2

We use a piece of web-based software that users can log on to in order to manage access to shares controlled with AD groups. The list of groups a user can manage are the groups on which they have 'Write Members' security. This allows users to maintain file shares without requiring knowledge of AD.

I am trying to write a Powershell script using the quest.activeroles.admanagement that will return a neat list of groups that a specified user has 'Write Members' security on, in order to clean out permissions for departed users. The groups I need to search through are stored in an OU, though there are over 1,000 of them.

I have so far come up with:

add-pssnapin quest.activeroles.admanagement
Get-QADObject -ShowProgress -SearchRoot 'domain.server.com/path/to/OU' -SearchScope 'OneLevel' -Type Group -SizeLimit 2500 | Get-QADPermission -Rights 'WriteProperty' -Property 'member' -Account "user" -WarningAction SilentlyContinue

This works fine (however inefficiently) but the host output is fairly messy:

Permissions for: full.domain.path/OU/path/group1

Ctrl   Account                                  Rights                              Source           AppliesTo                                    
----   -------                                  ------                              ------           ---------                                    
       Domain\user                              Write member                        Not inherited    This object and all child objects            
Permissions for: full.domain.path/OU/path/group2
       Domain\user                              Write member                        Not inherited    This object and all child objects                        Not inherited    This object and all child objects            
Permissions for: full.domain.path/OU/path/group3
       Domain\user                              Write member                        Not inherited    This object and all child objects                        Not inherited    This object only                             
Permissions for: full.domain.path/OU/path/group4
       Domain\user                              Write member                        Not inherited    This object and all child objects                        Not inherited    This object and all child objects            

I get the required information, but a whole lot of chaff surrounding it. If I pipe/append to a text file, I only get the username, not the group names. Ideally what I'd want is just a list of group names without the OU path, or in a perfect world, a CSV where column one is the user name and column two is the group, so that I could run multiple users (foreach ($username in $usernames)):

User                Group
domain\username     group_name_one
domain\username     group_name_two
domain\username     group_name_three

What would be the best way to tackle this in such a way that Export-CSV would spit out something a little bit nicer?

2
  • what domain and function level are we at, in otherwords why are you still using the quest tools?
    – tony roth
    Dec 11, 2012 at 14:48
  • Let's assume that I have full read-only access to the local domain controller. the quest tools were the best documented for this at the time I was researching, though I'm happy to use the activedirectory module.
    – nlseven
    Dec 12, 2012 at 3:11

1 Answer 1

1

There are two problems here.

  1. The CMDlet Get-QADPermission is writing directly to the console during execution which is why you're seeing Permissions for: .... Since your pipeline is writing to the same output, it all gets mixed together. Store the output from your pipeline to a variable instead.

  2. When you pipe the group into Get-QADPermission, you're throwing away the group object and getting a permissions object instead. If you want to keep the original object, you need to filter with Where-Object.

Also, be careful with Get-QADPermission. If you only query for WriteProperty, it won't return results with both Read+Write access. Usually you want to query for both. And in most cases, you also want to use -Inherited to get permissions granted from parent OU's. If you're really looking for once-off permissions, then you can ignore this switch.

function Test-UserCanModifyGroupsInOU ($Username, $OU)
{
  $results = Get-QADGroup -SearchScope 'OneLevel' -SearchRoot $OU |
    Where-Object {
      $_ | Get-QADPermission -Rights ReadProperty,WriteProperty -Property member -Account $username
    } |
    Select @{Name="User";Expression={$username}}, @{Name="Group";Expression={$_.Name}}
  $results | Write-Output
  $results | Export-Csv "$username.csv"
}

@("bob","sally") |
  ForEach-Object {
    Test-UserCanModifyGroupsInOU -Username $_ -OU 'domain.org.com/path/to/OU'
  }

Also note that this only works for permissions on specific properties. It won't return results for a user that has "Full Control" on the group, even though they're stil allowed to modify the member attribute.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .