Skip to content

Latest commit

 

History

History
290 lines (208 loc) · 7.27 KB

Get-ADTreeGroupMember.md

File metadata and controls

290 lines (208 loc) · 7.27 KB

external help file: PSADTree.dll-Help.xml Module Name: PSADTree online version: schema: 2.0.0

Get-ADTreeGroupMember

SYNOPSIS

tree like cmdlet for Active Directory group members.

SYNTAX

Depth (Default)

Get-ADTreeGroupMember
    [-Group]
    [-Identity] <String>
    [-Server <String>]
    [-Credential <PSCredential>]
    [-Depth <Int32>]
    [-ShowAll]
    [-Exclude <String[]>]
    [<CommonParameters>]

Recursive

Get-ADTreeGroupMember
    [-Group]
    [-Identity] <String>
    [-Server <String>]
    [-Credential <PSCredential>]
    [-Recursive]
    [-ShowAll]
    [-Exclude <String[]>]
    [<CommonParameters>]

DESCRIPTION

The Get-ADTreeGroupMember cmdlet gets the Active Directory members of a specified group and displays them in a tree like structure. The members of a group can be users, groups, computers and service accounts. This cmdlet also helps identifying Circular Nested Groups.

EXAMPLES

Example 1: Get the members of a group

PS ..\PSADTree\> Get-ADTreeGroupMember TestGroup001

By default, this cmdlet uses -Depth with a default value of 3.

Example 2: Get the members of a group recursively

PS ..\PSADTree\> Get-ADTreeGroupMember TestGroup001 -Recursive

Example 3: Get the members of all groups under an Organizational Unit

PS ..\PSADTree\> Get-ADGroup -Filter * -SearchBase 'OU=myOU,DC=myDomain,DC=com' |
    Get-ADTreeGroupMember

You can pipe strings containing an identity to this cmdlet. ADGroup instances piped to this cmdlet are also supported.

Example 4: Find any Circular Nested Groups from previous example

PS ..\PSADTree\> Get-ADComputer -Filter * -SearchBase 'OU=myOU,DC=myDomain,DC=com' |
    Get-ADTreeGroupMember -Recursive -Group |
    Where-Object IsCircular

The -Group switch limits the members tree view to nested groups only.

Example 5: Get group members in a different Domain

PS ..\PSADTree\> Get-ADTreeGroupMember TestGroup001 -Server otherDomain

Example 6: Get group members including processed groups

PS ..\PSADTree\> Get-ADTreeGroupMember TestGroup001 -ShowAll

By default, previously processed groups will be marked as "Processed Group" and their hierarchy will not be displayed. The -ShowAll switch indicates that the cmdlet should display the hierarchy of all previously processed groups.

Note

The use of this switch should not infer in a great performance cost, for more details see the parameter details.

PARAMETERS

-Credential

Specifies a user account that has permission to perform this action. The default is the current user.

Type a user name, such as User01 or Domain01\User01, or enter a PSCredential object generated by the Get-Credential cmdlet. If you type a user name, you're prompted to enter the password.

Type: PSCredential
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Depth

Determines the number of nested groups and their members included in the recursion. By default, only 3 levels of recursion are included. Get-ADTreeGroupMember emits a warning if the levels exceed this number.

Type: Int32
Parameter Sets: Depth
Aliases:

Required: False
Position: Named
Default value: 3
Accept pipeline input: False
Accept wildcard characters: False

-Exclude

Specifies an array of one or more string patterns to be matched as the cmdlet enumerates child principals. Any matching principal is excluded from the output. Wildcard characters are accepted.

Note

  • Patterns are tested against the principal's .SamAccountName property.
  • When the matched principal is of type group, all child principals are also excluded from the output.
Type: String[]
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: True

-Group

The -Group switch indicates that the cmdlet should display nested group members only. Essentially, a built-in filter where ObjectClass is group.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Identity

Specifies an Active Directory group by providing one of the following property values:

  • A DistinguishedName
  • A GUID
  • A SID (Security Identifier)
  • A sAMAccountName
  • A UserPrincipalName

See IdentityType Enum for more information.

Type: String
Parameter Sets: (All)
Aliases: DistinguishedName

Required: True
Position: 0
Default value: None
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: False

-Recursive

Specifies that the cmdlet should get all group members of the specified group.

Type: SwitchParameter
Parameter Sets: Recursive
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Server

Specifies the AD DS instance to connect to by providing one of the following values for a corresponding domain name or directory server.

Domain name values:

  • Fully qualified domain name
  • NetBIOS name

Directory server values:

  • Fully qualified directory server name
  • NetBIOS name
  • Fully qualified directory server name and port
Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ShowAll

By default, previously processed groups will be marked as "Processed Group" and their hierarchy will not be displayed. This switch forces the cmdlet to display the full hierarchy including previously processed groups.

Note

This cmdlet uses a caching mechanism to ensure that Active Directory Groups are only queried once per Identity. This caching mechanism is also used to reconstruct the pre-processed group's hierarchy when the -ShowAll switch is used, thus not incurring a performance cost. The intent behind this switch is to not clutter the cmdlet's output by default.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters. For more information, see about_CommonParameters.

INPUTS

System.String

You can pipe strings containing an identity to this cmdlet. ADGroup instances piped to this cmdlet are also supported.

OUTPUTS

PSADTree.TreeGroup

PSADTree.TreeUser

PSADTree.TreeComputer

NOTES

treegroupmember is the alias for this cmdlet.

RELATED LINKS