Powershell ADSI问题

Question

I'm working on a GPO powershell script that is supposed to help us cut down on our logon time. What I need to do, is pull the current username, and then check if it is a member of a group. The code I have right now is

$strFilter = "objectCategory=user"
$objDomain = New-Object System.DirectoryServices.DirectoryEntry("LDAP://OU=OU;DC=DC;DC=DC")
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.SearchRoot = $objDomain
$objSearcher.PageSize = 100000
$objSearcher.Filter = $strFilter
$objSearcher.SearchScope = "Subtree"
$colProplist = "samaccountname"
foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)}

$colResults = $objSearcher.FindAll()
$resultsarray = @() 
foreach ($objResult in $colResults)
{
    $objItem = $objResult.Properties | where-object -property samaccountname -eq $env:username
    $objItem.samaccountname

}

Unfortunately, even though it prints the username, I can't figure out how to see which principal group it's a member of! Since this is running on client machines that don't have RSAT, I can't use the active directory cmdlets like get-adprincipalgroupmembership . Any help?

Answer 1

It's a standard LDAP property. Just specify $colProplist = "samaccountname","memberof" .

Don't feel silly about missing it. The MSDN AD LDAP doc is comprehensive, but not particularly usable, especially because it assumes you already understand class inheritance, and some properties have two different names and only one is ever valid and it sometimes seems to change depending on context. Most people prefer alternate sources like SelfADSI .

Note that that is not a recursive search, but neither is Get-ADPrincipalGroupMembership . Getting a list of all AD groups a user is a member of directly or through group membership is exactly as painful as it sounds. You get memberof for the user, then walk through every group and check it's memberof, and repeat that until you run out of parents, then return the unique list. It's easier with the ActiveDirectory module, but it's not painless.