3

I am trying to get the list of a specific user’s groups and the groups’ descriptions using PowerShell.

import-module activedirectory
$username = Read-Host 'Please enter Username!'
Get-ADPrincipalGroupMembership $username | select name, description

The description field returns blank.

Palec
  • 11,499
  • 7
  • 57
  • 127
user3264332
  • 33
  • 1
  • 2
  • 5
  • Related ones: http://stackoverflow.com/q/5072996/2157640 http://stackoverflow.com/q/1458016/2157640 Did they help? – Palec Feb 03 '14 at 03:24
  • First link helped, though cannot figure out how to display the Description of the Groups – user3264332 Feb 03 '14 at 03:29

4 Answers4

6

From Get-ADPrincipalGroupMembership manual:

The Get-ADPrincipalGroupMembership cmdlet returns a default set of ADGroup property values. To retrieve additional ADGroup properties pass the ADGroups objects produced by this cmdlet through the pipline to Get-ADGroup. Specify the additional properties required from the group objects by passing the -Properties parameter to Get-ADGroup.

So, let’s do it!

import-module activedirectory
$username = Read-Host 'Please enter Username!'
Get-ADPrincipalGroupMembership $username | Get-ADGroup -Properties * | select name, description

Also, in this case it should be enough to specify name,description instead of asterisk (*). If this is a performance issue, replace it. I am leaving it at asterisk because you might later change your mind about which properties you need.

Palec
  • 11,499
  • 7
  • 57
  • 127
2

Here is a simple but effective script to get AD Group info.

Get-ADGroup -filter * -Properties * | Select Name,GroupCategory,Description | Export-Csv D:\Test\SecurityGroups.csv

Just add or remove the attributes you would like to see in the Select area. To see a list of usable attributes you can do something like this:

Get-ADGroup -filter * -Properties * | Where-Object {$_.Name -eq 'DHCP Users' }
TylerH
  • 20,816
  • 57
  • 73
  • 92
Mark
  • 21
  • 1
0

Get-ADPrincipalGroupMembership should work but fails if any group has a NAME containing '/' (which is a legal character in names as far as I understood the MS AD documentation).

This forces a heavy workaround:

$Groups = (Get-ADUser -identity $TemplateUserName -server $TemplateUserDomain -Properties MemberOf|select memberof).MemberOf|Get-ADGroup -Server :3268
foreach ($Group in $Groups)
{
    Write-Output $Group.Name
}

Notice I use a domain search for the user's properties and then a search in global catalog (-server :3268) for each group. Else you eventually won't get all of the user's groups or you'll get an error if any group belongs to a different domain than the user.

MKesper
  • 424
  • 5
  • 16
-1

For Users

Get-ADUser -Filter {name -eq $username} -Properties * | select name,description

For Groups

Get-ADGroup -Filter {displayname -eq $groupname} -Properties * | select name,description
edubriguenti
  • 3,926
  • 3
  • 37
  • 47
SpeKtro
  • 1