• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 543
  • Last Modified:

how to check accounts that are members of multiple groups

Can someone help me modify this ? or a new script ?
I need to know from users.txt which account is a member of NOT just domain users .

$contents = get-content "users.txt"
foreach ($obj in $contents)
{
      if ((Get-ADPrincipalGroupMembership $obj | ? { $_.name -notlike "domain users" }) -eq $NULL)
      {
            $OBJ
      }
}
0
MilesLogan
Asked:
MilesLogan
1 Solution
 
LearnctxEngineerCommented:
The easiest way to do this is to just do a count of the group membership. All your users should be a member of domain users (some people take users out of Domain Users but that's dumb...disable them). Its also going to be quicker as you're only going to process the user object and dump the group DN's from the memberof attribute.

$contents = gc users.txt
foreach ($obj in $contents)
{
   if ((Get-ADUser $obj -properties memberof).memberof.count -ge 2)
   {
      $obj
   }
}

Open in new window

If you are someone who happens to remove accounts from domain users, you could also do the following.

$contents = gc users.txt
foreach ($obj in $contents)
{
   if (((Get-ADUser $obj -properties memberof).memberof | ? {$_ -notmatch "domain\susers"} | measure).count -ge 1)
   {
      $obj
   }
}

Open in new window

If you are intent on using Get-ADPrincipalGroupMembership (slow), then you can do the following.

$contents = gc users.txt
foreach ($obj in $contents)
{
   if ((Get-ADPrincipalGroupMembership $obj |  ? {$_.name -ne "Domain Users"} | measure).count -ge 1)
   {
      $obj
   }
}

Open in new window

0
 
MilesLoganAuthor Commented:
Thanks Learnctx !! I went with the first option.. I just did not know better .. thanks !
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Tackle projects and never again get stuck behind a technical roadblock.
Join Now