2

I have a set of nested AD groups:

group
   subgroup1
      subsubgroup1a
      subsubgroup2b
   subgroup2
      subsubgroup2a
         userXY
      subsubgroup2b

I'm using "group" to grant access to a server. Now I want to know why my "userXY" has access to the server. How can I use powershell to find out that the user is member of "subsubgroup2a"?

2
  • If group is granted access to a server. userXY is a member of subsubgroup2a, which is a member of subgroup2, which is a member of group, which you granted access to your server. "Now I want to know why my "userXY" has access to the server." You gave him access.
    – Nixphoe
    Oct 20, 2015 at 16:39
  • There are many scripts online readily for this. Just make sure it covers cross domain membership scenarios if you have multiple domains or external trust. -Very few script takes that into consideration
    – strongline
    Oct 20, 2015 at 20:04

3 Answers 3

2

Update: Technically if you don't mind building a bulky function,

    function GetGroups ($object)
{
    Get-ADPrincipalGroupMembership $object | ForEach `
    {
        $_
        Get-ADPrincipalGroupMembership $_
    }
}

Then you can run:

GetGroups username | select name -Unique

I've used that one in the past. Takes a while too. Or

Here's a prebuilt script to find nested group data: https://gallery.technet.microsoft.com/scriptcenter/Get-nested-group-15f725f2

Update 2: Admin friend uses this script. It does list all sec groups but still does work and you can dump to CSV for easy nav: http://practical-admin.com/blog/powershell-recursively-show-user-membership-in-an-active-directory-group/

1
  • The first one only tells if the user is in any subgroup nested into my top group. The second one only lists all users in the group and subgroups. That's not exactly what I'm looking for but I'll try if I can use this.
    – jlai
    Oct 20, 2015 at 18:04
1

If your DC publishing ADWS is 2012 or later, you have the latest RSAT, and at least Powershell v4 you can do this:

$Filter = "Name -eq TestUser"
$User = Get-ADUser -filter $Filter -Properties memberof | select memberof
1

We use the following function to retrieve the recursive AD Group Memberships:

Function Get-GroupMembershipRecurse {
[CmdletBinding()]
Param(
    [Parameter(Mandatory=$true,ValueFromPipelineByPropertyName=$true,Position=0)]
    [string]$DistinguishedName
)

$memberships = @()
try{
    $obj = Get-ADObject -Identity $DistinguishedName -Properties SamAccountName,MemberOf
} catch {
    Write-Warning "Error while retrieving object details for $DistinguishedName"
    return [string[]]$memberships
}
if ($obj.ObjectClass -eq "group") {
    Write-Verbose "$($obj.name) is of ObjectClass Group. Adding to list of memberships."
    $memberships += $obj
}

$obj.MemberOf | Sort-Object | %{
    # prevent a loop if the group is a member of itself
    if ( $_ -ne $obj.DistinguishedName ) {
        $recursiveMembers = Get-GroupMembershipRecurse $_

        # Add all retrieved memberOf entries to the membership list
        $recursiveMembers | %{
            $memberships += $_
        }
    }
}

return [string[]]$memberships
}

Above function will return all groups an object (in your case a user account) is member of, direct or indirect.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .