Interface to query Active Directory

Hi experts,

I have another question open for querying AD with VBScript - this is for testing and reporting purposes.

I also need to provide my team of business consultants with a user interface that they can use to test various file share security issues.

Typical tasks they need to perform:
Use a given group name to get all members of the group
Use a given user account to get all groups that a user is a member of
Use a given folder path to get a view on which groups have what rights on the group

I've been searching the web and there are millions of tools.  The problem is I have to download, install and test all of them.

I was hoping to get to an answer quicker based on expert experience.

Many thanks
PantoffelSlippersAsked:
Who is Participating?
Advertise Here
 
PantoffelSlippersConnect With a Mentor Author Commented:
I ended up developing my own tool in VB.Net.

Once a day it extracts all groups in a specific AD container from AD and writes them into my SQL database.  Then it queries the database to get the groups back and queries AD again for the membership of each group individually.  Nested groups/recursion is handled well here too.  Membership is written to the SQL database too.

Thirdly, the tool traverses the shared folder structure and extracts all the groups with their permissions on each folder and writes that back to the database too.

Then the tool allows querying through a user interface for group membership, a user's group membership or groups/users permissions on specific folders.
0
 
pony10usConnect With a Mentor Commented:
Look at Dumpsec from Somarsoft:   http://www.systemtools.com/somarsoft/?somarsoft.com
0
 
PantoffelSlippersAuthor Commented:
Looking into it now thanks
0
Get 10% Off Your First Squarespace Website

Ready to showcase your work, publish content or promote your business online? With Squarespace’s award-winning templates and 24/7 customer service, getting started is simple. Head to Squarespace.com and use offer code ‘EXPERTS’ to get 10% off your first purchase.

Start Now
 
Will SzymkowskiConnect With a Mentor Senior Solution ArchitectCommented:
If you are not apposed to use Powershell you can do this very easily with 3 different commands... See below...

1. Import-Module activedirectory
    Get-ADGroupMember -Identity <GroupName> | Select Name, sAMAccountName

2. Import-module activedirectory
    Get-ADUser -Identity <Username> -Properties | Select MemberOf | ft -wrap

3. Get-Acl <yourPath> | fl

You can save each of these comamnds in notepad (save as .ps1 file extension) and create a shortcut to the users Desktop that need to be able to use it.

Will.
0
 
PantoffelSlippersAuthor Commented:
Thanks Will,

I'm not opposed to powershell...   I just know NOTHING about it.

Even the simple samples in your post are foreign to me.  How do I execute PowerShell scripts?

(Sorry for looking really dumb but I'm use to old school batch scripts, VBScripts or full .Net 2.0 applications).

Thanks again
0
 
Will SzymkowskiConnect With a Mentor Senior Solution ArchitectCommented:
You need to have powershell installed on the local machine (Win7/2008 and above has this built-in) You will also need to have ADMT (Active Direcroty Management Tools) installed on the PC's that will be running the scripts as well.

Once you have that the 3 basic commands above will provide the info you are looking for.

You can run the commands right from the powershell window or you can save the powershell commands (individually) to notepad and give them a name with a .PS1 file extension.

Example.
ADgroupMemberLookup.ps1
ADUserMemberOf.PS1
AclLookup.PS1

Will.
0
 
PantoffelSlippersAuthor Commented:
pony10us,

I'm trying Dumpsec.  It's fairly easy with a specific local machine but I'm struggling to find how to do what I was looking for.

If I have a specific domain user account, how do I see with Dumpsec what groups this user belongs to?

Thanks
0
 
PantoffelSlippersAuthor Commented:
Will,

I'm getting this error when running the PS1 file:   <fileName> cannot be loaded because the execution of scripts is disabled on this system.

I'm googling it now...
0
 
pony10usConnect With a Mentor Commented:
If you don't mind the command line then maybe try using dsget

Here is the syntax for getting the group membership of a user (as shown in the help)

To display the list of groups, recursively expanded, to which a given user
"Jon Smith" belongs, type:

    dsget user "cn=Jon Smith,cn=users,dc=microsoft,dc=com" -memberof -expand

You can get the help by typing dsget /? at a command prompt. It will also mention some of other tools such as dsquery.




Part of the problem with dumpsec is it isn't granule enough for what you want.
0
 
PantoffelSlippersAuthor Commented:
Will,

I set ExecutionPolicy to unrstricted to solve my problem.

I now a 2nd problem with query number 2.

The results i get is a list of OU's.  I used my own userID in the query but none of the groups I am a member of are listed.  Only OU's.

How do I get the groups?
0
 
PantoffelSlippersAuthor Commented:
pony10us,

I'm struggling with dsGet user also.

I only get back a message saying directory object was not found.  What needs to go in place of Jon Smith?   The user's alias?  Display Name?  I tied everything I could thing of.
0
 
pony10usConnect With a Mentor Commented:
Use display name.

There is an error in the help

Where it has "cn=users" it should be "ou=users"

c:\dsget user "cn=<display name>,ou=LV4,ou=LV3,ou=LV2,ou=LV1,dc=domain,dc=local" -memberof -expand

Open in new window


This is an example where my display name was 4 OU's down in the tree.
0
 
Will SzymkowskiConnect With a Mentor Senior Solution ArchitectCommented:
Sorry i was referring to a different command for #2. Use the below command to find the GroupMemberShip of a single user...

Import-module activedirectory
Get-ADPrincipalGroupMembership -Identity <username> | select sAMAccountName, GroupCategory, GroupScope | ft -autosize

That will give you all of the groups the individual user is part of. Also regarding the post above, you are correct you need to have the machines running the command to have ExecutionPolicy set to "remote signed".

Will.
0
 
PantoffelSlippersAuthor Commented:
I'm doing OK with the Powershell script for now - but I have two small prpoblems:

My script to get all groups for a user is as follows:

Import-module ActiveDirectory
(GET-ADUSER –Identity holds –Properties MemberOf | Select-Object MemberOf).MemberOf | Sort

First problem is that when I right click the PS1 file and select run in powershell, the command window opens, stays open for a while and then closes - no result displayed.

The groups returned by my above script, are a lot.  Many users have 50+ groups.  The groups I want to see all come from one container.  Is it possible to filter the query results to show groups only from OU=Documentum_ShareData ?

I searched for samples online and it seems -Identity cannot be used with -Filter.

Please assist.
0
 
PantoffelSlippersAuthor Commented:
So this is my final attempt for the day:

Get-ADPrincipalGroupMembership -Identity holds | select-object sAMAccountName, GroupCategory, GroupScope, distinguishedName | Where {$_.distinguishedName -like "*OU=Documentum_ShareData*"} | sort sAMAccountName | ft -autosize


That sort of takes care of the groups a user belongs to.

Not sure how to do this recursively though.  Any ideas?
0
 
PantoffelSlippersAuthor Commented:
Experts,

Making slow progress with the powershell script.

Please remember my original post -  was looking for a GUI for my business consultants - that would still be first prize.

Thanks
0
 
PantoffelSlippersAuthor Commented:
Thank you very much experts
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.