Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have several local groups on a Server 2008 instance. In this group are several members from our AD domain.

Is there a way to determine all of the local groups a given AD domain user belongs to by checking on the server, and not in one of the AD components? Something like:

Company\JSMITH John Smith is a member of:
Prod support
Report users
Backup operators
share|improve this question
up vote 1 down vote accepted

JSMITH's security token is generated when JSMITH logs on to a computer, so JSMITH needs to run "whoami /groups" to see his effective group membership on a given computer.

Other than that, you can get the MemberOf collection from the user principal in AD, however, that's only going to list AD security groups, not local groups on another computer.

edit: You'll probably have to script it, like so:

$LocalGroup =[ADSI]"WinNT://Localhost/GROUP"
$UserNames = @($LocalGroup.psbase.Invoke("Members"))
$UserNames | foreach {$_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)}
share|improve this answer
Solid! As an admin, however, how do I determine this information for JSMITH? Is there an equivalent command to whoami that an admin can run to determine this info for a given user? "whoisuser JSMITH /groups", or some such? – IVR Avenger Aug 7 '12 at 16:57
edited my original answer – Ryan Ries Aug 7 '12 at 17:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.