can ps check to see what groups a member is in, and export?

PowerShell Help
1

by LithiumKid1976 at 2012-12-03 13:37:02

hi

i have 2 groups in AD, that users need to be in, in order to get internet access.

not all members of the domain are members of the groups.

what i want to do, is to be able to query all users in the domain that are in both groups, and export the username, office location , etc for users that are in both.

how feasible is this?

the domain level is server 2008r2, and the Domain has approx 930 OU’s

thanks for your help
by RichardSiddaway at 2012-12-03 14:49:01
Its very feasible - the issue is how many users do you have.
You will need to get the membership of one group and compare it to the other. Take the resultant list and then iterate through the users getting the properties

try something like this - you’ll need to modify the last line to select the properties you want

$group1 = Get-ADGroupMember -Identity ADL-group1 | select SamAccountName

$group2 = Get-ADGroupMember -Identity ADL-group2 | select SamAccountName

Compare-Object -ReferenceObject $group1 -DifferenceObject $group2 -IncludeEqual |
where SideIndicator -eq "==" |
foreach {
$sam = ($.InputObject).SamAccountName

Get-ADUser -Identity $sam -Properties *

}
by Klaas at 2012-12-04 01:11:40
I think this will do the job too:
Get-ADUser -Filter * -Properties samaccountname,givenname,office,MemberOf | Where-Object { $.memberof -match "group1" -and $_.memberof -match "group2"}
I’ve got no idea which is most performant, you could test that with Measure-Command.
by RichardSiddaway at 2012-12-04 08:48:55
Performance will depend on the number of users to be checked. If you have more than 1000 you will need to ensure that -resultsize is set to $null