63

Suppose I have the user id of a user in Active Directory. I'd like to get a list of all AD groups in which that user is currently a member of. How can I do this from the Windows command line?

I've tried the following:

dsget user "DC=jxd123" -memberof

Error:

dsquery failed:'-memberof' is an unknown parameter.
type dsquery /? for help.
  • 3
    You certainly won't get an error for dsquery when you execute dsget. Copy&Paste fail? – mfinni Aug 19 '13 at 18:57
  • FYI, found the same question on StackOverflow with a couple more answers. – Nic Aug 20 '13 at 7:42
  • I don't have enough reputation to answer, but assuming you are using powershell, you can write this: Get-ADPrincipalGroupMembership username | select name – Avi Parshan Sep 10 '19 at 7:29

14 Answers 14

40

You can do this in PowerShell pretty easily. I'm sure you can do it with the ds tools too, but they're old and crusty and PowerShell should be used for everything possible nowadays.

Import-Module ActiveDirectory
(Get-ADUser userName –Properties MemberOf | Select-Object MemberOf).MemberOf

Shorter version

(Get-ADUser userName –Properties MemberOf).MemberOf
| improve this answer | |
  • I downloaded Powershell, and now have a *.msu file. How do I install it using the *.msu file? – MacGyver Aug 19 '13 at 18:51
  • What operating system are you on? PowerShell is built into anything newer than XP and is available to XP as an optional Windows Update. – MDMarra Aug 19 '13 at 18:53
  • Windows XP .. My company is slow :-\ – MacGyver Aug 19 '13 at 18:57
  • Then you downloaded the wrong installer. Also, just a heads up, XP support ends in just under a year. Get upgrades moving! microsoft.com/en-us/windows/endofsupport.aspx – MDMarra Aug 19 '13 at 18:58
  • 1
    Get-ADPrincipalGroupMembership is another way to do this in PowerShell. – Nic Aug 20 '13 at 7:43
90

Or with the net user command...

net user /domain username
| improve this answer | |
  • 3
    I love the simplicity that some of the "old" DOS commands offer. And, they've always been there so even if you don't have PoSH loaded on an old machine, DOS comes to the rescue! Thanks for posting this. – Jeff Moden Nov 4 '14 at 21:06
  • 3
    This will only return explicit, but not implicit group memberships. – Elias Probst Nov 5 '14 at 22:45
  • 11
    Slick command, BUT, the groups names in the output are truncated to 21 characters... :-( – t0r0X Mar 16 '15 at 13:37
  • 1
    Yes, there are limitations. Nested group memberships are not shown and you are right, the output is truncated. Admittedly, I had not considered the latter. – Jack Jun 23 '15 at 0:18
  • Worked great but why would it be truncated? Is there a config/parameter that can be added for full group name? – ThinkCode Aug 17 '16 at 14:44
44

Single line, no modules necessary, uses current logged user $($env:username), runs from other windows machines:

(New-Object System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$($env:username)))")).FindOne().GetDirectoryEntry().memberOf

Qudos to this vbs/powershell article: http://technet.microsoft.com/en-us/library/ff730963.aspx

| improve this answer | |
  • 2
    Very good solution, the only one which worked for me without installing any additional softwar! Thanks! – t0r0X Mar 16 '15 at 13:46
  • 2
    +1 for working on a restricted system without any additional software! – Saustrup Aug 11 '16 at 7:50
12

Found a good resource:

http://social.technet.microsoft.com/wiki/contents/articles/2195.active-directory-dsquery-commands.aspx

Here's how to do it from Windows command prompt:

dsquery user -samid jxd123 | dsget user -memberof | dsget group -samid
| improve this answer | |
9

If you need to see your own groups, there's whoami /groups:

Displays the user groups to which the current user belongs.

The advantage of this command over net user /domain username is that implicit group memberships are also displayed with whoami.

| improve this answer | |
  • 1
    Best solution. Upvoted. Short and sweet. Doesn't truncate. Personally I like best the LIST format, i.e. whoami /groups /fo list, because it is the easiest to read with the eye. – peterh Feb 17 '17 at 14:15
8

PowerShell:

Get-ADPrincipalGroupMembership -Identity jdoe | Format-Table -Property name
| improve this answer | |
6

Another approach: a PowerShell script that lists all implicit group memberships from the Windows account token. Works on a restricted system.

$token = [System.Security.Principal.WindowsIdentity]::GetCurrent() 
ForEach($group in $token.Groups){
    $group.Translate([System.Security.Principal.NTAccount])
}
| improve this answer | |
3
dsquery user -samid "user id" | dsget user -memberof > userid_memberof.txt
| improve this answer | |
2
$ADUser = Read-Host "Provide the AD User account"
Get-ADPrincipalGroupMembership -Identity $ADUser | Sort-Object name | Format-Table -Expand name
| improve this answer | |
2

adfind is another great tool for this sort of thing. It is a free tool from MVP Joe Richards

http://www.joeware.net/freetools/tools/adfind/

You can use one of the shortucts

adfind -sc u:username memberof
| improve this answer | |
1

This PowerShell version returns just the AD group names, rather than the DN of the group. The 'select-object' output can easily be piped to a CSV or test file.

(Get-ADUser ExampleUser –Properties MemberOf).memberof | Get-ADGroup | Select-Object name

| improve this answer | |
0

Powershell, gives a nice and clean output.

(get-aduser USER -Properties MemberOf | select MemberOf).MemberOf | % {$_.split(",")[0].replace("CN=","")}
| improve this answer | |
0

Here's a solution searching all domains under the given domain (assuming proper permission for each domain):

# provide the logon name here:
$user="alice"
$allGroups=@()

foreach ( $d in (Get-ADForest example.net).domains ) { Write-Output "Looking up $user in domain $d"; $allGroups += Get-ADPrincipalGroupMembership $user -ResourceContextServer $d }

$allGroups | ft name,GroupScope,distinguishedName -AutoSize

Using Get-ADPrincipalGroupMembership

| improve this answer | |
-2

Try this:

gpresult -V /user blah
| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.