69

Suppose I have the user id of a user in Active Directory. I'd like to get a list of all AD groups in which that user is currently a member of. How can I do this from the Windows command line?

I've tried the following:

dsget user "DC=jxd123" -memberof

Error:

dsquery failed:'-memberof' is an unknown parameter.
type dsquery /? for help.
3
  • 3
    You certainly won't get an error for dsquery when you execute dsget. Copy&Paste fail?
    – mfinni
    Aug 19 '13 at 18:57
  • FYI, found the same question on StackOverflow with a couple more answers.
    – Nic
    Aug 20 '13 at 7:42
  • 1
    I don't have enough reputation to answer, but assuming you are using powershell, you can write this: Get-ADPrincipalGroupMembership username | select name Sep 10 '19 at 7:29

15 Answers 15

44

You can do this in PowerShell pretty easily. I'm sure you can do it with the ds tools too, but they're old and crusty and PowerShell should be used for everything possible nowadays.

Import-Module ActiveDirectory
(Get-ADUser userName –Properties MemberOf | Select-Object MemberOf).MemberOf

Shorter version

(Get-ADUser userName –Properties MemberOf).MemberOf
8
  • I downloaded Powershell, and now have a *.msu file. How do I install it using the *.msu file?
    – MacGyver
    Aug 19 '13 at 18:51
  • What operating system are you on? PowerShell is built into anything newer than XP and is available to XP as an optional Windows Update.
    – MDMarra
    Aug 19 '13 at 18:53
  • Windows XP .. My company is slow :-\
    – MacGyver
    Aug 19 '13 at 18:57
  • Then you downloaded the wrong installer. Also, just a heads up, XP support ends in just under a year. Get upgrades moving! microsoft.com/en-us/windows/endofsupport.aspx
    – MDMarra
    Aug 19 '13 at 18:58
  • 2
    Get-ADPrincipalGroupMembership is another way to do this in PowerShell.
    – Nic
    Aug 20 '13 at 7:43
97

Or with the net user command...

net user /domain username
6
  • 4
    I love the simplicity that some of the "old" DOS commands offer. And, they've always been there so even if you don't have PoSH loaded on an old machine, DOS comes to the rescue! Thanks for posting this.
    – Jeff Moden
    Nov 4 '14 at 21:06
  • 4
    This will only return explicit, but not implicit group memberships. Nov 5 '14 at 22:45
  • 13
    Slick command, BUT, the groups names in the output are truncated to 21 characters... :-(
    – t0r0X
    Mar 16 '15 at 13:37
  • 1
    Yes, there are limitations. Nested group memberships are not shown and you are right, the output is truncated. Admittedly, I had not considered the latter.
    – Jack
    Jun 23 '15 at 0:18
  • Worked great but why would it be truncated? Is there a config/parameter that can be added for full group name?
    – ThinkCode
    Aug 17 '16 at 14:44
57

Single line, no modules necessary, uses current logged user $($env:username), runs from other windows machines:

(New-Object System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$($env:username)))")).FindOne().GetDirectoryEntry().memberOf

Qudos to this vbs/powershell article: http://technet.microsoft.com/en-us/library/ff730963.aspx

3
  • 4
    Very good solution, the only one which worked for me without installing any additional softwar! Thanks!
    – t0r0X
    Mar 16 '15 at 13:46
  • 3
    +1 for working on a restricted system without any additional software!
    – Saustrup
    Aug 11 '16 at 7:50
  • 3
    Another +1 here for both working on a restricted system and having better output than net.exe. Thanks a bunch! Feb 22 at 21:38
12

Found a good resource:

http://social.technet.microsoft.com/wiki/contents/articles/2195.active-directory-dsquery-commands.aspx

Here's how to do it from Windows command prompt:

dsquery user -samid jxd123 | dsget user -memberof | dsget group -samid
12

If you need to see your own groups, there's whoami /groups:

Displays the user groups to which the current user belongs.

The advantage of this command over net user /domain username is that implicit group memberships are also displayed with whoami.

1
  • 2
    Best solution. Upvoted. Short and sweet. Doesn't truncate. Personally I like best the LIST format, i.e. whoami /groups /fo list, because it is the easiest to read with the eye.
    – peterh
    Feb 17 '17 at 14:15
10

PowerShell:

Get-ADPrincipalGroupMembership -Identity jdoe | Format-Table -Property name
6

Another approach: a PowerShell script that lists all implicit group memberships from the Windows account token. Works on a restricted system.

$token = [System.Security.Principal.WindowsIdentity]::GetCurrent() 
ForEach($group in $token.Groups){
    $group.Translate([System.Security.Principal.NTAccount])
}
3
dsquery user -samid "user id" | dsget user -memberof > userid_memberof.txt
2
$ADUser = Read-Host "Provide the AD User account"
Get-ADPrincipalGroupMembership -Identity $ADUser | Sort-Object name | Format-Table -Expand name
2

adfind is another great tool for this sort of thing. It is a free tool from MVP Joe Richards

http://www.joeware.net/freetools/tools/adfind/

You can use one of the shortucts

adfind -sc u:username memberof
1

This PowerShell version returns just the AD group names, rather than the DN of the group. The 'select-object' output can easily be piped to a CSV or test file.

(Get-ADUser ExampleUser –Properties MemberOf).memberof | Get-ADGroup | Select-Object name

0

Powershell, gives a nice and clean output.

(get-aduser USER -Properties MemberOf | select MemberOf).MemberOf | % {$_.split(",")[0].replace("CN=","")}
0

Here's a solution searching all domains under the given domain (assuming proper permission for each domain):

# provide the logon name here:
$user="alice"
$allGroups=@()

foreach ( $d in (Get-ADForest example.net).domains ) { Write-Output "Looking up $user in domain $d"; $allGroups += Get-ADPrincipalGroupMembership $user -ResourceContextServer $d }

$allGroups | ft name,GroupScope,distinguishedName -AutoSize

Using Get-ADPrincipalGroupMembership

0

Try adquery (if you're on Linux/RHEL)

#To find All AD groups a user "XXXX" is a part of:

adquery user -a XXXX  

Conversely, to find all users an Active Directory group "ABCD" has:

adquery group -a ABCD  

You can pipe with grep to refine further.

These commands can be run when you are logged on as a standard user without elevated privileges.

For windows operating system, Jack's answer is relevant.

More info here: https://docs.centrify.com/Content/auth-unix-user/CommandLineUsers.htm

-2

Try this:

gpresult -V /user blah
0

Not the answer you're looking for? Browse other questions tagged or ask your own question.