not local groups on another computer.

edit: You'll probably have to script it, like so:

$LocalGroup =[ADSI]"WinNT://Localhost/GROUP"
$UserNames = @($LocalGroup.psbase.Invoke("Members"))
$UserNames | foreach {$_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)}
share|improve this answer
    
Solid! As an admin, however, how do I determine this information for JSMITH? Is there an equivalent command to whoami that an admin can run to determine this info for a given user? "whoisuser JSMITH /groups", or some such? –  IVR Avenger Aug 7 '12 at 16:57
    
edited my original answer –  Ryan Ries Aug 7 '12 at 17:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.