I have several local groups on a Server 2008 instance. In this group are several members from our AD domain.

Is there a way to determine all of the local groups a given AD domain user belongs to by checking on the server, and not in one of the AD components? Something like:

Company\JSMITH John Smith is a member of:
Prod support
Report users
Backup operators

JSMITH's security token is generated when JSMITH logs on to a computer, so JSMITH needs to run "whoami /groups" to see his effective group membership on a given computer.

Other than that, you can get the MemberOf collection from the user principal in AD, however, that's only going to list AD security groups, not local groups on another computer.

edit: You'll probably have to script it, like so:

$LocalGroup =[ADSI]"WinNT://Localhost/GROUP"
$UserNames = @($LocalGroup.psbase.Invoke("Members"))
$UserNames | foreach {$_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)}
  • Solid! As an admin, however, how do I determine this information for JSMITH? Is there an equivalent command to whoami that an admin can run to determine this info for a given user? "whoisuser JSMITH /groups", or some such? – IVR Avenger Aug 7 '12 at 16:57
  • edited my original answer – Ryan Ries Aug 7 '12 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.