Get user's non-truncated Active Directory groups from command line

前端 未结 7 600
南旧
南旧 2021-01-30 00:46

I often use the net user command to have a look at AD groups for a user:

net user /DOMAIN 

This works well, howeve

7条回答
  •  无人及你
    2021-01-30 01:14

    Based on answer by P.Brian.Mackey-- I tried using gpresult /user /r command, but it only seemed to work for my user account; for other users accounts I got this result: The user "userNameHere" does not have RSOP data.

    So I read through this blog-- https://blog.thesysadmins.co.uk/group-policy-gpresult-examples.html-- and came upon a solution. You have to know the users computer name:

    gpresult /s  /r /user:
    

    After running the command, you have to ENTER a few times for the program to complete because it will pause in the middle of the ouput. Also, the results gave a bunch of data including a section for "COMPUTER SETTINGS> Applied Group Policy Objects" and then "COMPUTER SETTINGS> Security groups" and finally "USER SETTINGS> security groups" (this is what we are looking for with the AD groups listed with non-truncated descriptions!).

    Interesting to note that GPRESULT had some extra members not seen in NET USER command. Also, the sort order does not match and is not alphabetical. Any body who can add more insights in the comments that would be great.

    RESULTS: gpresult (with ComputerName, UserName)

    For security reasons, I have included only a subset of the membership results. (36 TOTAL, 12 SAMPLE)

    The user is a part of the following security groups
    ---------------------------------------------------
    ..
     Internet Email 
     GEVStandardPSMViewers  
     GcoFieldServicesEditors    
     AnimalWelfare_Readers  
     Business Objects   
     Zscaler_Standard_Access    
    ..
     GCM    
    ..
     GcmSharesEditors   
     GHVStandardPSMViewers  
     IntranetReportsViewers 
     JetDWUsers     -- (NOTE: this one was deleted today, the other "Jet" one was added)
    ..
     Time and Attendance Users  
    ..
    

    RESULTS: net user /DOMAIN (with UserName)

    For security reasons, I have included only a subset of the membership results. (23 TOTAL, 12 SAMPLE)

    Local Group Memberships  
    Global Group memberships    ...
                                 *Internet Email       *GEVStandardPSMViewers
                                 *GcoFieldServicesEdito*AnimalWelfare_Readers
                                 *Business Objects     *Zscaler_Standard_Acce
                                 ...
                                 *Time and Attendance U*GCM
                                 ...
                                 *GcmSharesEditors     *GHVStandardPSMViewers
                                 *IntranetReportsViewer*JetPowerUsers
    The command completed successfully.
    

提交回复
热议问题