Hello,
When I run my script it is returning groups that do not have the user AD group membership in it directly.
Example if the person is a member of the Local Admins Group it is returning that he is a member of power user, backup operators, remote desktop users.
I just want to know if the AD group is in the local group or not.
Clear-Host
#This script gets the group and nested members of a user and compares it to the local groups on a server.
# If the user group is part of the local group it returns TRUE otherwise FALSE.
#*******************************************************
#Gets nested group members for an user
function GetGroups ($object)
{
Get-ADPrincipalGroupMembership $object | ForEach `
{
$_
# Get-ADPrincipalGroupMembership $_
GetGroups $_
}
}
#*********************************************************
# Uncomment this line to grab list of computers from a file
$Servers = Get-Content c:\temp\!_listv2.txt
#$Server = $env:computername # for testing on local computer
#$Servers = "xxxxxxx" # for testing on local computer
# User Information to run against a server.
$User = Get-ADUser "UserABC" -properties memberOf # user ID to compare against.
#$User = Read-Host 'What is the username?'
# Retrieves AD groups that the user is a member of
#$ADGroups = GetGroups $user | select name -Unique
[Array] $ADGroups = GetGroups $User | Where-Object -FilterScript {
$psitem -notin ('CN=Domain Users,CN=Builtin,DC=hteeter,DC=ht', 'CN=Users,CN=Builtin,DC=hteeter,DC=ht','CN=CERTSVC_DCOM_ACCESS,CN=Builtin,DC=hteeter,DC=ht')
}
# Change these two to suit your needs
#$ChildGroups = "domain users" # Compare to a single local domain group
$ChildGroups = $adgroups.name
#$LocalGroups = "Remote Desktop Users" # Compare to a single local group
$localgroups = Get-WMIObject win32_group -filter "LocalAccount='$true'" -computername $Servers | select name
$MemberNames = @()
foreach ($localgroup in $LocalGroups.name)
{ foreach ($Server in $Servers)
{
$Group= [ADSI]"WinNT://$Server/$LocalGroup,group"
$Members = @($Group.psbase.Invoke("Members"))
$Members | ForEach-Object {
$MemberNames += $_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)
}
$ChildGroups | ForEach-Object {
$output = "" | Select-Object Server, LocalGroup, AD_Group, InLocalGrp
$output.Server = $Server
$output.LocalGroup = $LocalGroup
$output.AD_Group = $_
$output.InLocalGrp = $MemberNames -contains $_
Write-Output $output
$output | Export-Csv c:\temp\compare.csv -Append -NoTypeInformation
}
}
}