Skip to main content

Powershell Active Directory - User and Group

Recently I needed to find out if a user was in an Active Directory Group.

The group contained more than 5000 entries, so using Get-ADGroupMember wasn't useful (it timed out)

The following command worked well for me...

get-adgroup "GroupName" -Properties Member | Select-Object -ExpandProperty Member | get-aduser |
 Where-Object {$_.SamAccountName -eq "username"}

For small groups, and for full member lists it's as simple as 

Get-ADGroupMember groupname 

Getting the actual AD details can be performed with powershell with the following

get-aduser -Filter 'GivenName -like "FirstName*" -and Surname -like "LastName*"'

or, if you know the SamAccountName...

get-aduser SamAccountName


To list the groups that an account belongs to 
Get-ADPrincipalGroupMembership username | select name

Comments

Popular posts from this blog

NMAP

It's been about 15 years since I used NMAP, I forgot how useful the tool is. To find out what services are running on an IP address simply use something like nmap -n -v -p1-10000 x.x.x.x -n tells nmap not to do name resolution (saves about 13 seconds if the IP you're scanning isn't in DNS_ -v verbose -p1-10000 says scan ports 1 to 10,000 (otherwise nmap will only scan the first 1000 ports)