Check if the user is a member of a list of AD groups

user_2919148 0
Viewed 70845
$groups = 'group1', 'group2'....

I need to check if the user is in a specific AD group and echo the group name if he is not ; can I do it in the pipeline?

I have googled a lot and cannot find anything, maybe I am too bad at Google search in English :).

$groups |
    Get-QADGroupMember |
    Get-QADUser -SamAccountName 'lalala' | ForEach-Object {
        if ($_.SamAccountName -ne $null) {
            Write-Host "ok"
        } else {
            Write-Host 'not ok'
        }
    }

How can I display: not ok. user is not ingroup_name?

quest powershell active-directory
3 Answers

If your server doesn't have the Active Directory PowerShell feature installed on it, you can use this method. Here I'm checking if a domain group is part of the local administrators group on the server, but you can just change the GroupPrincipal to UserPrincipal and supply the username if you want to check if a user belongs to a group. Also, if the group is a domain group, then use the $domainContext for both FindByIdentity calls.

function Test-DomainGroupIsMemberOfLocalAdministrators([string] $domainName, [string] $domainGroupName)
{
    Add-Type -AssemblyName 'System.DirectoryServices.AccountManagement'
    $domainContext = [System.DirectoryServices.AccountManagement.PrincipalContext]::new([System.DirectoryServices.AccountManagement.ContextType]::Domain, $domainName)
    $localMachineContext = [System.DirectoryServices.AccountManagement.PrincipalContext]::new([System.DirectoryServices.AccountManagement.ContextType]::Machine)
    $domainGroup = [System.DirectoryServices.AccountManagement.GroupPrincipal]::FindByIdentity($domainContext, $domainGroupName)
    $localAdministratorsGroup = [System.DirectoryServices.AccountManagement.GroupPrincipal]::FindByIdentity($localMachineContext, "Administrators")

    if($domainGroup -ne $null)
    {
        if ($domainGroup.IsMemberOf($localAdministratorsGroup))
        {
            return $true
        }
    }
    return $false
}
user_6025850

Is @henrycarteruk answer truely the best way to acomplish that? Let's have an example: I have list of 50 groups and I want to check if user is a member of each group.

By this example:

  • I have to get list of members for each groups
  • I have to check if each list contains my user login
  • Write answer

Problems I see:

  • group can have many, many users
  • I can have many, many groups I want to check if user is member of

I did fast test:

  1. My user have 180 groups
  2. I want to check if he's member of 10 groups I took my ~20 seconds

My approche is below.

Have a list of groups you want to check, but you need whole DN of group.

$list = 'CN=Administrators,CN=Builtin,DC=Fabrikam,DC=com','CN=Administrators,CN=Builtin,DC=Fabrikam,DC=com','CN=Administrators,CN=Builtin,DC=Fabrikam,DC=com'

Get user groups:

$user_groups = (Get-ADUser $login -Properties memberof | Select-Object memberof).memberof

Check which groups user have:

foreach($group2 in $list){
        if($user_groups.Contains($group2)){
            Write-Host "$login is member of $group2"
        }else{
           Write-Host "$login is not a member of $group2"
        }
    }
user_106034700
Related