I am relatively new to powershell and I have two statements on the cmd line:

get-adgroupmember <group name> | select-object name,samaccountname

To produce a nicely formatted table with two columns of a persons real name and their username.

get-adgroupmember <group name> | get-adprincipalgroupmembership | select-object name

To produce list of groups that each user in a named group belongs to.

I would like to combine these so that I have a users real name + username and then the groups they belong to for each user e.g.

name                samaccountname          memberof
----                --------------          --------
joe bloggs          jbloggs                 group1

bob laithwaite      blaithwaite             group2

or maybe

joe bloggs          jbloggs

bob laithwaite      blaithwaite

Is there any simple way to create this? I am not overly concerned about it being beautiful.

If there is no simple way can anyone give me any pointers to how I can create this a difficult way? If there is only a difficult way then whilst a working answer would be nice I would sooner have pointers to start with to see if I can produce something myself. I am still learning after all.

My original Google search found https://gallery.technet.microsoft.com/scriptcenter/Powershell-Get-users-who-b0420fe1 but could not get it to work on the cmd line by replacing variables with hard coded strings. This is what I ultimately want to achieve but with just 2 groups however in the first instance I want to start with something like the output above.

I also found How can I generate a list of the security groups a set of users belong to? in the process of writing this question but this just appears to produce similar list to that which I created in the 2nd cmd line, the one that uses get-adprincipalgroupmembership.

  • Are you still awaiting a correct answer? ServerFault prides itself on its high answer rate.
    – Colyn1337
    Jul 12 '16 at 20:36
  • i have not had an opportunity to try anything as of yet as work has been a bit hectic but i am working the weekend which normally gives me more "free" time (don't tell the boss) Jul 22 '16 at 20:29

There's no single line or single cmdlet that will give you what you want, but with a little scripting you can get it. I've drafted a script below which will do it, it's very simple and you should be able to understand what it's doing and modify it to your needs.

ipmo activedirectory

$searchBase = "OU=someOU,DC=yourdomain,DC=com"

$userlist = Get-ADUser -Filter * -SearchBase $searchBase -Properties memberOf

$report = @()

Foreach ($user in $userlist)
    $name = $user.Name
    $SAM = $user.SAMAccountName
    $memberOf = $user.memberOf

    $i = 0 #if you only want the user and SAMAccountName to appear once you will need a counter like this, it'se easier to just display it on every row

    Foreach($Group in $memberOf)
        $GroupName = $Group.Replace('CN=','')
        $rowGroup = $GroupName -replace ",.*"

        if($i -eq 0) #if you're happy to have username and SAMAccountName on each row you can skip this bit
            $rowName = $name
            $rowSAM = $SAM
            $rowName = ""
            $rowSAM = ""

        $objRow = New-Object System.Object
        $objRow | Add-Member -MemberType NoteProperty -Name Name -Value $rowName
        $objRow | Add-Member -MemberType NoteProperty -Name SAMAccountName -Value $rowSAM
        $objRow | Add-Member -MemberType NoteProperty -Name GroupName -Value $rowGroup

        $report += $objRow




$report | ft
  • 1
    I'd take a look at [pscustomobject][ordered]@{} for building new objects, I think this was introduced in Powershell v3. It's very helpful and gets rid of the New-Object ugliness. Nov 12 '18 at 8:01
  • 1
    Yeah looks like this is an old answer - I've switched to [PSCustomObject] now. Haven't come across the [ordered] attribute though, will look into that. Thanks!
    – Matt
    Nov 13 '18 at 2:55
  • 1
    Yep it's super neat, it orders otherwise un-ordered hashtables. Nov 14 '18 at 0:26

In your post you didn't specify where your user list is coming from. It looks like you're getting the users of one group and seeing what else they're a member of. It's largely irrelevant to the solution so I'll assume you have a list of $users and go from there.

What you want to do is combine properties from two commands into a single output stream. This can be accomplished by leveraging Calculated Properties like so...

$Users | %{Select DisplayName,SamAccountName,@{N="Groups";E={(Get-ADuser $_.SamAccountName -Properties memberof).memberof}}}

You could also use an approach similar to this:

Get-ADGroupMember $GroupName | %{Get-ADUser $_.SamAccountName -Properties memberof | Select Name, SamAccountName, memberof} 

You can try in this way, this will give you list of users with all the groups then are in

$users = get-content \\filepath.txt
foreach($u in $users){
  $report += Get-Aduser $u -properties memberof| Get-ADGroup |select-object @{N="GroupName";E={$_.samaccountname}},@{N="username";E={$u}}

$report | Export-csv \\filepath.csv

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.