Why is it that I cannot seem to see the groups a user is a member of when I use the Get-ADUser cmdlet?
\nSurely this a very common question.<\/p>\n
\r\nPS >$thisuser = Get-ADUser -Filter 'Name -like "LogonID"'\r\nPS >$thisuser\r\n\r\nDistinguishedName : CN=LogonID,OU=Users,DC=Home,DC=local\r\nEnabled : True\r\nGivenName : John\r\nName : LogonID\r\nObjectClass : user\r\nObjectGUID : 9383f28b-e4fc-4a8e-81e4-73094d4bba63\r\nPSShowComputerName : {}\r\nSamAccountName : LogonID\r\nSID : S-1-5-21-9871330858-2016497126-1624845914-51132\r\nSurname : Doe\r\nUserPrincipalName : LogonID@home.local\r\nWriteErrorStream : {}\r\nPropertyNames : {DistinguishedName, Enabled, GivenName, Name...}\r\nPropertyCount : 12\r\n<\/pre>\nLet us try get-member<\/p>\n
\r\nPS >$thisuser | Get-Member\r\n\r\n TypeName: Microsoft.ActiveDirectory.Management.ADUser\r\n\r\nName MemberType Definition\r\n---- ---------- ----------\r\nContains Method bool Contains(string propertyName)\r\nEquals Method bool Equals(System.Object obj)\r\nGetEnumerator Method System.Collections.IDictionaryEnumerator GetEnumerator()\r\nGetHashCode Method int GetHashCode()\r\nGetType Method type GetType()\r\nToString Method string ToString()\r\nItem ParameterizedProperty Microsoft.ActiveDirectory.Management.ADPropertyValueCollection Item(string ...\r\nDistinguishedName Property System.String DistinguishedName {get;set;}\r\nEnabled Property System.Boolean Enabled {get;set;}\r\nGivenName Property System.String GivenName {get;set;}\r\nName Property System.String Name {get;}\r\nObjectClass Property System.String ObjectClass {get;set;}\r\nObjectGUID Property System.Nullable`1[[System.Guid, mscorlib, Version=2.0.0.0, Culture=neutral,...\r\nPSShowComputerName Property Microsoft.ActiveDirectory.Management.ADPropertyValueCollection PSShowComput...\r\nSamAccountName Property System.String SamAccountName {get;set;}\r\nSID Property System.Security.Principal.SecurityIdentifier SID {get;set;}\r\nSurname Property System.String Surname {get;set;}\r\nUserPrincipalName Property System.String UserPrincipalName {get;set;}\r\nWriteErrorStream Property Microsoft.ActiveDirectory.Management.ADPropertyValueCollection WriteErrorSt...\r\n<\/pre>\nNope nothing there. So let’s look through the help. Nothing in basic help. So onto the -Detailed help.<\/p>\n
I get to the -Properties parameter<\/p>\n
-Properties
\n Specifies the properties of the output object to retrieve from the server. Use this parameter to retrieve properties that are not included in the default set.
\n<\/code><\/p>\nI guess that answers part of my question. So what are all the properties that I can look at? Reading a little further on<\/p>\n
To retrieve and display the list of all the properties for an ADGroup object, use the following command:
\n Get-ADGroup -Identity Administrators -Properties *| Get-Member<\/code><\/p>\nSo I alter my query like so:<\/p>\n
\r\nPS >$thisuser = Get-ADUser -Filter 'Name -like "LogonID"' -Properties *\r\nPS >$thisuser\r\n\r\nAccountExpirationDate :\r\naccountExpires : 9223372036854775807\r\nAccountLockoutTime :\r\nAccountNotDelegated : False\r\nAllowReversiblePasswordEncryption : False\r\nBadLogonCount : 0\r\nbadPwdCount : 0\r\nCannotChangePassword : False\r\n...\r\n<\/pre>\nI will save space and not put the whole lot here. You get the picture.<\/p>\n
So as a result I can now see an item called MemberOf which contains the information I am after. Now I can change my query to be the following.<\/p>\n
\r\nPS > Get-ADUser -Filter 'Name -like "LogonID"' -Properties MemberOf\r\n\r\nDistinguishedName : CN=LogonID,OU=Users,DC=Home,DC=local\r\nEnabled : True\r\nGivenName : John\r\nMemberOf : {CN=vCloud-SANDPIT-User,OU=Groups,DC=Home,DC=local, CN=vCloud-Infra-PowerUser,OU=Groups,DC=Home,DC=local, CN=vCOps-Admins,OU=Groups,DC=Home,DC=local...}\r\nName : LogonID\r\nObjectClass : user\r\nObjectGUID : 9383f28b-e4fc-4a8e-81e4-73094d4bba63\r\nPSShowComputerName : {}\r\nSamAccountName : LogonID\r\nSID : S-1-5-21-9871330858-2016497126-1624845914-51132\r\nSurname : Doe\r\nUserPrincipalName : LogonID@home.local\r\nWriteErrorStream : {}\r\nPropertyNames : {DistinguishedName, Enabled, GivenName, Name...}\r\nPropertyCount : 12\r\n<\/pre>\nIf you are curious about what Filtering you can do with ActiveDirectory run the following at a Powershell promopt:<\/p>\n
\r\nhelp about_ActiveDirectory_Filter\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"