如何根据组扩展属性获取用户所属的所有组

Question

I'm tryng to get all the groups the users of a domain are member of, but filtering only the groups with a given extensionattribute . I set the extensionattribute12 of all the domain groups to better filter some queries (ie Infrastructure - security - elearning). My query should get only the user(s) groups with

extensionattribute12=security

(for example). I use something like:

get-aduser -filter  -Properties memberof | select name, @{ l="GroupMembership"; e={$_.memberof  -join ";"  } }

and I get all the groups of the users. How can I filter by group extensionattribute?

Answer 1

You could use the inverse relationship ( member on the group object) to query all the groups a user is a member of, just 1 query per user. Here using an LDAP filter:

$groupLabel = "Security"

Get-ADUser -Filter * |ForEach-Object {
  $groups = Get-ADGroup -LDAPFilter "(&(extensionattribute12=$groupLabel)(member=$($_.DistinguishedName)))"

  [pscustomobject]@{
    User = $_.SamAccountName
    GroupMembership = $groups.DistinguishedName -join ';'
  }
}

---

If you have to process a large number of users or group memberships, you may find it faster to retrieve all the groups satisfying the extensionAttribute12 criteria up front and use that list to filter the memberOf attribute on the users:

$groupLabel = "Security"
# Create a hash set and populate it with the distinguished 
# names of all the groups we're looking for
$groupDNs = [System.Collections.Generic.HashSet[string]]::new(@(
  Get-ADGroup -Filter "extensionAttribute12 -eq '$groupLabel'" |Select -Expand DistinguishedName
))

Get-ADUser -Filter * -Properties memberOf |ForEach-Object {
  # Retrieve memberOf values and filter against the hash set
  $groups = $_.memberOf |Where-Object { $groupDNs.Contains($_) }

  [pscustomobject]@{
    User = $_.SamAccountName
    GroupMembership = $groups -join ';'
  }
}

Answer 2

Make it with N+1 queries

$groups = @( Get-ADGroup -Filter '(extensionattribute12 -eq "security")' )
$users = @( $groups | 
    ForEach-Object { Get-ADGroupMember -Identity $_ -Recursive } | 
    Sort-Object -Unique )

$users # All users of all groups that have EA12 = security

Answer 3

Get-ADUser -filter {...} -Properties memberof | select name, @{ l="GroupMembership"; e={( $_.memberof | Get-ADGroup |?{ $_.extensionattribute12 -eq 'security' }) -join ";" }} |?{ $_.GroupMembership }