Как посмотреть в какие группы входит пользователь windows

asked Feb 22, 2011 at 0:57

Get-ADPrincipalGroupMembership will do this.

Get-ADPrincipalGroupMembership username | select name

name
----
Domain Users
Domain Computers
Workstation Admins
Company Users
Company Developers
AutomatedProcessingTeam

answered Mar 22, 2013 at 12:14

Single line, no modules necessary, uses current logged user:

(New-Object System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$($env:username)))")).FindOne().GetDirectoryEntry().memberOf

Kudos to this vbs/powershell article: http://technet.microsoft.com/en-us/library/ff730963.aspx

Old school way from CMD:

net user mst999 /domain 

(GET-ADUSER –Identity USERNAME –Properties MemberOf | Select-Object MemberOf).MemberOf

This should provide you the details for current user. Powershell not needed.

whoami /groups

answered May 19, 2020 at 16:34

If you cannot get Get-ADPrincipalGroupMembership to work for you could try logging in as that user then use.

$id = [Security.Principal.WindowsIdentity]::GetCurrent()
$groups = $id.Groups | foreach-object {$_.Translate([Security.Principal.NTAccount])}
$groups | select *

answered Oct 4, 2018 at 11:09

While there are many excellent answers here, there is one which I was personally looking for that was missing. Once I figured it out — I thought I should post it in case I want to find it later, or it actually manages to help someone else at some point:

Get-ADPrincipalGroupMembership username | Format-Table -auto

A second approach for presenting this is to specify the individual columns you are interested in eg:

Get-ADPrincipalGroupMembership username | select name, GroupScope, GroupCategory

This gives all the AD groups the username belongs to — but also presents all of the default properties of each group formatted nicely as a table.

The key benefit this gives you is you can see at a glance which are distribution lists, & which are Security groups. You can further see at a glance which are Universal, which are DomainLocal & which are Global.
Why would you care about this last bit?

• Universal group is a security or distribution group that contains
  users, groups, and computers from any domain in its forest as
  members. You can give universal security groups rights and
  permissions on resources in any domain in the forest.
• Global group is a group that can be used in its own domain, in member
  servers and in workstations of the domain, and in trusting domains.
  In all those locations, you can give a global group rights and
  permissions and the global group can become a member of local groups.
  However, a global group can contain user accounts that are only from
  its own domain.
• Domain local group is a security or distribution group that can
  contain universal groups, global groups, other domain local groups
  from its own domain, and accounts from any domain in the forest. You
  can give domain local security groups rights and permissions on
  resources that reside only in the same domain where the domain local
  group is located.

answered Dec 12, 2018 at 22:20

Get-Member is not for getting user’s group membership. If you want to get a list of groups a user belongs to on the local system, you can do so by:

$query = "ASSOCIATORS OF {Win32_Account.Name='DemoUser1',Domain='DomainName'} WHERE ResultRole=GroupComponent ResultClass=Win32_Account"

Get-WMIObject -Query $query | Select Name

In the above query, replace DemoUser1 with the username you want and the DomainName with either your local computer name or domain name.

answered Feb 22, 2011 at 5:40

Get group membership for a user:

$strUserName = "Primoz"
$strUser = get-qaduser -SamAccountName $strUserName
$strUser.memberof

See Get Group Membership for a User

But also see Quest’s Free PowerShell Commands for Active Directory.

[Edit: Get-ADPrincipalGroupMembership command is included in Powershell since v2 with Windows 2008 R2. See kstrauss’ answer below.]

Keith HillKeith Hill

190k40 gold badges344 silver badges365 bronze badges

I wrote a PowerShell function called Get-ADPrincipalGroupMembershipRecursive. It accepts the DSN of a user, computer, group, or service account. It retrieves an initial list of groups from the account’s memberOf attribute, then recursively checks those group’s memberships. Abbreviated code is below. Full source code with comments can be found here.

function Get-ADPrincipalGroupMembershipRecursive( ) {

    Param(
        [string] $dsn,
        [array]$groups = @()
    )

    $obj = Get-ADObject $dsn -Properties memberOf

    foreach( $groupDsn in $obj.memberOf ) {

        $tmpGrp = Get-ADObject $groupDsn -Properties memberOf

        if( ($groups | where { $_.DistinguishedName -eq $groupDsn }).Count -eq 0 ) {
            $groups +=  $tmpGrp           
            $groups = Get-ADPrincipalGroupMembershipRecursive $groupDsn $groups
        }
    }

    return $groups
}

# Simple Example of how to use the function
$username = Read-Host -Prompt "Enter a username"
$groups   = Get-ADPrincipalGroupMembershipRecursive (Get-ADUser $username).DistinguishedName
$groups | Sort-Object -Property name | Format-Table

answered Dec 5, 2013 at 21:04

answered Jun 5, 2015 at 10:36

First, import the ActiveDirectory module:

Import-Module ActiveDirectory

Then issue this command:

Get-ADGroupMember -Identity $group | foreach-object {
    Write-Host $_.SamAccountName
}

This will display the members of the specified group.

answered Dec 14, 2012 at 18:25

It is just one line:

(get-aduser joe.bloggs -properties *).memberof

end of

JohnLBevanJohnLBevan

21.9k11 gold badges93 silver badges173 bronze badges

Sunil AherSunil Aher

7473 gold badges14 silver badges34 bronze badges

AdamAdam

5411 gold badge6 silver badges8 bronze badges

DarkLite1DarkLite1

13.1k40 gold badges113 silver badges201 bronze badges

Studying all comments presented gave me a starting point (thanks for such) but left me with several unresolved issues. As result here is my answer. The code snippet provided does a little more than what is asked for but it provides helpful debugging info.

[array] $script:groupsdns = @()
function Get-ADPrincipalGroupMembershipRecursive() 
{
  Param( [string] $dn, [int] $level = 0, [array] $groups = @() )

  #if(($groupsdns | where { $_.DistinguishedName -eq $dn }).Count -ne 0 ) { return $groups } # dependency on next statement
  #$groupsdns += (Get-ADObject $dn -Properties MemberOf) # Get-ADObject cannot find an object with identity
  if ($script:groupsdns.Contains($dn)) { return $groups }
  $script:groupsdns += $dn
  $mo = $Null
  $mo = Get-ADObject $dn -Properties MemberOf # Get-ADObject cannot find an object with identity
  $group = ($dn + " (" + $level.ToString())
  if ($mo -eq $Null) { $group += "!" }
  $group += ")"
  $groups += $group
  foreach( $groupdn in $mo.MemberOf )
  {
    $groups = Get-ADPrincipalGroupMembershipRecursive -dn $groupdn -level ($level+1) -groups $groups
  }
  if ($level -le 0) 
  { 
    $primarygroupdn = (Get-ADUser -Identity $dn -Properties PrimaryGroup).PrimaryGroup 
    $groups = Get-ADPrincipalGroupMembershipRecursive -dn $primarygroupdn -level ($level+1) -groups $groups
  }
  return $groups
}
$adusergroups = Get-ADPrincipalGroupMembershipRecursive -dn $aduser.DistinguishedName
$adusergroups | ft -AutoSize | `
              Out-File -Width 512 Get-ADPrincipalGroupMembershipRecursive.txt #-Append #-Wrap # | Sort-Object -Property Name

answered Nov 28, 2018 at 20:16

answered Apr 25, 2018 at 10:34

For LOCAL users and groups (ie not in Active Directory), and if you don’t want to, or aren’t allowed to, or can’t install RSAT and/or Install-WindowsFeature RSAT-AD-PowerShell and/or import-module activedirectory then here’s a pure, pre-installed powershell (5.1+) way to do it.

(Note: Get-LocalGroup* used below are only available Powershell v5.1 and above. «…v5.1 was released along with the Windows 10 Anniversary Update on August 2, 2016, and in Windows Server 2016. …[F]or Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 [it] was released on January 19, 2017.» (wikipedia))

$username = "user002"
Get-LocalGroup | ForEach-Object {
    # the usernames are returned in the string form "computernameusername"
    if (Get-LocalGroupMember -Group $_ | Where-Object name -like "*$username") {
        $_.name
    } 
}

Example output:

Administrators
Users

answered Mar 9, 2021 at 23:59

Almost all above solutions used the ActiveDirecotry module which might not be available by default in most cases.

I used below method. A bit indirect, but served my purpose.

List all available groups

Get-WmiObject -Class Win32_Group

And then list the groups the user belongs to

[System.Security.Principal.WindowsIdentity]::GetCurrent().Groups

Comparison can then be done via checking through the SIDs. This works for the logged in user. Please correct me if I am wrong. Completely new to PowerShell, but had to get this done for a work commitment.

answered Mar 9, 2017 at 17:07

coinbirdcoinbird

1,1624 gold badges22 silver badges44 bronze badges

user208145user208145

3492 silver badges13 bronze badges

asked Feb 22, 2011 at 0:57

Get-ADPrincipalGroupMembership will do this.

Get-ADPrincipalGroupMembership username | select name

name
----
Domain Users
Domain Computers
Workstation Admins
Company Users
Company Developers
AutomatedProcessingTeam

answered Mar 22, 2013 at 12:14

Single line, no modules necessary, uses current logged user:

(New-Object System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$($env:username)))")).FindOne().GetDirectoryEntry().memberOf

Kudos to this vbs/powershell article: http://technet.microsoft.com/en-us/library/ff730963.aspx

Old school way from CMD:

net user mst999 /domain 

(GET-ADUSER –Identity USERNAME –Properties MemberOf | Select-Object MemberOf).MemberOf

This should provide you the details for current user. Powershell not needed.

whoami /groups

answered May 19, 2020 at 16:34

If you cannot get Get-ADPrincipalGroupMembership to work for you could try logging in as that user then use.

$id = [Security.Principal.WindowsIdentity]::GetCurrent()
$groups = $id.Groups | foreach-object {$_.Translate([Security.Principal.NTAccount])}
$groups | select *

answered Oct 4, 2018 at 11:09

While there are many excellent answers here, there is one which I was personally looking for that was missing. Once I figured it out — I thought I should post it in case I want to find it later, or it actually manages to help someone else at some point:

Get-ADPrincipalGroupMembership username | Format-Table -auto

A second approach for presenting this is to specify the individual columns you are interested in eg:

Get-ADPrincipalGroupMembership username | select name, GroupScope, GroupCategory

This gives all the AD groups the username belongs to — but also presents all of the default properties of each group formatted nicely as a table.

The key benefit this gives you is you can see at a glance which are distribution lists, & which are Security groups. You can further see at a glance which are Universal, which are DomainLocal & which are Global.
Why would you care about this last bit?

• Universal group is a security or distribution group that contains
  users, groups, and computers from any domain in its forest as
  members. You can give universal security groups rights and
  permissions on resources in any domain in the forest.
• Global group is a group that can be used in its own domain, in member
  servers and in workstations of the domain, and in trusting domains.
  In all those locations, you can give a global group rights and
  permissions and the global group can become a member of local groups.
  However, a global group can contain user accounts that are only from
  its own domain.
• Domain local group is a security or distribution group that can
  contain universal groups, global groups, other domain local groups
  from its own domain, and accounts from any domain in the forest. You
  can give domain local security groups rights and permissions on
  resources that reside only in the same domain where the domain local
  group is located.

answered Dec 12, 2018 at 22:20

Get-Member is not for getting user’s group membership. If you want to get a list of groups a user belongs to on the local system, you can do so by:

$query = "ASSOCIATORS OF {Win32_Account.Name='DemoUser1',Domain='DomainName'} WHERE ResultRole=GroupComponent ResultClass=Win32_Account"

Get-WMIObject -Query $query | Select Name

In the above query, replace DemoUser1 with the username you want and the DomainName with either your local computer name or domain name.

answered Feb 22, 2011 at 5:40

Get group membership for a user:

$strUserName = "Primoz"
$strUser = get-qaduser -SamAccountName $strUserName
$strUser.memberof

See Get Group Membership for a User

But also see Quest’s Free PowerShell Commands for Active Directory.

[Edit: Get-ADPrincipalGroupMembership command is included in Powershell since v2 with Windows 2008 R2. See kstrauss’ answer below.]

Keith HillKeith Hill

190k40 gold badges344 silver badges365 bronze badges

I wrote a PowerShell function called Get-ADPrincipalGroupMembershipRecursive. It accepts the DSN of a user, computer, group, or service account. It retrieves an initial list of groups from the account’s memberOf attribute, then recursively checks those group’s memberships. Abbreviated code is below. Full source code with comments can be found here.

function Get-ADPrincipalGroupMembershipRecursive( ) {

    Param(
        [string] $dsn,
        [array]$groups = @()
    )

    $obj = Get-ADObject $dsn -Properties memberOf

    foreach( $groupDsn in $obj.memberOf ) {

        $tmpGrp = Get-ADObject $groupDsn -Properties memberOf

        if( ($groups | where { $_.DistinguishedName -eq $groupDsn }).Count -eq 0 ) {
            $groups +=  $tmpGrp           
            $groups = Get-ADPrincipalGroupMembershipRecursive $groupDsn $groups
        }
    }

    return $groups
}

# Simple Example of how to use the function
$username = Read-Host -Prompt "Enter a username"
$groups   = Get-ADPrincipalGroupMembershipRecursive (Get-ADUser $username).DistinguishedName
$groups | Sort-Object -Property name | Format-Table

answered Dec 5, 2013 at 21:04

answered Jun 5, 2015 at 10:36

First, import the ActiveDirectory module:

Import-Module ActiveDirectory

Then issue this command:

Get-ADGroupMember -Identity $group | foreach-object {
    Write-Host $_.SamAccountName
}

This will display the members of the specified group.

answered Dec 14, 2012 at 18:25

It is just one line:

(get-aduser joe.bloggs -properties *).memberof

end of

JohnLBevanJohnLBevan

21.9k11 gold badges93 silver badges173 bronze badges

Sunil AherSunil Aher

7473 gold badges14 silver badges34 bronze badges

AdamAdam

5411 gold badge6 silver badges8 bronze badges

DarkLite1DarkLite1

13.1k40 gold badges113 silver badges201 bronze badges

Studying all comments presented gave me a starting point (thanks for such) but left me with several unresolved issues. As result here is my answer. The code snippet provided does a little more than what is asked for but it provides helpful debugging info.

[array] $script:groupsdns = @()
function Get-ADPrincipalGroupMembershipRecursive() 
{
  Param( [string] $dn, [int] $level = 0, [array] $groups = @() )

  #if(($groupsdns | where { $_.DistinguishedName -eq $dn }).Count -ne 0 ) { return $groups } # dependency on next statement
  #$groupsdns += (Get-ADObject $dn -Properties MemberOf) # Get-ADObject cannot find an object with identity
  if ($script:groupsdns.Contains($dn)) { return $groups }
  $script:groupsdns += $dn
  $mo = $Null
  $mo = Get-ADObject $dn -Properties MemberOf # Get-ADObject cannot find an object with identity
  $group = ($dn + " (" + $level.ToString())
  if ($mo -eq $Null) { $group += "!" }
  $group += ")"
  $groups += $group
  foreach( $groupdn in $mo.MemberOf )
  {
    $groups = Get-ADPrincipalGroupMembershipRecursive -dn $groupdn -level ($level+1) -groups $groups
  }
  if ($level -le 0) 
  { 
    $primarygroupdn = (Get-ADUser -Identity $dn -Properties PrimaryGroup).PrimaryGroup 
    $groups = Get-ADPrincipalGroupMembershipRecursive -dn $primarygroupdn -level ($level+1) -groups $groups
  }
  return $groups
}
$adusergroups = Get-ADPrincipalGroupMembershipRecursive -dn $aduser.DistinguishedName
$adusergroups | ft -AutoSize | `
              Out-File -Width 512 Get-ADPrincipalGroupMembershipRecursive.txt #-Append #-Wrap # | Sort-Object -Property Name

answered Nov 28, 2018 at 20:16

answered Apr 25, 2018 at 10:34

For LOCAL users and groups (ie not in Active Directory), and if you don’t want to, or aren’t allowed to, or can’t install RSAT and/or Install-WindowsFeature RSAT-AD-PowerShell and/or import-module activedirectory then here’s a pure, pre-installed powershell (5.1+) way to do it.

(Note: Get-LocalGroup* used below are only available Powershell v5.1 and above. «…v5.1 was released along with the Windows 10 Anniversary Update on August 2, 2016, and in Windows Server 2016. …[F]or Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 [it] was released on January 19, 2017.» (wikipedia))

$username = "user002"
Get-LocalGroup | ForEach-Object {
    # the usernames are returned in the string form "computernameusername"
    if (Get-LocalGroupMember -Group $_ | Where-Object name -like "*$username") {
        $_.name
    } 
}

Example output:

Administrators
Users

answered Mar 9, 2021 at 23:59

Almost all above solutions used the ActiveDirecotry module which might not be available by default in most cases.

I used below method. A bit indirect, but served my purpose.

List all available groups

Get-WmiObject -Class Win32_Group

And then list the groups the user belongs to

[System.Security.Principal.WindowsIdentity]::GetCurrent().Groups

Comparison can then be done via checking through the SIDs. This works for the logged in user. Please correct me if I am wrong. Completely new to PowerShell, but had to get this done for a work commitment.

answered Mar 9, 2017 at 17:07

coinbirdcoinbird

1,1624 gold badges22 silver badges44 bronze badges

user208145user208145

3492 silver badges13 bronze badges