Solved

Interface to query Active Directory

Posted on 2013-12-19
17
194 Views
Last Modified: 2014-01-18
Hi experts,

I have another question open for querying AD with VBScript - this is for testing and reporting purposes.

I also need to provide my team of business consultants with a user interface that they can use to test various file share security issues.

Typical tasks they need to perform:
Use a given group name to get all members of the group
Use a given user account to get all groups that a user is a member of
Use a given folder path to get a view on which groups have what rights on the group

I've been searching the web and there are millions of tools.  The problem is I have to download, install and test all of them.

I was hoping to get to an answer quicker based on expert experience.

Many thanks
0
Comment
Question by:PantoffelSlippers
  • 11
  • 3
  • 3
17 Comments
 
LVL 26

Assisted Solution

by:pony10us
pony10us earned 150 total points
ID: 39729704
Look at Dumpsec from Somarsoft:   http://www.systemtools.com/somarsoft/?somarsoft.com
0
 

Author Comment

by:PantoffelSlippers
ID: 39729718
Looking into it now thanks
0
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 150 total points
ID: 39729744
If you are not apposed to use Powershell you can do this very easily with 3 different commands... See below...

1. Import-Module activedirectory
    Get-ADGroupMember -Identity <GroupName> | Select Name, sAMAccountName

2. Import-module activedirectory
    Get-ADUser -Identity <Username> -Properties | Select MemberOf | ft -wrap

3. Get-Acl <yourPath> | fl

You can save each of these comamnds in notepad (save as .ps1 file extension) and create a shortcut to the users Desktop that need to be able to use it.

Will.
0
Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 

Author Comment

by:PantoffelSlippers
ID: 39729756
Thanks Will,

I'm not opposed to powershell...   I just know NOTHING about it.

Even the simple samples in your post are foreign to me.  How do I execute PowerShell scripts?

(Sorry for looking really dumb but I'm use to old school batch scripts, VBScripts or full .Net 2.0 applications).

Thanks again
0
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 150 total points
ID: 39729773
You need to have powershell installed on the local machine (Win7/2008 and above has this built-in) You will also need to have ADMT (Active Direcroty Management Tools) installed on the PC's that will be running the scripts as well.

Once you have that the 3 basic commands above will provide the info you are looking for.

You can run the commands right from the powershell window or you can save the powershell commands (individually) to notepad and give them a name with a .PS1 file extension.

Example.
ADgroupMemberLookup.ps1
ADUserMemberOf.PS1
AclLookup.PS1

Will.
0
 

Author Comment

by:PantoffelSlippers
ID: 39729805
pony10us,

I'm trying Dumpsec.  It's fairly easy with a specific local machine but I'm struggling to find how to do what I was looking for.

If I have a specific domain user account, how do I see with Dumpsec what groups this user belongs to?

Thanks
0
 

Author Comment

by:PantoffelSlippers
ID: 39729832
Will,

I'm getting this error when running the PS1 file:   <fileName> cannot be loaded because the execution of scripts is disabled on this system.

I'm googling it now...
0
 
LVL 26

Assisted Solution

by:pony10us
pony10us earned 150 total points
ID: 39729853
If you don't mind the command line then maybe try using dsget

Here is the syntax for getting the group membership of a user (as shown in the help)

To display the list of groups, recursively expanded, to which a given user
"Jon Smith" belongs, type:

    dsget user "cn=Jon Smith,cn=users,dc=microsoft,dc=com" -memberof -expand

You can get the help by typing dsget /? at a command prompt. It will also mention some of other tools such as dsquery.




Part of the problem with dumpsec is it isn't granule enough for what you want.
0
 

Author Comment

by:PantoffelSlippers
ID: 39729894
Will,

I set ExecutionPolicy to unrstricted to solve my problem.

I now a 2nd problem with query number 2.

The results i get is a list of OU's.  I used my own userID in the query but none of the groups I am a member of are listed.  Only OU's.

How do I get the groups?
0
 

Author Comment

by:PantoffelSlippers
ID: 39729981
pony10us,

I'm struggling with dsGet user also.

I only get back a message saying directory object was not found.  What needs to go in place of Jon Smith?   The user's alias?  Display Name?  I tied everything I could thing of.
0
 
LVL 26

Assisted Solution

by:pony10us
pony10us earned 150 total points
ID: 39730077
Use display name.

There is an error in the help

Where it has "cn=users" it should be "ou=users"

c:\dsget user "cn=<display name>,ou=LV4,ou=LV3,ou=LV2,ou=LV1,dc=domain,dc=local" -memberof -expand

Open in new window


This is an example where my display name was 4 OU's down in the tree.
0
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 150 total points
ID: 39730139
Sorry i was referring to a different command for #2. Use the below command to find the GroupMemberShip of a single user...

Import-module activedirectory
Get-ADPrincipalGroupMembership -Identity <username> | select sAMAccountName, GroupCategory, GroupScope | ft -autosize

That will give you all of the groups the individual user is part of. Also regarding the post above, you are correct you need to have the machines running the command to have ExecutionPolicy set to "remote signed".

Will.
0
 

Author Comment

by:PantoffelSlippers
ID: 39730230
I'm doing OK with the Powershell script for now - but I have two small prpoblems:

My script to get all groups for a user is as follows:

Import-module ActiveDirectory
(GET-ADUSER –Identity holds –Properties MemberOf | Select-Object MemberOf).MemberOf | Sort

First problem is that when I right click the PS1 file and select run in powershell, the command window opens, stays open for a while and then closes - no result displayed.

The groups returned by my above script, are a lot.  Many users have 50+ groups.  The groups I want to see all come from one container.  Is it possible to filter the query results to show groups only from OU=Documentum_ShareData ?

I searched for samples online and it seems -Identity cannot be used with -Filter.

Please assist.
0
 

Author Comment

by:PantoffelSlippers
ID: 39730342
So this is my final attempt for the day:

Get-ADPrincipalGroupMembership -Identity holds | select-object sAMAccountName, GroupCategory, GroupScope, distinguishedName | Where {$_.distinguishedName -like "*OU=Documentum_ShareData*"} | sort sAMAccountName | ft -autosize


That sort of takes care of the groups a user belongs to.

Not sure how to do this recursively though.  Any ideas?
0
 

Author Comment

by:PantoffelSlippers
ID: 39730346
Experts,

Making slow progress with the powershell script.

Please remember my original post -  was looking for a GUI for my business consultants - that would still be first prize.

Thanks
0
 

Accepted Solution

by:
PantoffelSlippers earned 0 total points
ID: 39778638
I ended up developing my own tool in VB.Net.

Once a day it extracts all groups in a specific AD container from AD and writes them into my SQL database.  Then it queries the database to get the groups back and queries AD again for the membership of each group individually.  Nested groups/recursion is handled well here too.  Membership is written to the SQL database too.

Thirdly, the tool traverses the shared folder structure and extracts all the groups with their permissions on each folder and writes that back to the database too.

Then the tool allows querying through a user interface for group membership, a user's group membership or groups/users permissions on specific folders.
0
 

Author Closing Comment

by:PantoffelSlippers
ID: 39790485
Thank you very much experts
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Issue: One Windows 2008 R2 64bit server on the network unable to connect to a buffalo Device (Linkstation) with firmware version 1.56. There are a total of four servers on the network this being one of them. Troubleshooting Steps: Connect via h…
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question