Solved

Interface to query Active Directory

Posted on 2013-12-19
17
191 Views
Last Modified: 2014-01-18
Hi experts,

I have another question open for querying AD with VBScript - this is for testing and reporting purposes.

I also need to provide my team of business consultants with a user interface that they can use to test various file share security issues.

Typical tasks they need to perform:
Use a given group name to get all members of the group
Use a given user account to get all groups that a user is a member of
Use a given folder path to get a view on which groups have what rights on the group

I've been searching the web and there are millions of tools.  The problem is I have to download, install and test all of them.

I was hoping to get to an answer quicker based on expert experience.

Many thanks
0
Comment
Question by:PantoffelSlippers
  • 11
  • 3
  • 3
17 Comments
 
LVL 26

Assisted Solution

by:pony10us
pony10us earned 150 total points
ID: 39729704
Look at Dumpsec from Somarsoft:   http://www.systemtools.com/somarsoft/?somarsoft.com
0
 

Author Comment

by:PantoffelSlippers
ID: 39729718
Looking into it now thanks
0
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 150 total points
ID: 39729744
If you are not apposed to use Powershell you can do this very easily with 3 different commands... See below...

1. Import-Module activedirectory
    Get-ADGroupMember -Identity <GroupName> | Select Name, sAMAccountName

2. Import-module activedirectory
    Get-ADUser -Identity <Username> -Properties | Select MemberOf | ft -wrap

3. Get-Acl <yourPath> | fl

You can save each of these comamnds in notepad (save as .ps1 file extension) and create a shortcut to the users Desktop that need to be able to use it.

Will.
0
 

Author Comment

by:PantoffelSlippers
ID: 39729756
Thanks Will,

I'm not opposed to powershell...   I just know NOTHING about it.

Even the simple samples in your post are foreign to me.  How do I execute PowerShell scripts?

(Sorry for looking really dumb but I'm use to old school batch scripts, VBScripts or full .Net 2.0 applications).

Thanks again
0
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 150 total points
ID: 39729773
You need to have powershell installed on the local machine (Win7/2008 and above has this built-in) You will also need to have ADMT (Active Direcroty Management Tools) installed on the PC's that will be running the scripts as well.

Once you have that the 3 basic commands above will provide the info you are looking for.

You can run the commands right from the powershell window or you can save the powershell commands (individually) to notepad and give them a name with a .PS1 file extension.

Example.
ADgroupMemberLookup.ps1
ADUserMemberOf.PS1
AclLookup.PS1

Will.
0
 

Author Comment

by:PantoffelSlippers
ID: 39729805
pony10us,

I'm trying Dumpsec.  It's fairly easy with a specific local machine but I'm struggling to find how to do what I was looking for.

If I have a specific domain user account, how do I see with Dumpsec what groups this user belongs to?

Thanks
0
 

Author Comment

by:PantoffelSlippers
ID: 39729832
Will,

I'm getting this error when running the PS1 file:   <fileName> cannot be loaded because the execution of scripts is disabled on this system.

I'm googling it now...
0
 
LVL 26

Assisted Solution

by:pony10us
pony10us earned 150 total points
ID: 39729853
If you don't mind the command line then maybe try using dsget

Here is the syntax for getting the group membership of a user (as shown in the help)

To display the list of groups, recursively expanded, to which a given user
"Jon Smith" belongs, type:

    dsget user "cn=Jon Smith,cn=users,dc=microsoft,dc=com" -memberof -expand

You can get the help by typing dsget /? at a command prompt. It will also mention some of other tools such as dsquery.




Part of the problem with dumpsec is it isn't granule enough for what you want.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 

Author Comment

by:PantoffelSlippers
ID: 39729894
Will,

I set ExecutionPolicy to unrstricted to solve my problem.

I now a 2nd problem with query number 2.

The results i get is a list of OU's.  I used my own userID in the query but none of the groups I am a member of are listed.  Only OU's.

How do I get the groups?
0
 

Author Comment

by:PantoffelSlippers
ID: 39729981
pony10us,

I'm struggling with dsGet user also.

I only get back a message saying directory object was not found.  What needs to go in place of Jon Smith?   The user's alias?  Display Name?  I tied everything I could thing of.
0
 
LVL 26

Assisted Solution

by:pony10us
pony10us earned 150 total points
ID: 39730077
Use display name.

There is an error in the help

Where it has "cn=users" it should be "ou=users"

c:\dsget user "cn=<display name>,ou=LV4,ou=LV3,ou=LV2,ou=LV1,dc=domain,dc=local" -memberof -expand

Open in new window


This is an example where my display name was 4 OU's down in the tree.
0
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 150 total points
ID: 39730139
Sorry i was referring to a different command for #2. Use the below command to find the GroupMemberShip of a single user...

Import-module activedirectory
Get-ADPrincipalGroupMembership -Identity <username> | select sAMAccountName, GroupCategory, GroupScope | ft -autosize

That will give you all of the groups the individual user is part of. Also regarding the post above, you are correct you need to have the machines running the command to have ExecutionPolicy set to "remote signed".

Will.
0
 

Author Comment

by:PantoffelSlippers
ID: 39730230
I'm doing OK with the Powershell script for now - but I have two small prpoblems:

My script to get all groups for a user is as follows:

Import-module ActiveDirectory
(GET-ADUSER –Identity holds –Properties MemberOf | Select-Object MemberOf).MemberOf | Sort

First problem is that when I right click the PS1 file and select run in powershell, the command window opens, stays open for a while and then closes - no result displayed.

The groups returned by my above script, are a lot.  Many users have 50+ groups.  The groups I want to see all come from one container.  Is it possible to filter the query results to show groups only from OU=Documentum_ShareData ?

I searched for samples online and it seems -Identity cannot be used with -Filter.

Please assist.
0
 

Author Comment

by:PantoffelSlippers
ID: 39730342
So this is my final attempt for the day:

Get-ADPrincipalGroupMembership -Identity holds | select-object sAMAccountName, GroupCategory, GroupScope, distinguishedName | Where {$_.distinguishedName -like "*OU=Documentum_ShareData*"} | sort sAMAccountName | ft -autosize


That sort of takes care of the groups a user belongs to.

Not sure how to do this recursively though.  Any ideas?
0
 

Author Comment

by:PantoffelSlippers
ID: 39730346
Experts,

Making slow progress with the powershell script.

Please remember my original post -  was looking for a GUI for my business consultants - that would still be first prize.

Thanks
0
 

Accepted Solution

by:
PantoffelSlippers earned 0 total points
ID: 39778638
I ended up developing my own tool in VB.Net.

Once a day it extracts all groups in a specific AD container from AD and writes them into my SQL database.  Then it queries the database to get the groups back and queries AD again for the membership of each group individually.  Nested groups/recursion is handled well here too.  Membership is written to the SQL database too.

Thirdly, the tool traverses the shared folder structure and extracts all the groups with their permissions on each folder and writes that back to the database too.

Then the tool allows querying through a user interface for group membership, a user's group membership or groups/users permissions on specific folders.
0
 

Author Closing Comment

by:PantoffelSlippers
ID: 39790485
Thank you very much experts
0

Featured Post

How does your email signature look on mobiles?

Do your employees use mobile devices to reply to emails? With mobile becoming increasingly important to the business world, it is in your best interest to make sure that your email signature looks great across all types of devices.

Join & Write a Comment

Suggested Solutions

Some time ago I faced the need to use a uniform folder structure that spanned across numerous sites of an enterprise to be used as a common repository for the Software packages of the Configuration Manager 2007 infrastructure. Because the procedu…
Do you have users whose passwords are expiring and they are constantly calling you?  Well I sure did and needed a way to put an end to this.  We have a lot of remote users which would not be notified that their passwords were expiring since they wer…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now