6

I have been asked to generate a list of the security groups (so specifically not the distribution groups) that a list of approximately 50 users belong to.

I have a list of users, users.txt that contains each username on a new line. I want to generate a membership.txt that contains the username and a list of the security groups that user is a member of, separated by commas.

The Powershell script I have written so far is as follows:

$users = Get-Content C:\users.txt

ForEach ($User in $users) {
  $getmembership = Get-ADUser $User -Properties MemberOf | Select -ExpandProperty memberof
  $User + ',' + $getmembership | Out-File -Append c:\membership.txt
}

This almost works, but for two problems:

  1. It is generating a list of all groups, not just security groups. How can I tell it to only include security groups and not distribution groups?
  2. The groups are being appended in the format OU=Security Groups,OU=City,DC=domain,DC=com CN=Senior Leaders, but the only information I actually want is Senior Leaders. How can I cut out all the extra information?
4
  • Are you also looking to walk their nested group memberships?
    – jscott
    Commented Sep 25, 2014 at 20:22
  • Seems like a lot of work for something that is out there already: cjwdev.co.uk/Software/ADReportingTool/Info.html
    – TheCleaner
    Commented Sep 25, 2014 at 20:33
  • @jscott No, that will not be necessary.
    – NaOH
    Commented Sep 25, 2014 at 20:35
  • @TheCleaner I will try this out and see if it fits the bill.
    – NaOH
    Commented Sep 25, 2014 at 20:37

1 Answer 1

6

Extend your Get-ADUser line:

$getmembership = Get-ADUser $User -Properties MemberOf | Select -ExpandProperty memberof | Get-ADGroup -Properties name | Where { $_.GroupCategory -eq 'Security' } | Select -ExpandProperty Name

This will feed the DN of the Group to Get-ADGroup to retrieve additional properties, then filter on group category and select the name of the group (instead of the DistinguishedName).

4
  • This appears to return almost no groups... I see mostly this: username, username, username,@{Name=Group} username, username, username,@{Name=Different Group}
    – NaOH
    Commented Sep 25, 2014 at 19:48
  • Sorry, missed an ExpandProperty, corrected. Commented Sep 25, 2014 at 20:36
  • Sorry, the only thing that's not working is comma-separating the groups. Lots of our groups have spaces in the names so I can't rely on spacing to parse the groups out. I can't work out the syntax to add a comma between each group.
    – NaOH
    Commented Sep 25, 2014 at 20:41
  • Simple: $User + ',' + ($getmembership -join ',') Commented Sep 25, 2014 at 20:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .