使用Powershell检查Win32_group成员资格

Question

I want to know if a user whom username is delivered is member of a group whom groupname is delivered.

$u = Get-WmiObject -Class Win32_UserAccount -Filter "Name='$username'"
$g = Get-WmiObject -Class Win32_Group -Filter "Name='$groupname'"

So I get two object with the property SID.

How can I check that user $u is member of group $g ?

Answer 1

You can do this with an Associators query ( example ). Which are notoriously slow but do work.

$u = Get-WmiObject -Class Win32_UserAccount -Filter "Name='user'"
$group = Get-WmiObject -Class Win32_Group -Filter "Name='group'" | Select-Object -ExpandProperty Caption

$u | foreach { 
    $query = “Associators Of {Win32_UserAccount.Domain='” `
    + $_.Domain + “',Name='” + $_.Name `
     + “'} WHERE AssocClass=Win32_GroupUser”    
    $memberOf = Get-WmiObject -Query $query | 
    select -ExpandProperty Caption

    If($memberOf -contains $group){
        Write-Host "$($_.Name) is a member of $group"
    } Else {
        Write-Host "$($_.Name) is not a member of $group"
    }
}

Get the use you are looking for and group your are checking to see if the user is a member of. While u$ should be only one user it is still a collection with one member. Pipe it into a ForEach-Object and build the Associators query. Execute the query and return all the group captions ( domain\\groupname). Since $memberof is an array we can use -contains to see if the group you are looking for is there.

Alternatively

You could use the AD cmdlets if you have access to them and run the following

(Get-ADUser $user -Properties memberof | Select-Object -ExpandProperty memberof) -contains (Get-ADGroup -Identity $group)

The above will return True or False . You can install Ad cmdlets by using import-module activedirectory

Continued Testing

OpenLDAP should support this from what I gather and it's much faster then the previous WMI.

$search = [adsisearcher]"(&(objectcategory=user)(Name=userFullName))"
$userLDAP = $search.FindOne().Path
$userMembers = ([ADSI]$userLDAP).memberof

$search = [adsisearcher]"(&(objectcategory=group)(Name=groupname))" 
$group = ($search.FindOne().Path) -replace "LDAP://"

$userMembers -contains $group

Sorry as I do not have access to OpenLDAP for testing. Do a search for a user and get the MemberOf as $userMembers . Then get the group into $group . Needed to remove the LDAP prefix from the string. Then just do another -Contains again.