Display Active Directory User's Group Memberships

Hi there,
Just wondering how to properly display an AD User's Group Memberships when I create an array. What was requested, is to find all users in AD that have not logged into the network older than 90 days, do some cleanup (move their personal drive, Exchange mailbox, etc.) and to create a log of their account, and what groups they were in.

So here's what I was able to come up with:

#Create the time parameter, 90 days from last logon date

$90Days = (get-date).adddays(-90)

#Create a variable for the date stamp in the log file

$LogDate = get-date -f yyyyMMddhhmm

#Sets the OU to do the base search for all user accounts

$SearchBase = "OU=Contoso, DC=com"

#Create an empty array for the log file

$LogArray = @()

#Use ForEach to loop through all users with logon date older than date set, 90 days. Does clean up and adds to log array.

ForEach ($DeletedUser in (Get-ADUser -searchbase $SearchBase -filter {(lastlogondate -notlike "*" -OR lastlogondate -le $90days) -AND (passwordlastset -le $90days) -AND (enabled -eq $False) -AND (whencreated -le $90days)} -Properties *) )
{
	#Create new object for logging

        $obj = New-Object PSObject

        $obj | Add-Member -MemberType NoteProperty -Name “Name” -Value $DeletedUser.name

        $obj | Add-Member -MemberType NoteProperty -Name “samAccountName” -Value $DeletedUser.samaccountname

        $obj | Add-Member -MemberType NoteProperty -Name “DistinguishedName” -Value $DeletedUser.DistinguishedName

	[b]$obj | Add-Member -MemberType NoteProperty -Name "Member Of" -Value @{expression={$DeletedUser.memberof -join “;”}}[/b]

	#$obj | Add-Member -MemberType NoteProperty -Name “Home Directory” -Value $DeletedUser.homeDirectory

        $obj | Add-Member -MemberType NoteProperty -Name “Status” -Value ‘Deleted’

        #Adds object to the log array

        $LogArray += $obj
}

#Exports log array to CSV file in the temp directory with a date and time stamp in the file name.

$logArray | Export-Csv “C:\Temp\User_Report_$logDate.csv” -NoTypeInformation

Open in new window


Everything looks good, however, when it comes to the Member Of column, I get a "System.Collections.Hashtable", rather than all the groups the user was in. I think it's because I'm grabbing the data from a property that's an array, and then putting it in another array?

Just wondering what I'm missing...

Please let me know if you need additional info/details...

Thanks,
Classic
Classic1Database AdministratorAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

YZlatCommented:
try replacing

{$DeletedUser.memberof -join “;”}

Open in new window


with

{($DeletedUser.memberof | % { (Get-ADGroup $_).Name; }) -join ';'}

Open in new window

0
Classic1Database AdministratorAuthor Commented:
Hi YZlat,
Thanks for the quick response, unfortunately, I still get the same result:

        $obj | Add-Member -MemberType NoteProperty -Name "Member Of" -Value @{expression={($DeletedUser.memberof | % { (Get-ADGroup $_).Name; }) -join ';'}}

 

-Classic1
Output.jpg
0
footechCommented:
What you're seeing is kind of a combination of things.  When you use Export-CSV, all the values for the fields can really only be strings.  So having the "Member Of" field be a hashtable will not display correctly in a .CSV (even though it might display properly if you were outputting directly to console).
The following should work.
$obj | Add-Member -MemberType NoteProperty -Name "Member Of" -Value ($DeletedUser.memberof -join ";")

Open in new window


Beyond that, I would change your code to not use the Add-Member cmdlet, as it's typically very inefficient.  A better way would be:
Get-ADUser -searchbase $SearchBase -filter {(lastlogondate -notlike "*" -OR lastlogondate -le $90days) -AND (passwordlastset -le $90days) -AND (enabled -eq $False) -AND (whencreated -le $90days)} -Properties Name,samAccountName,DistinguishedName,MemberOf |
 Select Name,samAccountName,DistinguishedName,
        @{n="Member Of";e={$_.memberof -join ";"}},
        @{n="Status";e={"Deleted"}} |
 Export-Csv "C:\Temp\User_Report_$logDate.csv" -NoTypeInformation

Open in new window

Notice I also replaced the -properties * of the Get-ADUser command to retrieve only the attributes you want.
1

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Classic1Database AdministratorAuthor Commented:
Thanks for the quick response and tips! That worked great!
I was going to clean up the -Properties * once my Manager agreed on what she wanted to see...

I added: | % { (Get-ADObject $_).Name } to show the actual Name of the group, rather than showing everything...

Much appreciated,
Classic
0
footechCommented:
Glad to help.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Powershell

From novice to tech pro — start learning today.