Solved

Interface to query Active Directory

Posted on 2013-12-19
17
197 Views
Last Modified: 2014-01-18
Hi experts,

I have another question open for querying AD with VBScript - this is for testing and reporting purposes.

I also need to provide my team of business consultants with a user interface that they can use to test various file share security issues.

Typical tasks they need to perform:
Use a given group name to get all members of the group
Use a given user account to get all groups that a user is a member of
Use a given folder path to get a view on which groups have what rights on the group

I've been searching the web and there are millions of tools.  The problem is I have to download, install and test all of them.

I was hoping to get to an answer quicker based on expert experience.

Many thanks
0
Comment
Question by:PantoffelSlippers
  • 11
  • 3
  • 3
17 Comments
 
LVL 26

Assisted Solution

by:pony10us
pony10us earned 150 total points
ID: 39729704
Look at Dumpsec from Somarsoft:   http://www.systemtools.com/somarsoft/?somarsoft.com
0
 

Author Comment

by:PantoffelSlippers
ID: 39729718
Looking into it now thanks
0
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 150 total points
ID: 39729744
If you are not apposed to use Powershell you can do this very easily with 3 different commands... See below...

1. Import-Module activedirectory
    Get-ADGroupMember -Identity <GroupName> | Select Name, sAMAccountName

2. Import-module activedirectory
    Get-ADUser -Identity <Username> -Properties | Select MemberOf | ft -wrap

3. Get-Acl <yourPath> | fl

You can save each of these comamnds in notepad (save as .ps1 file extension) and create a shortcut to the users Desktop that need to be able to use it.

Will.
0
Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

 

Author Comment

by:PantoffelSlippers
ID: 39729756
Thanks Will,

I'm not opposed to powershell...   I just know NOTHING about it.

Even the simple samples in your post are foreign to me.  How do I execute PowerShell scripts?

(Sorry for looking really dumb but I'm use to old school batch scripts, VBScripts or full .Net 2.0 applications).

Thanks again
0
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 150 total points
ID: 39729773
You need to have powershell installed on the local machine (Win7/2008 and above has this built-in) You will also need to have ADMT (Active Direcroty Management Tools) installed on the PC's that will be running the scripts as well.

Once you have that the 3 basic commands above will provide the info you are looking for.

You can run the commands right from the powershell window or you can save the powershell commands (individually) to notepad and give them a name with a .PS1 file extension.

Example.
ADgroupMemberLookup.ps1
ADUserMemberOf.PS1
AclLookup.PS1

Will.
0
 

Author Comment

by:PantoffelSlippers
ID: 39729805
pony10us,

I'm trying Dumpsec.  It's fairly easy with a specific local machine but I'm struggling to find how to do what I was looking for.

If I have a specific domain user account, how do I see with Dumpsec what groups this user belongs to?

Thanks
0
 

Author Comment

by:PantoffelSlippers
ID: 39729832
Will,

I'm getting this error when running the PS1 file:   <fileName> cannot be loaded because the execution of scripts is disabled on this system.

I'm googling it now...
0
 
LVL 26

Assisted Solution

by:pony10us
pony10us earned 150 total points
ID: 39729853
If you don't mind the command line then maybe try using dsget

Here is the syntax for getting the group membership of a user (as shown in the help)

To display the list of groups, recursively expanded, to which a given user
"Jon Smith" belongs, type:

    dsget user "cn=Jon Smith,cn=users,dc=microsoft,dc=com" -memberof -expand

You can get the help by typing dsget /? at a command prompt. It will also mention some of other tools such as dsquery.




Part of the problem with dumpsec is it isn't granule enough for what you want.
0
 

Author Comment

by:PantoffelSlippers
ID: 39729894
Will,

I set ExecutionPolicy to unrstricted to solve my problem.

I now a 2nd problem with query number 2.

The results i get is a list of OU's.  I used my own userID in the query but none of the groups I am a member of are listed.  Only OU's.

How do I get the groups?
0
 

Author Comment

by:PantoffelSlippers
ID: 39729981
pony10us,

I'm struggling with dsGet user also.

I only get back a message saying directory object was not found.  What needs to go in place of Jon Smith?   The user's alias?  Display Name?  I tied everything I could thing of.
0
 
LVL 26

Assisted Solution

by:pony10us
pony10us earned 150 total points
ID: 39730077
Use display name.

There is an error in the help

Where it has "cn=users" it should be "ou=users"

c:\dsget user "cn=<display name>,ou=LV4,ou=LV3,ou=LV2,ou=LV1,dc=domain,dc=local" -memberof -expand

Open in new window


This is an example where my display name was 4 OU's down in the tree.
0
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 150 total points
ID: 39730139
Sorry i was referring to a different command for #2. Use the below command to find the GroupMemberShip of a single user...

Import-module activedirectory
Get-ADPrincipalGroupMembership -Identity <username> | select sAMAccountName, GroupCategory, GroupScope | ft -autosize

That will give you all of the groups the individual user is part of. Also regarding the post above, you are correct you need to have the machines running the command to have ExecutionPolicy set to "remote signed".

Will.
0
 

Author Comment

by:PantoffelSlippers
ID: 39730230
I'm doing OK with the Powershell script for now - but I have two small prpoblems:

My script to get all groups for a user is as follows:

Import-module ActiveDirectory
(GET-ADUSER –Identity holds –Properties MemberOf | Select-Object MemberOf).MemberOf | Sort

First problem is that when I right click the PS1 file and select run in powershell, the command window opens, stays open for a while and then closes - no result displayed.

The groups returned by my above script, are a lot.  Many users have 50+ groups.  The groups I want to see all come from one container.  Is it possible to filter the query results to show groups only from OU=Documentum_ShareData ?

I searched for samples online and it seems -Identity cannot be used with -Filter.

Please assist.
0
 

Author Comment

by:PantoffelSlippers
ID: 39730342
So this is my final attempt for the day:

Get-ADPrincipalGroupMembership -Identity holds | select-object sAMAccountName, GroupCategory, GroupScope, distinguishedName | Where {$_.distinguishedName -like "*OU=Documentum_ShareData*"} | sort sAMAccountName | ft -autosize


That sort of takes care of the groups a user belongs to.

Not sure how to do this recursively though.  Any ideas?
0
 

Author Comment

by:PantoffelSlippers
ID: 39730346
Experts,

Making slow progress with the powershell script.

Please remember my original post -  was looking for a GUI for my business consultants - that would still be first prize.

Thanks
0
 

Accepted Solution

by:
PantoffelSlippers earned 0 total points
ID: 39778638
I ended up developing my own tool in VB.Net.

Once a day it extracts all groups in a specific AD container from AD and writes them into my SQL database.  Then it queries the database to get the groups back and queries AD again for the membership of each group individually.  Nested groups/recursion is handled well here too.  Membership is written to the SQL database too.

Thirdly, the tool traverses the shared folder structure and extracts all the groups with their permissions on each folder and writes that back to the database too.

Then the tool allows querying through a user interface for group membership, a user's group membership or groups/users permissions on specific folders.
0
 

Author Closing Comment

by:PantoffelSlippers
ID: 39790485
Thank you very much experts
0

Featured Post

Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A project that enables an administrator to perform actions within a user session context not just at the time of login but any time later on day(s) or week(s) later.
Active Directory security has been a hot topic of late, and for good reason. With 90% of the world’s organization using this system to manage access to all parts of their IT infrastructure, knowing how to protect against threats and keep vulnerabil…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question