Get the count of AD groups a user is a member of

Question

There are lots of questions around counting members in a group but with the hard limit of 200 groups for groups to get into a token, I need to get a count of groups a user is member of.

This (Get-ADUser userName –Properties MemberOf).MemberOf from this response gets me the list of groups a user is member of but how do I just get a count?

Answer 1

There are many ways to count things in PowerShell. Measure-Object is one, but my preferred choice is the count method:

(Get-ADUser <username> -Properties MemberOf).MemberOf.count

Personally, I would be more interested in the recursive (nested) group memberships of the user. This provides a more complete picture of what they have access to. To get all nested groups a user is a member of, you could use the constructed attribute tokenGroups (as explained here):

Get-ADUser -SearchScope Base -SearchBase (Get-ADUser <username>).DistinguishedName -LDAPFilter '(objectClass=user)' -Properties tokenGroups | Select-Object -ExpandProperty tokenGroups | Select-Object -ExpandProperty Value | %{(Get-ADGroup $_).Name} | Sort-Object

Answer 2

Perhaps Measure-Object -Line

(Get-ADUser userName –Properties MemberOf).MemberOf | Measure-Object -Line