50

Suppose I have the user id of a user in Active Directory. I'd like to get a list of all AD groups in which that user is currently a member of. How can I do this from the Windows command line?

I've tried the following:

dsget user "DC=jxd123" -memberof

Error:

dsquery failed:'-memberof' is an unknown parameter.
type dsquery /? for help.
  • 3
    You certainly won't get an error for dsquery when you execute dsget. Copy&Paste fail? – mfinni Aug 19 '13 at 18:57
  • FYI, found the same question on StackOverflow with a couple more answers. – Nic Aug 20 '13 at 7:42

14 Answers 14

30

You can do this in PowerShell pretty easily. I'm sure you can do it with the ds tools too, but they're old and crusty and PowerShell should be used for everything possible nowadays.

Import-Module ActiveDirectory
(Get-ADUser userName –Properties MemberOf | Select-Object MemberOf).MemberOf

Shorter version

(Get-ADUser userName –Properties MemberOf).MemberOf
  • I downloaded Powershell, and now have a *.msu file. How do I install it using the *.msu file? – MacGyver Aug 19 '13 at 18:51
  • What operating system are you on? PowerShell is built into anything newer than XP and is available to XP as an optional Windows Update. – MDMarra Aug 19 '13 at 18:53
  • Windows XP .. My company is slow :-\ – MacGyver Aug 19 '13 at 18:57
  • Then you downloaded the wrong installer. Also, just a heads up, XP support ends in just under a year. Get upgrades moving! microsoft.com/en-us/windows/endofsupport.aspx – MDMarra Aug 19 '13 at 18:58
  • 1
    Get-ADPrincipalGroupMembership is another way to do this in PowerShell. – Nic Aug 20 '13 at 7:43
80

Or with the net user command...

net user /domain username
  • 3
    I love the simplicity that some of the "old" DOS commands offer. And, they've always been there so even if you don't have PoSH loaded on an old machine, DOS comes to the rescue! Thanks for posting this. – Jeff Moden Nov 4 '14 at 21:06
  • 3
    This will only return explicit, but not implicit group memberships. – Elias Probst Nov 5 '14 at 22:45
  • 9
    Slick command, BUT, the groups names in the output are truncated to 21 characters... :-( – t0r0X Mar 16 '15 at 13:37
  • 1
    Yes, there are limitations. Nested group memberships are not shown and you are right, the output is truncated. Admittedly, I had not considered the latter. – Jack Jun 23 '15 at 0:18
  • Worked great but why would it be truncated? Is there a config/parameter that can be added for full group name? – ThinkCode Aug 17 '16 at 14:44
35

Single line, no modules necessary, uses current logged user $($env:username), runs from other windows machines:

(New-Object System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$($env:username)))")).FindOne().GetDirectoryEntry().memberOf

Qudos to this vbs/powershell article: http://technet.microsoft.com/en-us/library/ff730963.aspx

  • 1
    Very good solution, the only one which worked for me without installing any additional softwar! Thanks! – t0r0X Mar 16 '15 at 13:46
  • 1
    +1 for working on a restricted system without any additional software! – Saustrup Aug 11 '16 at 7:50
9

Found a good resource:

http://social.technet.microsoft.com/wiki/contents/articles/2195.active-directory-dsquery-commands.aspx

Here's how to do it from Windows command prompt:

dsquery user -samid jxd123 | dsget user -memberof | dsget group -samid
7

If you need to see your own groups, there's whoami /groups:

Displays the user groups to which the current user belongs.

The advantage of this command over net user /domain username is that implicit group memberships are also displayed with whoami.

  • Best solution. Upvoted. Short and sweet. Doesn't truncate. Personally I like best the LIST format, i.e. whoami /groups /fo list, because it is the easiest to read with the eye. – peterh Feb 17 '17 at 14:15
6

PowerShell:

Get-ADPrincipalGroupMembership -Identity jdoe | Format-Table -Property name
6

Another approach: a PowerShell script that lists all implicit group memberships from the Windows account token. Works on a restricted system.

$token = [System.Security.Principal.WindowsIdentity]::GetCurrent() 
ForEach($group in $token.Groups){
    $group.Translate([System.Security.Principal.NTAccount])
}
3
dsquery user -samid "user id" | dsget user -memberof > userid_memberof.txt
2
$ADUser = Read-Host "Provide the AD User account"
Get-ADPrincipalGroupMembership -Identity $ADUser | Sort-Object name | Format-Table -Expand name
2

adfind is another great tool for this sort of thing. It is a free tool from MVP Joe Richards

http://www.joeware.net/freetools/tools/adfind/

You can use one of the shortucts

adfind -sc u:username memberof
1

This PowerShell version returns just the AD group names, rather than the DN of the group. The 'select-object' output can easily be piped to a CSV or test file.

(Get-ADUser ExampleUser –Properties MemberOf).memberof | Get-ADGroup | Select-Object name

0

Powershell, gives a nice and clean output.

(get-aduser USER -Properties MemberOf | select MemberOf).MemberOf | % {$_.split(",")[0].replace("CN=","")}
0

Here's a solution searching all domains under the given domain (assuming proper permission for each domain):

# provide the logon name here:
$user="alice"
$allGroups=@()

foreach ( $d in (Get-ADForest example.net).domains ) { Write-Output "Looking up $user in domain $d"; $allGroups += Get-ADPrincipalGroupMembership $user -ResourceContextServer $d }

$allGroups | ft name,GroupScope,distinguishedName -AutoSize

Using Get-ADPrincipalGroupMembership

-4

Try this:

gpresult -V /user blah

protected by Sven May 26 '17 at 7:02

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.