Determine local group membership of an AD user?

Question

I have several local groups on a Server 2008 instance. In this group are several members from our AD domain.

Is there a way to determine all of the local groups a given AD domain user belongs to by checking on the server, and not in one of the AD components? Something like:

Company\JSMITH John Smith is a member of:
Prod support
Report users
Backup operators

Answer 1

JSMITH's security token is generated when JSMITH logs on to a computer, so JSMITH needs to run "whoami /groups" to see his effective group membership on a given computer.

Other than that, you can get the MemberOf collection from the user principal in AD, however, that's only going to list AD security groups, not local groups on another computer.

edit: You'll probably have to script it, like so:

$LocalGroup =[ADSI]"WinNT://Localhost/GROUP"
$UserNames = @($LocalGroup.psbase.Invoke("Members"))
$UserNames | foreach {$_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)}