# Get-AdComputers AdUser has rights to logon?

**URL:** <https://forums.powershell.org/t/get-adcomputers-aduser-has-rights-to-logon/13670>\
**Category:** PowerShell Help\
**Created:** [January 17, 2020, 8:23am UTC](https://forums.powershell.org/t/get-adcomputers-aduser-has-rights-to-logon/13670 "2020-01-17T08:23:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jason-mcmahan](https://avatars.discourse-cdn.com/v4/letter/j/b487fb/32.png) [@jason-mcmahan](https://forums.powershell.org/u/jason-mcmahan)\
**Post date:** [January 17, 2020, 8:23am UTC](https://forums.powershell.org/t/get-adcomputers-aduser-has-rights-to-logon/13670/1 "2020-01-17T08:23:13Z")

</div>

Recently i was pondering if it is possible to determine all computers a specific aduser has rights to logon to in the domain? I wasnt sure if i should start with retrieving all adcomputers or find all groups the user is a member of then compare?  
I assumed in ad there was some way to have it tell me this aduser object does not have logon rights to this adcomputer without querying the machine directly.

Any suggestions would be great.

---

<div class="post-metadata">

**Author:** ![rob-simmers](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/rob-simmers/32/1010_2.png) [@rob-simmers](https://forums.powershell.org/u/rob-simmers)\
**Post date:** [January 17, 2020, 8:53am UTC](https://forums.powershell.org/t/get-adcomputers-aduser-has-rights-to-logon/13670/2 "2020-01-17T08:53:20Z")

</div>

Logon rights are provided on the computer:

> **[Allow log on locally - security policy setting - Windows Security](https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/allow-log-on-locally)**
>
> Describes the best practices, location, values, policy management, and security considerations for the Allow log on locally security policy setting.

As the kb mentions, typically rights are by default assigned to these local server groups:

> By default, the members of the following groups have this right on workstations and servers:
> 
> Administrators  
> Backup Operators  
> Users

Then a user or group is typically added to these groups, normally ‘Administrators’. Some companies will create Local\Global Active Directory groups and then assign the group so that Active Directory can be queried, but by default there isn’t a method to determine what resources are assigned to a user. It’s actually one of the biggest issues in IT security is there is no link to fully determine what is assigned to a user, solutions need to be built to create as much audit capabilities.

---

<div class="post-metadata">

**Author:** ![jason-mcmahan](https://avatars.discourse-cdn.com/v4/letter/j/b487fb/32.png) [@jason-mcmahan](https://forums.powershell.org/u/jason-mcmahan)\
**Post date:** [January 17, 2020, 8:56am UTC](https://forums.powershell.org/t/get-adcomputers-aduser-has-rights-to-logon/13670/3 "2020-01-17T08:56:16Z")

</div>

Thank you Rob,

I was afraid of that, I had known i could evaluate the groups on the local machine but hoped maybe there was something else i hadnt thought of.

&nbsp;

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:30pm UTC](https://forums.powershell.org/t/get-adcomputers-aduser-has-rights-to-logon/13670/4 "2024-05-16T20:30:49Z")

</div>