Skip to content

Latest commit

 

History

History
269 lines (192 loc) · 6.83 KB

Get-ADTreePrincipalGroupMembership.md

File metadata and controls

269 lines (192 loc) · 6.83 KB

external help file: PSADTree.dll-Help.xml Module Name: PSADTree online version: schema: 2.0.0

Get-ADTreePrincipalGroupMembership

SYNOPSIS

tree like cmdlet for Active Directory Principals Group Membership.

SYNTAX

Depth (Default)

Get-ADTreePrincipalGroupMembership
    [-Identity] <String>
    [-Server <String>]
    [-Credential <PSCredential>]
    [-Depth <Int32>]
    [-ShowAll]
    [-Exclude <String[]>]
    [<CommonParameters>]

Recursive

Get-ADTreePrincipalGroupMembership
    [-Identity] <String>
    [-Server <String>]
    [-Credential <PSCredential>]
    [-Recursive]
    [-ShowAll]
    [-Exclude <String[]>]
    [<CommonParameters>]

DESCRIPTION

The Get-ADTreePrincipalGroupMembership cmdlet gets the Active Directory groups that have a specified user, computer, group, or service account as a member and displays them in a tree like structure. This cmdlet also helps identifying Circular Nested Groups.

EXAMPLES

Example 1: Get group memberships for a user

PS ..\PSADTree\> Get-ADTreePrincipalGroupMembership john.doe

By default, this cmdlet uses -Depth with a default value of 3.

Example 2: Get the recursive group memberships for a user

PS ..\PSADTree\> Get-ADTreePrincipalGroupMembership john.doe -Recursive

Example 3: Get group memberships for all computers under an Organizational Unit

PS ..\PSADTree\> Get-ADComputer -Filter * -SearchBase 'OU=myOU,DC=myDomain,DC=com' |
    Get-ADTreePrincipalGroupMembership

You can pipe strings containing an identity to this cmdlet. ADObject instances piped to this cmdlet are also supported.

Example 4: Find any Circular Nested Groups from previous example

PS ..\PSADTree\> Get-ADComputer -Filter * -SearchBase 'OU=myOU,DC=myDomain,DC=com' |
    Get-ADTreePrincipalGroupMembership -Recursive |
    Where-Object IsCircular

Example 5: Get group memberships for a user in a different Domain

PS ..\PSADTree\> Get-ADTreePrincipalGroupMembership john.doe -Server otherDomain

Example 6: Get group memberships for a user, including processed groups

PS ..\PSADTree\> Get-ADTreePrincipalGroupMembership john.doe -ShowAll

By default, previously processed groups will be marked as "Processed Group" and their hierarchy will not be displayed. The -ShowAll switch indicates that the cmdlet should display the hierarchy of all previously processed groups.

Note

The use of this switch should not infer in a great performance cost, for more details see the parameter details.

PARAMETERS

-Credential

Specifies a user account that has permission to perform this action. The default is the current user.

Type a user name, such as User01 or Domain01\User01, or enter a PSCredential object generated by the Get-Credential cmdlet. If you type a user name, you're prompted to enter the password.

Type: PSCredential
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Depth

Determines the number of nested group memberships included in the recursion. By default, only 3 levels of recursion are included. Get-ADTreePrincipalGroupMembership emits a warning if the levels exceed this number.

Type: Int32
Parameter Sets: Depth
Aliases:

Required: False
Position: Named
Default value: 3
Accept pipeline input: False
Accept wildcard characters: False

-Exclude

Specifies an array of one or more string patterns to be matched as the cmdlet enumerates child principals. Any matching principal is excluded from the output. Wildcard characters are accepted.

Note

Patterns are tested against the principal's .SamAccountName property.

Type: String[]
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: True

-Identity

Specifies an Active Directory principal by providing one of the following property values:

  • A DistinguishedName
  • A GUID
  • A SID (Security Identifier)
  • A sAMAccountName
  • A UserPrincipalName

See IdentityType Enum for more information.

Type: String
Parameter Sets: (All)
Aliases: DistinguishedName

Required: True
Position: 0
Default value: None
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: False

-Recursive

Specifies that the cmdlet should get all group membership of the specified principal.

Type: SwitchParameter
Parameter Sets: Recursive
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Server

Specifies the AD DS instance to connect to by providing one of the following values for a corresponding domain name or directory server.

Domain name values:

  • Fully qualified domain name
  • NetBIOS name

Directory server values:

  • Fully qualified directory server name
  • NetBIOS name
  • Fully qualified directory server name and port
Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ShowAll

By default, previously processed groups will be marked as "Processed Group" and their hierarchy will not be displayed. This switch forces the cmdlet to display the full hierarchy including previously processed groups.

Note

This cmdlet uses a caching mechanism to ensure that Active Directory Groups are only queried once per Identity. This caching mechanism is also used to reconstruct the pre-processed group's hierarchy when the -ShowAll switch is used, thus not incurring a performance cost. The intent behind this switch is to not clutter the cmdlet's output by default.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters. For more information, see about_CommonParameters.

INPUTS

System.String

You can pipe strings containing an identity to this cmdlet. ADObject instances piped to this cmdlet are also supported.

OUTPUTS

PSADTree.TreeGroup

PSADTree.TreeUser

PSADTree.TreeComputer

NOTES

treeprincipalmembership is the alias for this cmdlet.

RELATED LINKS