Why is it that I cannot seem to see the groups a user is a member of when I use the Get-ADUser cmdlet?
Surely this a very common question.

PS >$thisuser = Get-ADUser -Filter 'Name -like "LogonID"'
PS >$thisuser

DistinguishedName  : CN=LogonID,OU=Users,DC=Home,DC=local
Enabled            : True
GivenName          : John
Name               : LogonID
ObjectClass        : user
ObjectGUID         : 9383f28b-e4fc-4a8e-81e4-73094d4bba63
PSShowComputerName : {}
SamAccountName     : LogonID
SID                : S-1-5-21-9871330858-2016497126-1624845914-51132
Surname            : Doe
UserPrincipalName  : LogonID@home.local
WriteErrorStream   : {}
PropertyNames      : {DistinguishedName, Enabled, GivenName, Name...}
PropertyCount      : 12

Let us try get-member

PS >$thisuser | Get-Member

   TypeName: Microsoft.ActiveDirectory.Management.ADUser

Name               MemberType            Definition
----               ----------            ----------
Contains           Method                bool Contains(string propertyName)
Equals             Method                bool Equals(System.Object obj)
GetEnumerator      Method                System.Collections.IDictionaryEnumerator GetEnumerator()
GetHashCode        Method                int GetHashCode()
GetType            Method                type GetType()
ToString           Method                string ToString()
Item               ParameterizedProperty Microsoft.ActiveDirectory.Management.ADPropertyValueCollection Item(string ...
DistinguishedName  Property              System.String DistinguishedName {get;set;}
Enabled            Property              System.Boolean Enabled {get;set;}
GivenName          Property              System.String GivenName {get;set;}
Name               Property              System.String Name {get;}
ObjectClass        Property              System.String ObjectClass {get;set;}
ObjectGUID         Property              System.Nullable`1[[System.Guid, mscorlib, Version=2.0.0.0, Culture=neutral,...
PSShowComputerName Property              Microsoft.ActiveDirectory.Management.ADPropertyValueCollection PSShowComput...
SamAccountName     Property              System.String SamAccountName {get;set;}
SID                Property              System.Security.Principal.SecurityIdentifier SID {get;set;}
Surname            Property              System.String Surname {get;set;}
UserPrincipalName  Property              System.String UserPrincipalName {get;set;}
WriteErrorStream   Property              Microsoft.ActiveDirectory.Management.ADPropertyValueCollection WriteErrorSt...

Nope nothing there. So let’s look through the help. Nothing in basic help. So onto the -Detailed help.

I get to the -Properties parameter

-Properties
Specifies the properties of the output object to retrieve from the server. Use this parameter to retrieve properties that are not included in the default set.


I guess that answers part of my question. So what are all the properties that I can look at? Reading a little further on

To retrieve and display the list of all the properties for an ADGroup object, use the following command:
Get-ADGroup -Identity Administrators -Properties *| Get-Member

So I alter my query like so:

PS >$thisuser = Get-ADUser -Filter 'Name -like "LogonID"' -Properties *
PS >$thisuser

AccountExpirationDate              :
accountExpires                     : 9223372036854775807
AccountLockoutTime                 :
AccountNotDelegated                : False
AllowReversiblePasswordEncryption  : False
BadLogonCount                      : 0
badPwdCount                        : 0
CannotChangePassword               : False
...

I will save space and not put the whole lot here. You get the picture.

So as a result I can now see an item called MemberOf which contains the information I am after. Now I can change my query to be the following.

PS > Get-ADUser -Filter 'Name -like "LogonID"' -Properties MemberOf

DistinguishedName  : CN=LogonID,OU=Users,DC=Home,DC=local
Enabled            : True
GivenName          : John
MemberOf           : {CN=vCloud-SANDPIT-User,OU=Groups,DC=Home,DC=local, CN=vCloud-Infra-PowerUser,OU=Groups,DC=Home,DC=local, CN=vCOps-Admins,OU=Groups,DC=Home,DC=local...}
Name               : LogonID
ObjectClass        : user
ObjectGUID         : 9383f28b-e4fc-4a8e-81e4-73094d4bba63
PSShowComputerName : {}
SamAccountName     : LogonID
SID                : S-1-5-21-9871330858-2016497126-1624845914-51132
Surname            : Doe
UserPrincipalName  : LogonID@home.local
WriteErrorStream   : {}
PropertyNames      : {DistinguishedName, Enabled, GivenName, Name...}
PropertyCount      : 12

If you are curious about what Filtering you can do with ActiveDirectory run the following at a Powershell promopt:

help about_ActiveDirectory_Filter