blocks|key|779303|text|Get-ADPrincipalGroupMembership将执行此操作。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779304|Get-ADPrincipalGroupMembership+username+%7C+select+name

name
----
Domain+Users
Domain+Computers
Workstation+Admins
Company+Users
Company+Developers
AutomatedProcessingTeam|code-block|syntax|javascript|779305|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Get-ADPrincipalGroupMembership will do this.

<pre><code>Get-ADPrincipalGroupMembership username | select name

name
----
Domain Users
Domain Computers
Workstation Admins
Company Users
Company Developers
AutomatedProcessingTeam
</code></pre>

blocks|key|993967|text|单行，不需要模块，使用当前登录的用户：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|993968|(New-Object+System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$($env:username)))")).FindOne().GetDirectoryEntry().memberOf|code-block|syntax|javascript|993969|致敬这篇vbs/powershell文章：http://technet.microsoft.com/en-us/library/ff730963.aspx|offset|length|993970|entityMap|0|LINK|mutability|MUTABLE|url|http://technet.microsoft.com/en-us/library/ff730963.aspx^0|0|0|L|1K|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|U|8|@]|9|@$I|V|J|W|1|X]]|A|$]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|L|$M|$5|N|O|P|A|$Q|R]]]]

Single line, no modules necessary, uses current logged user:
<pre><code>(New-Object System.DirectoryServices.DirectorySearcher(&quot;(&amp;(objectCategory=User)(samAccountName=$($env:username)))&quot;)).FindOne().GetDirectoryEntry().memberOf
</code></pre>
Kudos to this vbs/powershell article: <a href="http://technet.microsoft.com/en-us/library/ff730963.aspx" rel="noreferrer">http://technet.microsoft.com/en-us/library/ff730963.aspx</a>

blocks|key|994052|text|一种比Canoas发布的更简洁的替代方法，用于获取当前登录用户的组成员资格。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|994053|我在这篇博文中遇到了这种方法：http://www.travisrunyard.com/2013/03/26/auto-create-outlook-mapi-user-profiles/|offset|length|994054|([ADSISEARCHER]"samaccountname=$($env:USERNAME)").Findone().Properties.memberof|code-block|syntax|javascript|994055|还有一个更好的版本，它使用正则表达式去掉LDAP垃圾，只留下组名称：|994056|([ADSISEARCHER]"samaccountname=$($env:USERNAME)").Findone().Properties.memberof+-replace+'%5ECN=([%5E,]%2B).%2B$','$1'|994057|有关使用ADSISEARCHER类型加速器的更多详细信息，请参阅scripting+guy博客：http://blogs.technet.com/b/heyscriptingguy/archive/2010/08/24/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory.aspx|994058|entityMap|0|LINK|mutability|MUTABLE|url|http://www.travisrunyard.com/2013/03/26/auto-create-outlook-mapi-user-profiles/|1|http://blogs.technet.com/b/heyscriptingguy/archive/2010/08/24/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory.aspx^0|0|F|27|0|0|0|0|0|1C|3Y|1|0^^$0|@$1|2|3|4|5|6|7|10|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|11|8|@]|9|@$D|12|E|13|1|14]]|A|$]]|$1|F|3|G|5|H|7|15|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|16|8|@]|9|@]|A|$]]|$1|M|3|N|5|H|7|17|8|@]|9|@]|A|$I|J]]|$1|O|3|P|5|6|7|18|8|@]|9|@$D|19|E|1A|1|1B]]|A|$]]|$1|Q|3|-4|5|6|7|1C|8|@]|9|@]|A|$]]]|R|$S|$5|T|U|V|A|$W|X]]|Y|$5|T|U|V|A|$W|Z]]]]

A more concise alternative to the one posted by Canoas, to get group membership for the currently-logged-on user.

I came across this method in this blog post: <a href="http://www.travisrunyard.com/2013/03/26/auto-create-outlook-mapi-user-profiles/">http://www.travisrunyard.com/2013/03/26/auto-create-outlook-mapi-user-profiles/</a>

<pre><code>([ADSISEARCHER]"samaccountname=$($env:USERNAME)").Findone().Properties.memberof
</code></pre>

An even better version which uses a regex to strip the LDAP guff and leaves the group names only:

<pre><code>([ADSISEARCHER]"samaccountname=$($env:USERNAME)").Findone().Properties.memberof -replace '^CN=([^,]+).+$','$1'
</code></pre>

More details about using the [ADSISEARCHER] type accelerator can be found on the scripting guy blog: <a href="http://blogs.technet.com/b/heyscriptingguy/archive/2010/08/24/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory.aspx">http://blogs.technet.com/b/heyscriptingguy/archive/2010/08/24/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory.aspx</a>

blocks|key|779779|text|来自CMD的老式方法：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779780|net+user+mst999+/domain+|code-block|syntax|javascript|779781|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Old school way from CMD: 

<pre><code>net user mst999 /domain 
</code></pre>

blocks|key|993591|text|(GET-ADUSER+–Identity+USERNAME+–Properties+MemberOf+%7C+Select-Object+MemberOf).MemberOf|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|993592|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>(GET-ADUSER –Identity USERNAME –Properties MemberOf | Select-Object MemberOf).MemberOf
</code></pre>

blocks|key|994536|text|如果您不能让Get-ADPrincipalGroupMembership为您工作，您可以尝试以该用户身份登录，然后使用。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|994537|$id+=+[Security.Principal.WindowsIdentity]::GetCurrent()
$groups+=+$id.Groups+%7C+foreach-object+{$_.Translate([Security.Principal.NTAccount])}
$groups+%7C+select+*|code-block|syntax|javascript|994538|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

If you cannot get Get-ADPrincipalGroupMembership to work for you could try logging in as that user then use.

<pre><code>$id = [Security.Principal.WindowsIdentity]::GetCurrent()
$groups = $id.Groups | foreach-object {$_.Translate([Security.Principal.NTAccount])}
$groups | select *
</code></pre>

blocks|key|994635|text|这将为您提供当前用户的详细信息。不需要Powershell。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|994636|whoami+/groups|offset|length|style|CODE|994637|entityMap^0|0|0|E|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@$D|L|E|M|F|G]]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

This should provide you the details for current user. Powershell not needed.

<code>whoami /groups</code>

blocks|key|779176|text|Get-Member不用于获取用户的组成员身份。如果您想要获取用户在本地系统上所属的组的列表，可以通过以下方式实现：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779177|$query+=+"ASSOCIATORS+OF+{Win32_Account.Name='DemoUser1',Domain='DomainName'}+WHERE+ResultRole=GroupComponent+ResultClass=Win32_Account"

Get-WMIObject+-Query+$query+%7C+Select+Name|code-block|syntax|javascript|779178|在上面的查询中，将DemoUser1替换为所需的用户名，并将DomainName替换为您的本地计算机名或域名。|779179|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

Get-Member is not for getting user's group membership. If you want to get a list of groups a user belongs to on the local system, you can do so by:

<pre><code>$query = "ASSOCIATORS OF {Win32_Account.Name='DemoUser1',Domain='DomainName'} WHERE ResultRole=GroupComponent ResultClass=Win32_Account"

Get-WMIObject -Query $query | Select Name
</code></pre>

In the above query, replace DemoUser1 with the username you want and the DomainName with either your local computer name or domain name.

blocks|key|993646|text|首先，导入ActiveDirectory模块：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|993647|Import-Module+ActiveDirectory|code-block|syntax|javascript|993648|然后发出以下命令：|993649|Get-ADGroupMember+-Identity+$group+%7C+foreach-object+{
++++Write-Host+$_.SamAccountName
}|993650|这将显示指定组的成员。|993651|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|Q|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|R|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|S|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

First, import the ActiveDirectory module:
<pre><code>Import-Module ActiveDirectory
</code></pre>
Then issue this command:
<pre><code>Get-ADGroupMember -Identity $group | foreach-object {
 Write-Host $_.SamAccountName
}
</code></pre>
This will display the members of the specified group.

blocks|key|779121|text|Get-Member是用于列出.NET+object的成员的cmdlet。这与用户/组成员身份无关。您可以通过如下方式获取当前用户的组成员身份：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|779122|PS>+[System.Security.Principal.WindowsIdentity]::GetCurrent().Groups+%7C+
+++++++++Format-Table+-auto

BinaryLength+AccountDomainSid++++Value
------------+----------------++++-----
++++++++++28+S-1-5-21-...++++++++S-1-5-21-2229937839-1383249143-3977914998-513
++++++++++12+++++++++++++++++++++S-1-1-0
++++++++++28+S-1-5-21-...++++++++S-1-5-21-2229937839-1383249143-3977914998-1010
++++++++++28+S-1-5-21-...++++++++S-1-5-21-2229937839-1383249143-3977914998-1003
++++++++++16+++++++++++++++++++++S-1-5-32-545
...|code-block|syntax|javascript|779123|如果您需要访问任意用户的组信息，那么@tiagoinu建议使用Quest+AD+cmdlet是一种更好的方法。|779124|entityMap^0|0|A|K|6|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@$9|P|A|Q|B|C]|$9|R|A|S|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|T|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|U|8|@]|D|@]|E|$]]|$1|M|3|-4|5|6|7|V|8|@]|D|@]|E|$]]]|N|$]]

<code>Get-Member</code> is a cmdlet for listing the members of a .NET <code>object</code>. This has nothing to do with user/group membership. You can get the current user's group membership like so:

<pre><code>PS&gt; [System.Security.Principal.WindowsIdentity]::GetCurrent().Groups | 
 Format-Table -auto

BinaryLength AccountDomainSid Value
------------ ---------------- -----
 28 S-1-5-21-... S-1-5-21-2229937839-1383249143-3977914998-513
 12 S-1-1-0
 28 S-1-5-21-... S-1-5-21-2229937839-1383249143-3977914998-1010
 28 S-1-5-21-... S-1-5-21-2229937839-1383249143-3977914998-1003
 16 S-1-5-32-545
...
</code></pre>

If you need access to arbitrary users' group info then @tiagoinu suggestion of using the Quest AD cmdlets is a better way to go.

blocks|key|779403|text|我编写了一个名为Get-ADPrincipalGroupMembershipRecursive+PowerShell的PowerShell函数。它接受用户、计算机、组或服务帐户的DSN。它从帐户的memberOf属性中检索组的初始列表，然后递归地检查这些组的成员身份。下面是简短的代码。完整的source+code+with+comments+can+be+found+here。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|779404|function+Get-ADPrincipalGroupMembershipRecursive(+)+{

++++Param(
++++++++[string]+$dsn,
++++++++[array]$groups+=+@()
++++)

++++$obj+=+Get-ADObject+$dsn+-Properties+memberOf

++++foreach(+$groupDsn+in+$obj.memberOf+)+{

++++++++$tmpGrp+=+Get-ADObject+$groupDsn+-Properties+memberOf

++++++++if(+($groups+%7C+where+{+$_.DistinguishedName+-eq+$groupDsn+}).Count+-eq+0+)+{
++++++++++++$groups+%2B=++$tmpGrp+++++++++++
++++++++++++$groups+=+Get-ADPrincipalGroupMembershipRecursive+$groupDsn+$groups
++++++++}
++++}

++++return+$groups
}

#+Simple+Example+of+how+to+use+the+function
$username+=+Read-Host+-Prompt+"Enter+a+username"
$groups+++=+Get-ADPrincipalGroupMembershipRecursive+(Get-ADUser+$username).DistinguishedName
$groups+%7C+Sort-Object+-Property+name+%7C+Format-Table|code-block|syntax|javascript|779405|entityMap|0|LINK|mutability|MUTABLE|url|http://www.reich-consulting.net/2013/12/05/retrieving-recursive-group-memberships-powershell/^0|42|17|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@$A|R|B|S|1|T]]|C|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|C|$G|H]]|$1|I|3|-4|5|6|7|V|8|@]|9|@]|C|$]]]|J|$K|$5|L|M|N|C|$O|P]]]]

I wrote a PowerShell function called Get-ADPrincipalGroupMembershipRecursive. It accepts the DSN of a user, computer, group, or service account. It retrieves an initial list of groups from the account's memberOf attribute, then recursively checks those group's memberships. Abbreviated code is below. Full <a href="http://www.reich-consulting.net/2013/12/05/retrieving-recursive-group-memberships-powershell/" rel="nofollow">source code with comments can be found here</a>.

<pre><code>function Get-ADPrincipalGroupMembershipRecursive( ) {

 Param(
 [string] $dsn,
 [array]$groups = @()
 )

 $obj = Get-ADObject $dsn -Properties memberOf

 foreach( $groupDsn in $obj.memberOf ) {

 $tmpGrp = Get-ADObject $groupDsn -Properties memberOf

 if( ($groups | where { $_.DistinguishedName -eq $groupDsn }).Count -eq 0 ) {
 $groups += $tmpGrp 
 $groups = Get-ADPrincipalGroupMembershipRecursive $groupDsn $groups
 }
 }

 return $groups
}

# Simple Example of how to use the function
$username = Read-Host -Prompt "Enter a username"
$groups = Get-ADPrincipalGroupMembershipRecursive (Get-ADUser $username).DistinguishedName
$groups | Sort-Object -Property name | Format-Table
</code></pre>

blocks|key|994264|text|使用：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|994265|Get-ADPrincipalGroupMembership+username+%7C+select+name+%7C+export-CSV+username.csv|code-block|syntax|javascript|994266|这会将命令的输出通过管道传输到CSV文件中。|offset|length|994267|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Comma-separated_values^0|0|0|F|3|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|U|8|@]|9|@$I|V|J|W|1|X]]|A|$]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|L|$M|$5|N|O|P|A|$Q|R]]]]

Use:

<pre><code>Get-ADPrincipalGroupMembership username | select name | export-CSV username.csv
</code></pre>

This pipes output of the command into a <a href="http://en.wikipedia.org/wiki/Comma-separated_values" rel="nofollow">CSV</a> file.

blocks|key|779865|text|它只有一行：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779866|(get-aduser+joe.bloggs+-properties+*).memberof|code-block|syntax|javascript|779867|结束:)|779868|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

It is just one line:

<pre><code>(get-aduser joe.bloggs -properties *).memberof
</code></pre>

end of :)

blocks|key|779822|text|下面的代码运行良好：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779823|get-aduser+$username+-Properties+memberof+%7C+select+-expand+memberof|code-block|syntax|javascript|779824|如果您有一个用户列表：|779825|$list+=+'administrator','testuser1','testuser2'
$list+%7C+`
++++%25{++
++++++++$user+=+$_;+
++++++++get-aduser+$user+-Properties+memberof+%7C+`
++++++++select+-expand+memberof+%7C+`
++++++++%25{new-object+PSObject+-property+@{User=$user;Group=$_;}}+`
++++}|779826|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

The below works well:

<pre><code>get-aduser $username -Properties memberof | select -expand memberof
</code></pre>

If you have a list of users:

<pre><code>$list = 'administrator','testuser1','testuser2'
$list | `
 %{ 
 $user = $_; 
 get-aduser $user -Properties memberof | `
 select -expand memberof | `
 %{new-object PSObject -property @{User=$user;Group=$_;}} `
 }
</code></pre>

blocks|key|779468|text|Get-QADUser+-SamAccountName+LoginID+%7C%25+{$_.MemberOf+}%7C+Get-QADGroup+%7C选择名称|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779469|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Get-QADUser -SamAccountName LoginID | % {$_.MemberOf } | Get-QADGroup | select name

blocks|key|779707|text|+++Get-ADUser+-Filter+{+memberOf+-RecursiveMatch+"CN=Administrators,CN=Builtin,DC=Fabrikam,DC=com"+}+-SearchBase+"CN=Administrator,CN=Users,DC=Fabrikam,DC=com"++-SearchScope+Base
++++++++++++++++++##+NOTE:+The+above+command+will+return+the+user+object+(Administrator+in+this+case)+if+it+finds+a+match+recursively+in+memberOf+attribute.+|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|779708|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code> Get-ADUser -Filter { memberOf -RecursiveMatch "CN=Administrators,CN=Builtin,DC=Fabrikam,DC=com" } -SearchBase "CN=Administrator,CN=Users,DC=Fabrikam,DC=com" -SearchScope Base
 ## NOTE: The above command will return the user object (Administrator in this case) if it finds a match recursively in memberOf attribute. 
</code></pre>

blocks|key|779941|text|要使其具有递归性，可以使用：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779942|<#+
++++.SYNOPSIS+++
++++++++Get+all+the+groups+that+a+user+is+MemberOf.

++++.DESCRIPTION
++++++++This+script+retrieves+all+the+groups+that+a+user+is+MemberOf+in+a+recursive+way.

++++.PARAMETER+SamAccountName
++++++++The+name+of+the+user+you+want+to+check+#>

Param+(
++++[String]$SamAccountName+=+'test',
++++$DomainUsersGroup+=+'CN=Domain+Users,CN=Users,DC=domain,DC=net'
)


Function+Get-ADMemberOf+{
++++Param+(
++++++++[Parameter(ValueFromPipeline)]
++++++++[PSObject[]]$Group,
++++++++[String]$DomainUsersGroup+=+'CN=Domain+Users,CN=Users,DC=grouphc,DC=net'
++++)
++++Process+{
++++++++foreach+($G+in+$Group)+{
++++++++++++$G+%7C+Get-ADGroup+%7C+Select+-ExpandProperty+Name
++++++++++++Get-ADGroup+$G+-Properties+MemberOf%7C+Select-Object+Memberof+%7C+ForEach-Object+{
++++++++++++++++Get-ADMemberOf+$_.Memberof
++++++++++++}
++++++++}
++++}
}


$Groups+=+Get-ADUser+$SamAccountName+-Properties+MemberOf+%7C+Select-Object+-ExpandProperty+MemberOf
$Groups+%2B=+$DomainUsersGroup
$Groups+%7C+Get-ADMemberOf+%7C+Select+-Unique+%7C+Sort-Object|code-block|syntax|javascript|779943|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

To get it recursive, you can use:

<pre><code>&lt;# 
 .SYNOPSIS 
 Get all the groups that a user is MemberOf.

 .DESCRIPTION
 This script retrieves all the groups that a user is MemberOf in a recursive way.

 .PARAMETER SamAccountName
 The name of the user you want to check #&gt;

Param (
 [String]$SamAccountName = 'test',
 $DomainUsersGroup = 'CN=Domain Users,CN=Users,DC=domain,DC=net'
)


Function Get-ADMemberOf {
 Param (
 [Parameter(ValueFromPipeline)]
 [PSObject[]]$Group,
 [String]$DomainUsersGroup = 'CN=Domain Users,CN=Users,DC=grouphc,DC=net'
 )
 Process {
 foreach ($G in $Group) {
 $G | Get-ADGroup | Select -ExpandProperty Name
 Get-ADGroup $G -Properties MemberOf| Select-Object Memberof | ForEach-Object {
 Get-ADMemberOf $_.Memberof
 }
 }
 }
}


$Groups = Get-ADUser $SamAccountName -Properties MemberOf | Select-Object -ExpandProperty MemberOf
$Groups += $DomainUsersGroup
$Groups | Get-ADMemberOf | Select -Unique | Sort-Object
</code></pre>

blocks|key|994449|text|如果您没有咨询其他成员组的权限，但有咨询组成员的权限，则可以执行以下操作来构建哪些用户有权访问哪些组的映射。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|994450|$groups+=+get-adgroup+-Filter+*+%7C+sort+name+%7C+select+Name
$users+=+@{}
foreach($group+in+$groups)+{
++++$groupUsers+=+@()
++++$groupUsers+=+Get-ADGroupMember+-Identity+$group.Name+%7C+Select-Object+SamAccountName
++++$groupUsers+%7C+%25+{
++++++++if(!$users.ContainsKey($_.SamAccountName)){
++++++++++++$users[$_.SamAccountName]+=+@()
++++++++}
++++++++($users[$_.SamAccountName])+%2B=+($group.Name)
++++}
}|code-block|syntax|javascript|994451|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

When you do not have privileges to consult other member groups but you do have the privilege to consult group members, you can do the following to build a map of which user has access to which groups.

<pre><code>$groups = get-adgroup -Filter * | sort name | select Name
$users = @{}
foreach($group in $groups) {
 $groupUsers = @()
 $groupUsers = Get-ADGroupMember -Identity $group.Name | Select-Object SamAccountName
 $groupUsers | % {
 if(!$users.ContainsKey($_.SamAccountName)){
 $users[$_.SamAccountName] = @()
 }
 ($users[$_.SamAccountName]) += ($group.Name)
 }
}
</code></pre>

blocks|key|780236|text|研究所有提出的评论给了我一个起点(感谢)，但也给我留下了几个未解决的问题。因此，这就是我的答案。所提供的代码片段比所要求的要多一点，但它提供了有用的调试信息。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|780237|[array]+$script:groupsdns+=+@()
function+Get-ADPrincipalGroupMembershipRecursive()+
{
++Param(+[string]+$dn,+[int]+$level+=+0,+[array]+$groups+=+@()+)

++#if(($groupsdns+%7C+where+{+$_.DistinguishedName+-eq+$dn+}).Count+-ne+0+)+{+return+$groups+}+#+dependency+on+next+statement
++#$groupsdns+%2B=+(Get-ADObject+$dn+-Properties+MemberOf)+#+Get-ADObject+cannot+find+an+object+with+identity
++if+($script:groupsdns.Contains($dn))+{+return+$groups+}
++$script:groupsdns+%2B=+$dn
++$mo+=+$Null
++$mo+=+Get-ADObject+$dn+-Properties+MemberOf+#+Get-ADObject+cannot+find+an+object+with+identity
++$group+=+($dn+%2B+"+("+%2B+$level.ToString())
++if+($mo+-eq+$Null)+{+$group+%2B=+"!"+}
++$group+%2B=+")"
++$groups+%2B=+$group
++foreach(+$groupdn+in+$mo.MemberOf+)
++{
++++$groups+=+Get-ADPrincipalGroupMembershipRecursive+-dn+$groupdn+-level+($level%2B1)+-groups+$groups
++}
++if+($level+-le+0)+
++{+
++++$primarygroupdn+=+(Get-ADUser+-Identity+$dn+-Properties+PrimaryGroup).PrimaryGroup+
++++$groups+=+Get-ADPrincipalGroupMembershipRecursive+-dn+$primarygroupdn+-level+($level%2B1)+-groups+$groups
++}
++return+$groups
}
$adusergroups+=+Get-ADPrincipalGroupMembershipRecursive+-dn+$aduser.DistinguishedName
$adusergroups+%7C+ft+-AutoSize+%7C+`
++++++++++++++Out-File+-Width+512+Get-ADPrincipalGroupMembershipRecursive.txt+#-Append+#-Wrap+#+%7C+Sort-Object+-Property+Name|code-block|syntax|javascript|780238|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Studying all comments presented gave me a starting point (thanks for such) but left me with several unresolved issues. As result here is my answer. The code snippet provided does a little more than what is asked for but it provides helpful debugging info.

<pre><code>[array] $script:groupsdns = @()
function Get-ADPrincipalGroupMembershipRecursive() 
{
 Param( [string] $dn, [int] $level = 0, [array] $groups = @() )

 #if(($groupsdns | where { $_.DistinguishedName -eq $dn }).Count -ne 0 ) { return $groups } # dependency on next statement
 #$groupsdns += (Get-ADObject $dn -Properties MemberOf) # Get-ADObject cannot find an object with identity
 if ($script:groupsdns.Contains($dn)) { return $groups }
 $script:groupsdns += $dn
 $mo = $Null
 $mo = Get-ADObject $dn -Properties MemberOf # Get-ADObject cannot find an object with identity
 $group = ($dn + " (" + $level.ToString())
 if ($mo -eq $Null) { $group += "!" }
 $group += ")"
 $groups += $group
 foreach( $groupdn in $mo.MemberOf )
 {
 $groups = Get-ADPrincipalGroupMembershipRecursive -dn $groupdn -level ($level+1) -groups $groups
 }
 if ($level -le 0) 
 { 
 $primarygroupdn = (Get-ADUser -Identity $dn -Properties PrimaryGroup).PrimaryGroup 
 $groups = Get-ADPrincipalGroupMembershipRecursive -dn $primarygroupdn -level ($level+1) -groups $groups
 }
 return $groups
}
$adusergroups = Get-ADPrincipalGroupMembershipRecursive -dn $aduser.DistinguishedName
$adusergroups | ft -AutoSize | `
 Out-File -Width 512 Get-ADPrincipalGroupMembershipRecursive.txt #-Append #-Wrap # | Sort-Object -Property Name
</code></pre>

blocks|key|780423|text|对于本地用户和组(即不在Active+Directory中)，如果你不想，或者不被允许，或者不能安装RSAT和/或Install-WindowsFeature+RSAT-AD-PowerShell和/或import-module+activedirectory，那么这里有一个纯粹的，预先安装的powershell+(5.1%2B)方法。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|780424|(注意:下面使用的Get-LocalGroup*仅适用于Powershell+v5.1及更高版本。"...v5.1与Windows10周年纪念更新一起于2016年8月2日发布，并在Windows+Server+2016中发布。Windows+7、Windows+Server+2008、Windows+Server+2008+R2、Windows+Server+2012和Windows+Server+2012+R2于2017年1月19日发布。“(wikipedia)|780425|$username+=+"user002"
Get-LocalGroup+%7C+ForEach-Object+{
++++#+the+usernames+are+returned+in+the+string+form+"computername\username"
++++if+(Get-LocalGroupMember+-Group+$_+%7C+Where-Object+name+-like+"*\$username")+{
++++++++$_.name
++++}+
}|code-block|syntax|javascript|780426|输出示例：|780427|Administrators
Users|780428|entityMap|0|LINK|mutability|MUTABLE|url|https://en.wikipedia.org/wiki/PowerShell^0|1L|15|2T|T|0|9|F|68|9|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@$9|Z|A|10|B|C]|$9|11|A|12|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|13|8|@$9|14|A|15|B|C]]|D|@$9|16|A|17|1|18]]|E|$]]|$1|H|3|I|5|J|7|19|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|1A|8|@]|D|@]|E|$]]|$1|O|3|P|5|J|7|1B|8|@]|D|@]|E|$K|L]]|$1|Q|3|-4|5|6|7|1C|8|@]|D|@]|E|$]]]|R|$S|$5|T|U|V|E|$W|X]]]]

For LOCAL users and groups (ie not in Active Directory), and if you don't want to, or aren't allowed to, or can't install RSAT and/or <code>Install-WindowsFeature RSAT-AD-PowerShell</code> and/or <code>import-module activedirectory</code> then here's a pure, pre-installed powershell (5.1+) way to do it.
(Note: <code>Get-LocalGroup*</code> used below are only available Powershell v5.1 and above. &quot;...v5.1 was released along with the Windows 10 Anniversary Update on August 2, 2016, and in Windows Server 2016. ...[F]or Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 [it] was released on January 19, 2017.&quot; (<a href="https://en.wikipedia.org/wiki/PowerShell" rel="nofollow noreferrer">wikipedia</a>))
<pre><code>$username = &quot;user002&quot;
Get-LocalGroup | ForEach-Object {
 # the usernames are returned in the string form &quot;computername\username&quot;
 if (Get-LocalGroupMember -Group $_ | Where-Object name -like &quot;*\$username&quot;) {
 $_.name
 } 
}
</code></pre>
Example output:
<pre><code>Administrators
Users
</code></pre>

blocks|key|779335|text|Import-Module+ActiveDirectory
Get-ADUser+-SearchBase+"OU=Users,DC=domain,DC=local"+-Filter+*+%7C+foreach-object+{
write-host+"User:"+$_.Name+-foreground+green
++++Get-ADPrincipalGroupMembership+$_.SamAccountName+%7C+foreach-object+{
++++++++write-host+"Member+Of:"+$_.name
++++}
}|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|779336|更改-SearchBase的值以反映您需要列出以下用户的OU+:)|unstyled|779337|这将列出该OU中的所有用户，并显示他们所属的组。|779338|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$B|C]]|$1|D|3|E|5|F|7|L|8|@]|9|@]|A|$]]|$1|G|3|H|5|F|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|F|7|N|8|@]|9|@]|A|$]]]|J|$]]

<pre><code>Import-Module ActiveDirectory
Get-ADUser -SearchBase "OU=Users,DC=domain,DC=local" -Filter * | foreach-object {
write-host "User:" $_.Name -foreground green
 Get-ADPrincipalGroupMembership $_.SamAccountName | foreach-object {
 write-host "Member Of:" $_.name
 }
}
</code></pre>

Change the value of -SearchBase to reflect the OU you need to list the users from :)

This will list all of the users in that OU and show you which groups they are a member of.

blocks|key|779505|text|Get-ADPrincipalGroupMembership+USERLOGON+%7C选择名称|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779506|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Get-ADPrincipalGroupMembership USERLOGON | select name

blocks|key|779740|text|这是获取名称的最简单方法：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779741|Get-ADPrincipalGroupMembership+"YourUserName"|offset|length|style|CODE|779742|#+Returns+distinguishedName+:+CN=users,OU=test,DC=SomeWhere+GroupCategory+++++:+Security+GroupScope++++++++:+Global+name++++++++++++++:+testGroup+objectClass+++++++:+group+objectGUID++++++++:+2130ed49-24c4-4a17-88e6-dd4477d15a4c+SamAccountName++++:+testGroup+SID+++++++++++++++:+S-1-5-21-2114067515-1964795913-1973001494-71628|779743|添加select语句以修剪响应或获取OU中的每个用户所属的每个组：|779744|foreach+($user+in+(get-aduser+-SearchScope+Subtree+-SearchBase+$oupath+-filter+*+-Properties+samaccountName,+MemberOf+%7C+select+samaccountName)){+Get-ADPrincipalGroupMembership+$user.samaccountName+%7C+select+name}|779745|entityMap^0|0|0|19|0|0|92|0|0|0|5V|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@$D|R|E|S|F|G]]|9|@]|A|$]]|$1|H|3|I|5|6|7|T|8|@$D|U|E|V|F|G]]|9|@]|A|$]]|$1|J|3|K|5|6|7|W|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|X|8|@$D|Y|E|Z|F|G]]|9|@]|A|$]]|$1|N|3|-4|5|6|7|10|8|@]|9|@]|A|$]]]|O|$]]

This is the simplest way to just get the names:

<code>Get-ADPrincipalGroupMembership "YourUserName"</code>

<code># Returns
distinguishedName : CN=users,OU=test,DC=SomeWhere
GroupCategory : Security
GroupScope : Global
name : testGroup
objectClass : group
objectGUID : 2130ed49-24c4-4a17-88e6-dd4477d15a4c
SamAccountName : testGroup
SID : S-1-5-21-2114067515-1964795913-1973001494-71628</code>

Add a select statement to trim the response or to get every user in an OU every group they are a user of:

<code>foreach ($user in (get-aduser -SearchScope Subtree -SearchBase $oupath -filter * -Properties samaccountName, MemberOf | select samaccountName)){
Get-ADPrincipalGroupMembership $user.samaccountName | select name}</code>

blocks|key|994384|text|上面几乎所有的解决方案都使用了ActiveDirecotry模块，在大多数情况下，该模块在默认情况下可能不可用。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|994385|我使用了下面的方法。有点间接，但达到了我的目的。|994386|列出所有可用组|994387|Get-WmiObject+-Class+Win32_Group|994388|然后列出用户所属的组|994389|[System.Security.Principal.WindowsIdentity]::GetCurrent().Groups|994390|然后，可以通过SIDs进行检查来完成比较。这适用于已登录的用户。如果我错了，请纠正我。这对PowerShell来说是全新的，但为了完成工作，我不得不完成这项工作。|994391|entityMap^0|F|F|0|0|0|0|W|0|0|0|1S|0|7|4|0^^$0|@$1|2|3|4|5|6|7|T|8|@$9|U|A|V|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|W|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|X|8|@]|D|@]|E|$]]|$1|J|3|K|5|6|7|Y|8|@$9|Z|A|10|B|C]]|D|@]|E|$]]|$1|L|3|M|5|6|7|11|8|@]|D|@]|E|$]]|$1|N|3|O|5|6|7|12|8|@$9|13|A|14|B|C]]|D|@]|E|$]]|$1|P|3|Q|5|6|7|15|8|@$9|16|A|17|B|C]]|D|@]|E|$]]|$1|R|3|-4|5|6|7|18|8|@]|D|@]|E|$]]]|S|$]]

Almost all above solutions used the <code>ActiveDirecotry</code> module which might not be available by default in most cases. 

I used below method. A bit indirect, but served my purpose. 

List all available groups

<code>Get-WmiObject -Class Win32_Group</code>

And then list the groups the user belongs to 

<code>[System.Security.Principal.WindowsIdentity]::GetCurrent().Groups</code>

Comparison can then be done via checking through the <code>SIDs</code>. This works for the logged in user. Please correct me if I am wrong. Completely new to PowerShell, but had to get this done for a work commitment.

blocks|key|780048|text|使用用户输入和奇特的输出格式：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|780049|[CmdletBinding(SupportsShouldProcess=$True)]+
Param(+
++++[Parameter(Mandatory+=+$True)]+
++++[String]$UserName+
)+
Import-Module+ActiveDirectory+
If+($UserName)+{+
++++$UserName+=+$UserName.ToUpper().Trim()+
++++$Res+=+(Get-ADPrincipalGroupMembership+$UserName+%7C+Measure-Object).Count+
++++If+($Res+-GT+0)+{+
++++++++Write-Output+"`n"+
++++++++Write-Output+"$UserName+AD+Group+Membership:"+
++++++++Write-Output+"==========================================================="+
++++++++Get-ADPrincipalGroupMembership+$UserName+%7C+Select-Object+-Property+Name,+GroupScope,+GroupCategory+%7C+Sort-Object+-Property+Name+%7C+FT+-A+
++++}+
}|code-block|syntax|javascript|780050|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

With user input and fancy output formatting:

<pre><code>[CmdletBinding(SupportsShouldProcess=$True)] 
Param( 
 [Parameter(Mandatory = $True)] 
 [String]$UserName 
) 
Import-Module ActiveDirectory 
If ($UserName) { 
 $UserName = $UserName.ToUpper().Trim() 
 $Res = (Get-ADPrincipalGroupMembership $UserName | Measure-Object).Count 
 If ($Res -GT 0) { 
 Write-Output "`n" 
 Write-Output "$UserName AD Group Membership:" 
 Write-Output "===========================================================" 
 Get-ADPrincipalGroupMembership $UserName | Select-Object -Property Name, GroupScope, GroupCategory | Sort-Object -Property Name | FT -A 
 } 
}
</code></pre>

blocks|key|994479|text|把这个放在这里以备将来参考。我正在进行电子邮件迁移。我需要知道每个用户帐户及其各自的组成员身份，还需要知道每个组及其各自的成员。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|994480|我使用下面的代码块为每个用户的组成员身份输出CSV。|994481|Get-ADUser+-Filter+*+%7C`
++ForEach-Object+{+`
++++$FileName+=+$_.SamAccountName+%2B+".csv"+;+`
++++$FileName+;+`
++++Get-ADPrincipalGroupMembership+$_+%7C+`
++++++Select-Object+-Property+SamAccountName,+name,+GroupScope,+GroupCategory+%7C+`
++++++++Sort-Object+-Property+SamAccountName+%7C+`
++++++++++Export-Csv+-Path+$FileName+-Encoding+ASCII+;+`
++}|code-block|syntax|javascript|994482|组及其各自成员的导出过程有点复杂，但下面的工作是可行的。输出文件名包括组的类型。因此，我需要的电子邮件通讯组是/应该是通用通讯组和全局通讯组。我应该能够删除或移动不需要的TXT文件。|994483|Get-ADGroup+-Filter+*+%7C+`
+Select-Object+-Property+Name,+DistinguishedName,+GroupScope,+GroupCategory+%7C+`
++Sort-Object+-Property+GroupScope,+GroupCategory,+Name+%7C+`
+++Export-Csv+-Path+ADGroupsNew.csv+-Encoding+ASCII

$MyCSV+=+Import-Csv+-Path+.\ADGroupsNew.csv+-Encoding+ASCII

$MyCSV+%7C+`
+ForEach-Object+{+`
++$FN+=+$_.GroupScope+%2B+",+"+%2B+$_.GroupCategory+%2B+",+"+%2B+$_.Name+%2B+".txt"+;+`
++$FN+;+`
++Get-ADGroupMember+-Identity+$_.DistinguishedName+%7C+`
+++Out-File+-FilePath+$FN+-Encoding+ASCII+;+$FN="";+`
++}|994484|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|Q|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|R|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|S|8|@]|9|@]|A|$G|H]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

Putting this here for future reference. I'm in the midst of an email migration. I need to know each user account and its respective group membership, and also I need to know each group and its respective members.

I'm using the code block below to output a CSV for each user's group membership.

<pre><code>Get-ADUser -Filter * |`
 ForEach-Object { `
 $FileName = $_.SamAccountName + ".csv" ; `
 $FileName ; `
 Get-ADPrincipalGroupMembership $_ | `
 Select-Object -Property SamAccountName, name, GroupScope, GroupCategory | `
 Sort-Object -Property SamAccountName | `
 Export-Csv -Path $FileName -Encoding ASCII ; `
 }
</code></pre>

The export process for the groups and their respective members was a little convoluted, but the below works. The output filenames include the type of group. Therefore, the email distribution groups I need are/should be the Universal and Global Distribution groups. I should be able to just delete or move the resulting TXT files I don't need.

<pre><code>Get-ADGroup -Filter * | `
 Select-Object -Property Name, DistinguishedName, GroupScope, GroupCategory | `
 Sort-Object -Property GroupScope, GroupCategory, Name | `
 Export-Csv -Path ADGroupsNew.csv -Encoding ASCII

$MyCSV = Import-Csv -Path .\ADGroupsNew.csv -Encoding ASCII

$MyCSV | `
 ForEach-Object { `
 $FN = $_.GroupScope + ", " + $_.GroupCategory + ", " + $_.Name + ".txt" ; `
 $FN ; `
 Get-ADGroupMember -Identity $_.DistinguishedName | `
 Out-File -FilePath $FN -Encoding ASCII ; $FN=""; `
 }
</code></pre>

blocks|key|780327|text|我使用这个简单的一行程序递归地搜索用户所属的所有组：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|780328|Get-ADPrincipalGroupMembership+$UserName+%7C+foreach-object+{+Get-ADPrincipalGroupMembership+$_.SamAccountName+%7C+select+SamAccountName+}|code-block|syntax|javascript|780329|要筛选组以确定用户是否为特定组的成员，我使用以下命令：|780330|if+(+Get-ADPrincipalGroupMembership+$UserName+%7C+foreach-object+{+Get-ADPrincipalGroupMembership+$_.SamAccountName+%7C+select+SamAccountName+}+%7C+where-object+{$_.SamAccountName+-like+"*$Groupname*"}+)+{+write-host+"Found"+}+else+{+write-host+"not+a+member+of+group+$Groupname"+}|780331|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

I use this simple oneliner to recursively search all the groups a user is member of:
<pre><code>Get-ADPrincipalGroupMembership $UserName | foreach-object { Get-ADPrincipalGroupMembership $_.SamAccountName | select SamAccountName }
</code></pre>
To filter the groups to find out if user is member of a specific group i use this:
<pre><code>if ( Get-ADPrincipalGroupMembership $UserName | foreach-object { Get-ADPrincipalGroupMembership $_.SamAccountName | select SamAccountName } | where-object {$_.SamAccountName -like &quot;*$Groupname*&quot;} ) { write-host &quot;Found&quot; } else { write-host &quot;not a member of group $Groupname&quot; }
</code></pre>

blocks|key|994836|text|(Get-ADUser+$env:username+-Properties+MemberOf).MemberOf+%7C+%25+{$_.split(",")[0].replace("CN=","")}

Domain+Users
Domain+Computers
Workstation+Admins
Company+Users
Company+Developers
AutomatedProcessingTeam|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|994837|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>(Get-ADUser $env:username -Properties MemberOf).MemberOf | % {$_.split(&quot;,&quot;)[0].replace(&quot;CN=&quot;,&quot;&quot;)}

Domain Users
Domain Computers
Workstation Admins
Company Users
Company Developers
AutomatedProcessingTeam
</code></pre>

PowerShell's <a href="https://technet.microsoft.com/en-us/library/ee617193.aspx"><code>Get-ADGroupMember</code></a> cmdlet returns members of a specific group. Is there a cmdlet or property to get all the groups that a particular user is a member of? 

<hr/>

I fixed my mistake: <a href="http://technet.microsoft.com/en-us/library/hh849928.aspx"><code>Get-Member</code></a> should be <code>Get-ADGroupMember</code>.

How to get all groups that a user is a member of?

Windows Server

Windows

PowerShell的 cmdlet返回特定组的成员。是否有cmdlet或属性可以获取特定用户所属的所有组？我修正了我的错误：应该是Get-ADGroupMember。

问如何获取用户所属的所有群组？
EN

回答 28

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何获取用户所属的所有群组？EN

回答 28

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何获取用户所属的所有群组？
EN