We use a piece of web-based software that users can log on to in order to manage access to shares controlled with AD groups. The list of groups a user can manage are the groups on which they have 'Write Members' security. This allows users to maintain file shares without requiring knowledge of AD.
I am trying to write a Powershell script using the quest.activeroles.admanagement that will return a neat list of groups that a specified user has 'Write Members' security on, in order to clean out permissions for departed users. The groups I need to search through are stored in an OU, though there are over 1,000 of them.
I have so far come up with:
add-pssnapin quest.activeroles.admanagement
Get-QADObject -ShowProgress -SearchRoot 'domain.server.com/path/to/OU' -SearchScope 'OneLevel' -Type Group -SizeLimit 2500 | Get-QADPermission -Rights 'WriteProperty' -Property 'member' -Account "user" -WarningAction SilentlyContinue
This works fine (however inefficiently) but the host output is fairly messy:
Permissions for: full.domain.path/OU/path/group1
Ctrl Account Rights Source AppliesTo
---- ------- ------ ------ ---------
Domain\user Write member Not inherited This object and all child objects
Permissions for: full.domain.path/OU/path/group2
Domain\user Write member Not inherited This object and all child objects Not inherited This object and all child objects
Permissions for: full.domain.path/OU/path/group3
Domain\user Write member Not inherited This object and all child objects Not inherited This object only
Permissions for: full.domain.path/OU/path/group4
Domain\user Write member Not inherited This object and all child objects Not inherited This object and all child objects
I get the required information, but a whole lot of chaff surrounding it. If I pipe/append to a text file, I only get the username, not the group names. Ideally what I'd want is just a list of group names without the OU path, or in a perfect world, a CSV where column one is the user name and column two is the group, so that I could run multiple users (foreach ($username in $usernames)):
User Group
domain\username group_name_one
domain\username group_name_two
domain\username group_name_three
What would be the best way to tackle this in such a way that Export-CSV would spit out something a little bit nicer?