How to get all groups that a user is a member of?

Question

PowerShell\'s Get-ADGroupMember cmdlet returns members of a specific group. Is there a cmdlet or property to get all the groups that a particular user is a member of?

Answer 1

Putting this here for future reference. I'm in the midst of an email migration. I need to know each user account and its respective group membership, and also I need to know each group and its respective members.

I'm using the code block below to output a CSV for each user's group membership.

Get-ADUser -Filter * |`
  ForEach-Object { `
    $FileName = $_.SamAccountName + ".csv" ; `
    $FileName ; `
    Get-ADPrincipalGroupMembership $_ | `
      Select-Object -Property SamAccountName, name, GroupScope, GroupCategory | `
        Sort-Object -Property SamAccountName | `
          Export-Csv -Path $FileName -Encoding ASCII ; `
  }

The export process for the groups and their respective members was a little convoluted, but the below works. The output filenames include the type of group. Therefore, the email distribution groups I need are/should be the Universal and Global Distribution groups. I should be able to just delete or move the resulting TXT files I don't need.

Get-ADGroup -Filter * | `
 Select-Object -Property Name, DistinguishedName, GroupScope, GroupCategory | `
  Sort-Object -Property GroupScope, GroupCategory, Name | `
   Export-Csv -Path ADGroupsNew.csv -Encoding ASCII

$MyCSV = Import-Csv -Path .\ADGroupsNew.csv -Encoding ASCII

$MyCSV | `
 ForEach-Object { `
  $FN = $_.GroupScope + ", " + $_.GroupCategory + ", " + $_.Name + ".txt" ; `
  $FN ; `
  Get-ADGroupMember -Identity $_.DistinguishedName | `
   Out-File -FilePath $FN -Encoding ASCII ; $FN=""; `
  }

Answer 2

Get group membership for a user:

$strUserName = "Primoz"
$strUser = get-qaduser -SamAccountName $strUserName
$strUser.memberof

See Get Group Membership for a User

But also see Quest's Free PowerShell Commands for Active Directory.

[Edit: Get-ADPrincipalGroupMembership command is included in Powershell since v2 with Windows 2008 R2. See kstrauss' answer below.]

Answer 3

   Get-ADUser -Filter { memberOf -RecursiveMatch "CN=Administrators,CN=Builtin,DC=Fabrikam,DC=com" } -SearchBase "CN=Administrator,CN=Users,DC=Fabrikam,DC=com"  -SearchScope Base
                  ## NOTE: The above command will return the user object (Administrator in this case) if it finds a match recursively in memberOf attribute. 

Answer 4

This should provide you the details for current user. Powershell not needed.

whoami /groups

Answer 5

Single line, no modules necessary, uses current logged user:

(New-Object System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$($env:username)))")).FindOne().GetDirectoryEntry().memberOf

Qudos to this vbs/powershell article: http://technet.microsoft.com/en-us/library/ff730963.aspx

Answer 6

First, import the activedirectory module:

import-module activedirectory

Then issue this command:

Get-ADGroupMember -Identity $group | foreach-object {
    Write-Host $_.SamAccountName
}

This will display the members of the specified group.