Get-AdmPrincipalGroupMembership

Gets the groups that have a specified user, computer, or group as a member.

Get-AdmPrincipalGroupMembership
- [-Identity] <Object> required parameter
- -AdaxesService <string> required parameter
- [-Credential <PSCredential>]
- [-Partition <string>]
- [-Server <string>]
- [<CommonParameters>]

Description

The Get-AdmPrincipalGroupMembership cmdlet gets the groups that have a specified user, computer or group, as a member.

The Identity parameter specifies the user, computer, or group object that you want to determine group membership for. You can identify a user, computer, or group object by its distinguished name (DN), GUID, security identifier (SID) or Security Accounts Manager (SAM) account name (sAMAccountName). You can also specify a user, group, or computer object variable, such as $<localGroupObject>, or pass an object through the pipeline to the Identity parameter. For example, you can use the Get-AdmGroup cmdlet to retrieve a group object and then pass the object through the pipeline to the Get-AdmPrincipalGroupMembership cmdlet. Similarly, you can use Get-AdmUser or Get-AdmComputer to get user and computer objects to pass through the pipeline.

The AdaxesService parameter must be specified. The parameter identifies the Adaxes service that will be used to execute the cmdlet.

Examples

Example 1 – Get group membership of the specified user

Get-AdmPrincipalGroupMembership -AdaxesService localhost

cmdlet Get-AdmPrincipalGroupMembership at command pipeline position 1
Supply values for the following parameters:
Identity: administrator

DistinguishedName : CN=Domain Users,CN=Users,DC=Fabrikam,DC=com
ObjectClass       : group
Name              : Domain Users
ObjectGUID        : 0ec3128a-8b60-48a7-af56-e18cc7c9f218
SamAccountName    : Domain Users
SID               : S-1-5-21-2718492785-1413807572-3629993048-2006625
GroupCategory     : Security
GroupScope        : DomainLocal

DistinguishedName : CN=Administrators,CN=Builtin,DC=Fabrikam,DC=com
ObjectClass       : group
Name              : Administrators
ObjectGUID        : bd511337-fcad-4a53-8be2-11dd8be1f056
SamAccountName    : Administrators
SID               : S-1-5-21-2718492785-1413807572-3629993048-1637811
GroupCategory     : Security
GroupScope        : Universal

DistinguishedName : CN=Schema Admins,CN=Users,DC=Fabrikam,DC=com
ObjectClass       : group
Name              : Schema Admins
ObjectGUID        : 2db27f25-6c55-4e57-8bd4-a75faade1034
SamAccountName    : Schema Admins
SID               : S-1-5-21-2718492785-1413807572-3629993048-1624923
GroupCategory     : Distribution
GroupScope        : Global

This command gets all groups user administrator is a member of.

Example 2 – Get group membership of an account by using credentials

Get-AdmPrincipalGroupMembership -Identity Administrator -AdaxesService "adaxes.company.com" -Credential "FABRIKAM\User1"

DistinguishedName : CN=Domain Users,CN=Users,DC=Fabrikam,DC=com
ObjectClass       : group
Name              : Domain Users
ObjectGUID        : 0ec3128a-8b60-48a7-af56-e18cc7c9f218
SamAccountName    : Domain Users
SID               : S-1-5-21-2718492785-1413807572-3629993048-2006625
GroupCategory     : Security
GroupScope        : DomainLocal

DistinguishedName : CN=Administrators,CN=Builtin,DC=Fabrikam,DC=com
ObjectClass       : group
Name              : Administrators
ObjectGUID        : bd511337-fcad-4a53-8be2-11dd8be1f056
SamAccountName    : Administrators
SID               : S-1-5-21-2718492785-1413807572-3629993048-1637811
GroupCategory     : Security
GroupScope        : Universal

DistinguishedName : CN=Schema Admins,CN=Users,DC=Fabrikam,DC=com
ObjectClass       : group
Name              : Schema Admins
ObjectGUID        : 2db27f25-6c55-4e57-8bd4-a75faade1034
SamAccountName    : Schema Admins
SID               : S-1-5-21-2718492785-1413807572-3629993048-1624923
GroupCategory     : Distribution
GroupScope        : Global

This command gets all groups the Administrator account is a member of using the FABRIKAM\User1 credentials.

Parameters

-AdaxesService

Specifies the DNS name of an Adaxes service that will be used to execute this cmdlet. If this parameter is not specified, and the cmdlet is running from an Adaxes Active Directory provider drive, the value for this parameter can be determined from the current path. For example, if the current path is Adaxes:/example.com, the Adaxes service on example.com will be used. If the parameter is not specified and the service DNS name can't be determined from the current path, the cmdlet will access Active Directory directly. To perform an operation in a Microsoft Entra managed domain, you must specify this parameter.

Type:
string
Position:
Named
Required:
True
Default Value:
None
Accept pipeline input:
False
Accept wildcard characters:
False

-Credential

Specifies the user account credentials to use to perform this task. The default credentials are the credentials of the currently logged on user unless the cmdlet is run from an Adaxes Active Directory PowerShell provider drive. If the cmdlet is run from such a provider drive, the account associated with the drive is the default one.

To specify this parameter, you can type a user name, such as User1 or Domain01\User01 or you can specify a PSCredential object. If you specify a user name for this parameter, the cmdlet prompts for a password.

You can also create a PSCredential object by using a script or by using the Get-Credential cmdlet. You can then set the Credential parameter to the PSCredential object.

If the acting credentials do not have permission to perform the task, the cmdlet returns a terminating error.

Type:
PSCredential
Position:
Named
Required:
False
Default Value:
None
Accept pipeline input:
False
Accept wildcard characters:
False

-Identity

Specifies a directory object by providing one of the following property values. The identifier in parentheses is the schema name of the attribute.

Possible values for this parameter are:

Distinguished name (distinguishedName)
GUID (objectGUID)
Security identifier (objectSid)
SAM account name (sAMAccountName)

The cmdlet searches the default naming context or partition to find the object. If two or more objects are found, the cmdlet returns a non-terminating error.

This parameter can also get an object through the pipeline or you can set the parameter to an object instance.

Type:
ADComputer
Position:
1
Required:
True
Default Value:
None
Accept pipeline input:
True (ByValue)
Accept wildcard characters:
False

-Partition

Specifies the distinguished name of an Active Directory partition. The distinguished name must be one of the naming contexts on the current directory server. The cmdlet searches this partition to find the object defined by the Identity parameter.

In many cases, a default value will be used for the Partition parameter if no value is specified. The rules for determining the default value are given below. Note that rules listed first are evaluated first, and once a default value can be determined, no further rules will be evaluated.

If the Identity parameter is set to a distinguished name, the default value of Partition is automatically generated from this distinguished name.
If running cmdlets from an Adaxes Active Directory provider drive, the default value of Partition is automatically generated from the current path in the drive.
If none of the previous cases apply, the default value of Partition will be set to the default partition or naming context of the target domain.

Type:
string
Position:
Named
Required:
False
Default Value:
None
Accept pipeline input:
False
Accept wildcard characters:
False

-Server

Specifies the directory to connect to by providing one of the following values for a corresponding domain name or directory server. Specify the AD DS instance or the Microsoft Entra domain name in one of the following ways:

Domain name values:

Fully qualified domain name
NetBIOS name

Directory server values:

Fully qualified directory server name
NetBIOS name
Fully qualified directory server name and port

The default value for the Server parameter is determined by one of the following methods in the order that they are listed:

By using Server value from objects passed through the pipeline.
By using the server information associated with the Adaxes Active Directory PowerShell provider drive, when running under that drive.
By using the domain of the computer running PowerShell.

Type:
string
Position:
Named
Required:
False
Default Value:
None
Accept pipeline input:
False
Accept wildcard characters:
False

Inputs

Object

A principal object that represents a user, computer or group is received by the Identity parameter.

Derived types, such as the following are also received by this parameter:

Softerra.Adaxes.PowerShellModule.Directory.ADUser
Softerra.Adaxes.PowerShellModule.Directory.ADComputer
Softerra.Adaxes.PowerShellModule.Directory.ADGroup

Outputs

Softerra.Adaxes.PowerShellModule.Directory.ADGroup

Returns group objects that have the specified user, computer, group or service account as a member.

The Get-AdmPrincipalGroupMembership cmdlet returns a default set of ADGroup property values. To retrieve additional properties pass the objects produced by this cmdlet through the pipline to Get-AdmGroup and specify the additional properties required for the group objects in the Properties parameter.