6

I am trying to get the list of a specific user’s groups and the groups’ descriptions using PowerShell.

import-module activedirectory
$username = Read-Host 'Please enter Username!'
Get-ADPrincipalGroupMembership $username | select name, description

The description field returns blank.

2

5 Answers 5

7

From Get-ADPrincipalGroupMembership manual:

The Get-ADPrincipalGroupMembership cmdlet returns a default set of ADGroup property values. To retrieve additional ADGroup properties pass the ADGroups objects produced by this cmdlet through the pipline to Get-ADGroup. Specify the additional properties required from the group objects by passing the -Properties parameter to Get-ADGroup.

So, let’s do it!

import-module activedirectory
$username = Read-Host 'Please enter Username!'
Get-ADPrincipalGroupMembership $username | Get-ADGroup -Properties * | select name, description

Also, in this case it should be enough to specify name,description instead of asterisk (*). If this is a performance issue, replace it. I am leaving it at asterisk because you might later change your mind about which properties you need.

3

Here is a simple but effective script to get AD Group info.

Get-ADGroup -filter * -Properties * | Select Name,GroupCategory,Description | Export-Csv D:\Test\SecurityGroups.csv

Just add or remove the attributes you would like to see in the Select area. To see a list of usable attributes you can do something like this:

Get-ADGroup -filter * -Properties * | Where-Object {$_.Name -eq 'DHCP Users' }
0

Get-ADPrincipalGroupMembership should work but fails if any group has a NAME containing '/' (which is a legal character in names as far as I understood the MS AD documentation).

This forces a heavy workaround:

$Groups = (Get-ADUser -identity $TemplateUserName -server $TemplateUserDomain -Properties MemberOf|select memberof).MemberOf|Get-ADGroup -Server :3268
foreach ($Group in $Groups)
{
    Write-Output $Group.Name
}

Notice I use a domain search for the user's properties and then a search in global catalog (-server :3268) for each group. Else you eventually won't get all of the user's groups or you'll get an error if any group belongs to a different domain than the user.

0

For a list of groups a user is member of:

(get-aduser NameOfTheUser -properties *).memberof

-1

For Users

Get-ADUser -Filter {name -eq $username} -Properties * | select name,description

For Groups

Get-ADGroup -Filter {displayname -eq $groupname} -Properties * | select name,description
1
  • Can you explain what your code is doing? That would help make your answer clearer. Apr 9, 2015 at 23:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.