blocks|key|779121|text|Get-Member是用于列出.NET+object的成员的cmdlet。这与用户/组成员身份无关。您可以通过如下方式获取当前用户的组成员身份：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|779122|PS>+[System.Security.Principal.WindowsIdentity]::GetCurrent().Groups+%7C+
+++++++++Format-Table+-auto

BinaryLength+AccountDomainSid++++Value
------------+----------------++++-----
++++++++++28+S-1-5-21-...++++++++S-1-5-21-2229937839-1383249143-3977914998-513
++++++++++12+++++++++++++++++++++S-1-1-0
++++++++++28+S-1-5-21-...++++++++S-1-5-21-2229937839-1383249143-3977914998-1010
++++++++++28+S-1-5-21-...++++++++S-1-5-21-2229937839-1383249143-3977914998-1003
++++++++++16+++++++++++++++++++++S-1-5-32-545
...|code-block|syntax|javascript|779123|如果您需要访问任意用户的组信息，那么@tiagoinu建议使用Quest+AD+cmdlet是一种更好的方法。|779124|entityMap^0|0|A|K|6|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@$9|P|A|Q|B|C]|$9|R|A|S|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|T|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|U|8|@]|D|@]|E|$]]|$1|M|3|-4|5|6|7|V|8|@]|D|@]|E|$]]]|N|$]]

<code>Get-Member</code> is a cmdlet for listing the members of a .NET <code>object</code>. This has nothing to do with user/group membership. You can get the current user's group membership like so:

<pre><code>PS&gt; [System.Security.Principal.WindowsIdentity]::GetCurrent().Groups | 
 Format-Table -auto

BinaryLength AccountDomainSid Value
------------ ---------------- -----
 28 S-1-5-21-... S-1-5-21-2229937839-1383249143-3977914998-513
 12 S-1-1-0
 28 S-1-5-21-... S-1-5-21-2229937839-1383249143-3977914998-1010
 28 S-1-5-21-... S-1-5-21-2229937839-1383249143-3977914998-1003
 16 S-1-5-32-545
...
</code></pre>

If you need access to arbitrary users' group info then @tiagoinu suggestion of using the Quest AD cmdlets is a better way to go.

blocks|key|779176|text|Get-Member不用于获取用户的组成员身份。如果您想要获取用户在本地系统上所属的组的列表，可以通过以下方式实现：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779177|$query+=+"ASSOCIATORS+OF+{Win32_Account.Name='DemoUser1',Domain='DomainName'}+WHERE+ResultRole=GroupComponent+ResultClass=Win32_Account"

Get-WMIObject+-Query+$query+%7C+Select+Name|code-block|syntax|javascript|779178|在上面的查询中，将DemoUser1替换为所需的用户名，并将DomainName替换为您的本地计算机名或域名。|779179|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

Get-Member is not for getting user's group membership. If you want to get a list of groups a user belongs to on the local system, you can do so by:

<pre><code>$query = "ASSOCIATORS OF {Win32_Account.Name='DemoUser1',Domain='DomainName'} WHERE ResultRole=GroupComponent ResultClass=Win32_Account"

Get-WMIObject -Query $query | Select Name
</code></pre>

In the above query, replace DemoUser1 with the username you want and the DomainName with either your local computer name or domain name.

blocks|key|993591|text|(GET-ADUSER+–Identity+USERNAME+–Properties+MemberOf+%7C+Select-Object+MemberOf).MemberOf|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|993592|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>(GET-ADUSER –Identity USERNAME –Properties MemberOf | Select-Object MemberOf).MemberOf
</code></pre>

blocks|key|993646|text|首先，导入ActiveDirectory模块：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|993647|Import-Module+ActiveDirectory|code-block|syntax|javascript|993648|然后发出以下命令：|993649|Get-ADGroupMember+-Identity+$group+%7C+foreach-object+{
++++Write-Host+$_.SamAccountName
}|993650|这将显示指定组的成员。|993651|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|Q|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|R|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|S|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

First, import the ActiveDirectory module:
<pre><code>Import-Module ActiveDirectory
</code></pre>
Then issue this command:
<pre><code>Get-ADGroupMember -Identity $group | foreach-object {
 Write-Host $_.SamAccountName
}
</code></pre>
This will display the members of the specified group.

blocks|key|779303|text|Get-ADPrincipalGroupMembership将执行此操作。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779304|Get-ADPrincipalGroupMembership+username+%7C+select+name

name
----
Domain+Users
Domain+Computers
Workstation+Admins
Company+Users
Company+Developers
AutomatedProcessingTeam|code-block|syntax|javascript|779305|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Get-ADPrincipalGroupMembership will do this.

<pre><code>Get-ADPrincipalGroupMembership username | select name

name
----
Domain Users
Domain Computers
Workstation Admins
Company Users
Company Developers
AutomatedProcessingTeam
</code></pre>

blocks|key|779335|text|Import-Module+ActiveDirectory
Get-ADUser+-SearchBase+"OU=Users,DC=domain,DC=local"+-Filter+*+%7C+foreach-object+{
write-host+"User:"+$_.Name+-foreground+green
++++Get-ADPrincipalGroupMembership+$_.SamAccountName+%7C+foreach-object+{
++++++++write-host+"Member+Of:"+$_.name
++++}
}|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|779336|更改-SearchBase的值以反映您需要列出以下用户的OU+:)|unstyled|779337|这将列出该OU中的所有用户，并显示他们所属的组。|779338|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$B|C]]|$1|D|3|E|5|F|7|L|8|@]|9|@]|A|$]]|$1|G|3|H|5|F|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|F|7|N|8|@]|9|@]|A|$]]]|J|$]]

<pre><code>Import-Module ActiveDirectory
Get-ADUser -SearchBase "OU=Users,DC=domain,DC=local" -Filter * | foreach-object {
write-host "User:" $_.Name -foreground green
 Get-ADPrincipalGroupMembership $_.SamAccountName | foreach-object {
 write-host "Member Of:" $_.name
 }
}
</code></pre>

Change the value of -SearchBase to reflect the OU you need to list the users from :)

This will list all of the users in that OU and show you which groups they are a member of.

blocks|key|779403|text|我编写了一个名为Get-ADPrincipalGroupMembershipRecursive+PowerShell的PowerShell函数。它接受用户、计算机、组或服务帐户的DSN。它从帐户的memberOf属性中检索组的初始列表，然后递归地检查这些组的成员身份。下面是简短的代码。完整的source+code+with+comments+can+be+found+here。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|779404|function+Get-ADPrincipalGroupMembershipRecursive(+)+{

++++Param(
++++++++[string]+$dsn,
++++++++[array]$groups+=+@()
++++)

++++$obj+=+Get-ADObject+$dsn+-Properties+memberOf

++++foreach(+$groupDsn+in+$obj.memberOf+)+{

++++++++$tmpGrp+=+Get-ADObject+$groupDsn+-Properties+memberOf

++++++++if(+($groups+%7C+where+{+$_.DistinguishedName+-eq+$groupDsn+}).Count+-eq+0+)+{
++++++++++++$groups+%2B=++$tmpGrp+++++++++++
++++++++++++$groups+=+Get-ADPrincipalGroupMembershipRecursive+$groupDsn+$groups
++++++++}
++++}

++++return+$groups
}

#+Simple+Example+of+how+to+use+the+function
$username+=+Read-Host+-Prompt+"Enter+a+username"
$groups+++=+Get-ADPrincipalGroupMembershipRecursive+(Get-ADUser+$username).DistinguishedName
$groups+%7C+Sort-Object+-Property+name+%7C+Format-Table|code-block|syntax|javascript|779405|entityMap|0|LINK|mutability|MUTABLE|url|http://www.reich-consulting.net/2013/12/05/retrieving-recursive-group-memberships-powershell/^0|42|17|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@$A|R|B|S|1|T]]|C|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|C|$G|H]]|$1|I|3|-4|5|6|7|V|8|@]|9|@]|C|$]]]|J|$K|$5|L|M|N|C|$O|P]]]]

I wrote a PowerShell function called Get-ADPrincipalGroupMembershipRecursive. It accepts the DSN of a user, computer, group, or service account. It retrieves an initial list of groups from the account's memberOf attribute, then recursively checks those group's memberships. Abbreviated code is below. Full <a href="http://www.reich-consulting.net/2013/12/05/retrieving-recursive-group-memberships-powershell/" rel="nofollow">source code with comments can be found here</a>.

<pre><code>function Get-ADPrincipalGroupMembershipRecursive( ) {

 Param(
 [string] $dsn,
 [array]$groups = @()
 )

 $obj = Get-ADObject $dsn -Properties memberOf

 foreach( $groupDsn in $obj.memberOf ) {

 $tmpGrp = Get-ADObject $groupDsn -Properties memberOf

 if( ($groups | where { $_.DistinguishedName -eq $groupDsn }).Count -eq 0 ) {
 $groups += $tmpGrp 
 $groups = Get-ADPrincipalGroupMembershipRecursive $groupDsn $groups
 }
 }

 return $groups
}

# Simple Example of how to use the function
$username = Read-Host -Prompt "Enter a username"
$groups = Get-ADPrincipalGroupMembershipRecursive (Get-ADUser $username).DistinguishedName
$groups | Sort-Object -Property name | Format-Table
</code></pre>

blocks|key|779468|text|Get-QADUser+-SamAccountName+LoginID+%7C%25+{$_.MemberOf+}%7C+Get-QADGroup+%7C选择名称|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779469|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Get-QADUser -SamAccountName LoginID | % {$_.MemberOf } | Get-QADGroup | select name

blocks|key|779505|text|Get-ADPrincipalGroupMembership+USERLOGON+%7C选择名称|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779506|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Get-ADPrincipalGroupMembership USERLOGON | select name

blocks|key|993967|text|单行，不需要模块，使用当前登录的用户：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|993968|(New-Object+System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$($env:username)))")).FindOne().GetDirectoryEntry().memberOf|code-block|syntax|javascript|993969|致敬这篇vbs/powershell文章：http://technet.microsoft.com/en-us/library/ff730963.aspx|offset|length|993970|entityMap|0|LINK|mutability|MUTABLE|url|http://technet.microsoft.com/en-us/library/ff730963.aspx^0|0|0|L|1K|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|U|8|@]|9|@$I|V|J|W|1|X]]|A|$]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|L|$M|$5|N|O|P|A|$Q|R]]]]

Single line, no modules necessary, uses current logged user:
<pre><code>(New-Object System.DirectoryServices.DirectorySearcher(&quot;(&amp;(objectCategory=User)(samAccountName=$($env:username)))&quot;)).FindOne().GetDirectoryEntry().memberOf
</code></pre>
Kudos to this vbs/powershell article: <a href="http://technet.microsoft.com/en-us/library/ff730963.aspx" rel="noreferrer">http://technet.microsoft.com/en-us/library/ff730963.aspx</a>

blocks|key|994052|text|一种比Canoas发布的更简洁的替代方法，用于获取当前登录用户的组成员资格。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|994053|我在这篇博文中遇到了这种方法：http://www.travisrunyard.com/2013/03/26/auto-create-outlook-mapi-user-profiles/|offset|length|994054|([ADSISEARCHER]"samaccountname=$($env:USERNAME)").Findone().Properties.memberof|code-block|syntax|javascript|994055|还有一个更好的版本，它使用正则表达式去掉LDAP垃圾，只留下组名称：|994056|([ADSISEARCHER]"samaccountname=$($env:USERNAME)").Findone().Properties.memberof+-replace+'%5ECN=([%5E,]%2B).%2B$','$1'|994057|有关使用ADSISEARCHER类型加速器的更多详细信息，请参阅scripting+guy博客：http://blogs.technet.com/b/heyscriptingguy/archive/2010/08/24/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory.aspx|994058|entityMap|0|LINK|mutability|MUTABLE|url|http://www.travisrunyard.com/2013/03/26/auto-create-outlook-mapi-user-profiles/|1|http://blogs.technet.com/b/heyscriptingguy/archive/2010/08/24/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory.aspx^0|0|F|27|0|0|0|0|0|1C|3Y|1|0^^$0|@$1|2|3|4|5|6|7|10|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|11|8|@]|9|@$D|12|E|13|1|14]]|A|$]]|$1|F|3|G|5|H|7|15|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|16|8|@]|9|@]|A|$]]|$1|M|3|N|5|H|7|17|8|@]|9|@]|A|$I|J]]|$1|O|3|P|5|6|7|18|8|@]|9|@$D|19|E|1A|1|1B]]|A|$]]|$1|Q|3|-4|5|6|7|1C|8|@]|9|@]|A|$]]]|R|$S|$5|T|U|V|A|$W|X]]|Y|$5|T|U|V|A|$W|Z]]]]

A more concise alternative to the one posted by Canoas, to get group membership for the currently-logged-on user.

I came across this method in this blog post: <a href="http://www.travisrunyard.com/2013/03/26/auto-create-outlook-mapi-user-profiles/">http://www.travisrunyard.com/2013/03/26/auto-create-outlook-mapi-user-profiles/</a>

<pre><code>([ADSISEARCHER]"samaccountname=$($env:USERNAME)").Findone().Properties.memberof
</code></pre>

An even better version which uses a regex to strip the LDAP guff and leaves the group names only:

<pre><code>([ADSISEARCHER]"samaccountname=$($env:USERNAME)").Findone().Properties.memberof -replace '^CN=([^,]+).+$','$1'
</code></pre>

More details about using the [ADSISEARCHER] type accelerator can be found on the scripting guy blog: <a href="http://blogs.technet.com/b/heyscriptingguy/archive/2010/08/24/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory.aspx">http://blogs.technet.com/b/heyscriptingguy/archive/2010/08/24/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory.aspx</a>

blocks|key|779707|text|+++Get-ADUser+-Filter+{+memberOf+-RecursiveMatch+"CN=Administrators,CN=Builtin,DC=Fabrikam,DC=com"+}+-SearchBase+"CN=Administrator,CN=Users,DC=Fabrikam,DC=com"++-SearchScope+Base
++++++++++++++++++##+NOTE:+The+above+command+will+return+the+user+object+(Administrator+in+this+case)+if+it+finds+a+match+recursively+in+memberOf+attribute.+|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|779708|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code> Get-ADUser -Filter { memberOf -RecursiveMatch "CN=Administrators,CN=Builtin,DC=Fabrikam,DC=com" } -SearchBase "CN=Administrator,CN=Users,DC=Fabrikam,DC=com" -SearchScope Base
 ## NOTE: The above command will return the user object (Administrator in this case) if it finds a match recursively in memberOf attribute. 
</code></pre>

blocks|key|779740|text|这是获取名称的最简单方法：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779741|Get-ADPrincipalGroupMembership+"YourUserName"|offset|length|style|CODE|779742|#+Returns+distinguishedName+:+CN=users,OU=test,DC=SomeWhere+GroupCategory+++++:+Security+GroupScope++++++++:+Global+name++++++++++++++:+testGroup+objectClass+++++++:+group+objectGUID++++++++:+2130ed49-24c4-4a17-88e6-dd4477d15a4c+SamAccountName++++:+testGroup+SID+++++++++++++++:+S-1-5-21-2114067515-1964795913-1973001494-71628|779743|添加select语句以修剪响应或获取OU中的每个用户所属的每个组：|779744|foreach+($user+in+(get-aduser+-SearchScope+Subtree+-SearchBase+$oupath+-filter+*+-Properties+samaccountName,+MemberOf+%7C+select+samaccountName)){+Get-ADPrincipalGroupMembership+$user.samaccountName+%7C+select+name}|779745|entityMap^0|0|0|19|0|0|92|0|0|0|5V|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@$D|R|E|S|F|G]]|9|@]|A|$]]|$1|H|3|I|5|6|7|T|8|@$D|U|E|V|F|G]]|9|@]|A|$]]|$1|J|3|K|5|6|7|W|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|X|8|@$D|Y|E|Z|F|G]]|9|@]|A|$]]|$1|N|3|-4|5|6|7|10|8|@]|9|@]|A|$]]]|O|$]]

This is the simplest way to just get the names:

<code>Get-ADPrincipalGroupMembership "YourUserName"</code>

<code># Returns
distinguishedName : CN=users,OU=test,DC=SomeWhere
GroupCategory : Security
GroupScope : Global
name : testGroup
objectClass : group
objectGUID : 2130ed49-24c4-4a17-88e6-dd4477d15a4c
SamAccountName : testGroup
SID : S-1-5-21-2114067515-1964795913-1973001494-71628</code>

Add a select statement to trim the response or to get every user in an OU every group they are a user of:

<code>foreach ($user in (get-aduser -SearchScope Subtree -SearchBase $oupath -filter * -Properties samaccountName, MemberOf | select samaccountName)){
Get-ADPrincipalGroupMembership $user.samaccountName | select name}</code>

blocks|key|779779|text|来自CMD的老式方法：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779780|net+user+mst999+/domain+|code-block|syntax|javascript|779781|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Old school way from CMD: 

<pre><code>net user mst999 /domain 
</code></pre>

blocks|key|779822|text|下面的代码运行良好：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779823|get-aduser+$username+-Properties+memberof+%7C+select+-expand+memberof|code-block|syntax|javascript|779824|如果您有一个用户列表：|779825|$list+=+'administrator','testuser1','testuser2'
$list+%7C+`
++++%25{++
++++++++$user+=+$_;+
++++++++get-aduser+$user+-Properties+memberof+%7C+`
++++++++select+-expand+memberof+%7C+`
++++++++%25{new-object+PSObject+-property+@{User=$user;Group=$_;}}+`
++++}|779826|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

The below works well:

<pre><code>get-aduser $username -Properties memberof | select -expand memberof
</code></pre>

If you have a list of users:

<pre><code>$list = 'administrator','testuser1','testuser2'
$list | `
 %{ 
 $user = $_; 
 get-aduser $user -Properties memberof | `
 select -expand memberof | `
 %{new-object PSObject -property @{User=$user;Group=$_;}} `
 }
</code></pre>

blocks|key|779865|text|它只有一行：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779866|(get-aduser+joe.bloggs+-properties+*).memberof|code-block|syntax|javascript|779867|结束:)|779868|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

It is just one line:

<pre><code>(get-aduser joe.bloggs -properties *).memberof
</code></pre>

end of :)

blocks|key|994264|text|使用：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|994265|Get-ADPrincipalGroupMembership+username+%7C+select+name+%7C+export-CSV+username.csv|code-block|syntax|javascript|994266|这会将命令的输出通过管道传输到CSV文件中。|offset|length|994267|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Comma-separated_values^0|0|0|F|3|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|U|8|@]|9|@$I|V|J|W|1|X]]|A|$]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|L|$M|$5|N|O|P|A|$Q|R]]]]

Use:

<pre><code>Get-ADPrincipalGroupMembership username | select name | export-CSV username.csv
</code></pre>

This pipes output of the command into a <a href="http://en.wikipedia.org/wiki/Comma-separated_values" rel="nofollow">CSV</a> file.

blocks|key|779941|text|要使其具有递归性，可以使用：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|779942|<#+
++++.SYNOPSIS+++
++++++++Get+all+the+groups+that+a+user+is+MemberOf.

++++.DESCRIPTION
++++++++This+script+retrieves+all+the+groups+that+a+user+is+MemberOf+in+a+recursive+way.

++++.PARAMETER+SamAccountName
++++++++The+name+of+the+user+you+want+to+check+#>

Param+(
++++[String]$SamAccountName+=+'test',
++++$DomainUsersGroup+=+'CN=Domain+Users,CN=Users,DC=domain,DC=net'
)


Function+Get-ADMemberOf+{
++++Param+(
++++++++[Parameter(ValueFromPipeline)]
++++++++[PSObject[]]$Group,
++++++++[String]$DomainUsersGroup+=+'CN=Domain+Users,CN=Users,DC=grouphc,DC=net'
++++)
++++Process+{
++++++++foreach+($G+in+$Group)+{
++++++++++++$G+%7C+Get-ADGroup+%7C+Select+-ExpandProperty+Name
++++++++++++Get-ADGroup+$G+-Properties+MemberOf%7C+Select-Object+Memberof+%7C+ForEach-Object+{
++++++++++++++++Get-ADMemberOf+$_.Memberof
++++++++++++}
++++++++}
++++}
}


$Groups+=+Get-ADUser+$SamAccountName+-Properties+MemberOf+%7C+Select-Object+-ExpandProperty+MemberOf
$Groups+%2B=+$DomainUsersGroup
$Groups+%7C+Get-ADMemberOf+%7C+Select+-Unique+%7C+Sort-Object|code-block|syntax|javascript|779943|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

To get it recursive, you can use:

<pre><code>&lt;# 
 .SYNOPSIS 
 Get all the groups that a user is MemberOf.

 .DESCRIPTION
 This script retrieves all the groups that a user is MemberOf in a recursive way.

 .PARAMETER SamAccountName
 The name of the user you want to check #&gt;

Param (
 [String]$SamAccountName = 'test',
 $DomainUsersGroup = 'CN=Domain Users,CN=Users,DC=domain,DC=net'
)


Function Get-ADMemberOf {
 Param (
 [Parameter(ValueFromPipeline)]
 [PSObject[]]$Group,
 [String]$DomainUsersGroup = 'CN=Domain Users,CN=Users,DC=grouphc,DC=net'
 )
 Process {
 foreach ($G in $Group) {
 $G | Get-ADGroup | Select -ExpandProperty Name
 Get-ADGroup $G -Properties MemberOf| Select-Object Memberof | ForEach-Object {
 Get-ADMemberOf $_.Memberof
 }
 }
 }
}


$Groups = Get-ADUser $SamAccountName -Properties MemberOf | Select-Object -ExpandProperty MemberOf
$Groups += $DomainUsersGroup
$Groups | Get-ADMemberOf | Select -Unique | Sort-Object
</code></pre>

blocks|key|994384|text|上面几乎所有的解决方案都使用了ActiveDirecotry模块，在大多数情况下，该模块在默认情况下可能不可用。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|994385|我使用了下面的方法。有点间接，但达到了我的目的。|994386|列出所有可用组|994387|Get-WmiObject+-Class+Win32_Group|994388|然后列出用户所属的组|994389|[System.Security.Principal.WindowsIdentity]::GetCurrent().Groups|994390|然后，可以通过SIDs进行检查来完成比较。这适用于已登录的用户。如果我错了，请纠正我。这对PowerShell来说是全新的，但为了完成工作，我不得不完成这项工作。|994391|entityMap^0|F|F|0|0|0|0|W|0|0|0|1S|0|7|4|0^^$0|@$1|2|3|4|5|6|7|T|8|@$9|U|A|V|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|W|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|X|8|@]|D|@]|E|$]]|$1|J|3|K|5|6|7|Y|8|@$9|Z|A|10|B|C]]|D|@]|E|$]]|$1|L|3|M|5|6|7|11|8|@]|D|@]|E|$]]|$1|N|3|O|5|6|7|12|8|@$9|13|A|14|B|C]]|D|@]|E|$]]|$1|P|3|Q|5|6|7|15|8|@$9|16|A|17|B|C]]|D|@]|E|$]]|$1|R|3|-4|5|6|7|18|8|@]|D|@]|E|$]]]|S|$]]

Almost all above solutions used the <code>ActiveDirecotry</code> module which might not be available by default in most cases. 

I used below method. A bit indirect, but served my purpose. 

List all available groups

<code>Get-WmiObject -Class Win32_Group</code>

And then list the groups the user belongs to 

<code>[System.Security.Principal.WindowsIdentity]::GetCurrent().Groups</code>

Comparison can then be done via checking through the <code>SIDs</code>. This works for the logged in user. Please correct me if I am wrong. Completely new to PowerShell, but had to get this done for a work commitment.

blocks|key|780048|text|使用用户输入和奇特的输出格式：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|780049|[CmdletBinding(SupportsShouldProcess=$True)]+
Param(+
++++[Parameter(Mandatory+=+$True)]+
++++[String]$UserName+
)+
Import-Module+ActiveDirectory+
If+($UserName)+{+
++++$UserName+=+$UserName.ToUpper().Trim()+
++++$Res+=+(Get-ADPrincipalGroupMembership+$UserName+%7C+Measure-Object).Count+
++++If+($Res+-GT+0)+{+
++++++++Write-Output+"`n"+
++++++++Write-Output+"$UserName+AD+Group+Membership:"+
++++++++Write-Output+"==========================================================="+
++++++++Get-ADPrincipalGroupMembership+$UserName+%7C+Select-Object+-Property+Name,+GroupScope,+GroupCategory+%7C+Sort-Object+-Property+Name+%7C+FT+-A+
++++}+
}|code-block|syntax|javascript|780050|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

With user input and fancy output formatting:

<pre><code>[CmdletBinding(SupportsShouldProcess=$True)] 
Param( 
 [Parameter(Mandatory = $True)] 
 [String]$UserName 
) 
Import-Module ActiveDirectory 
If ($UserName) { 
 $UserName = $UserName.ToUpper().Trim() 
 $Res = (Get-ADPrincipalGroupMembership $UserName | Measure-Object).Count 
 If ($Res -GT 0) { 
 Write-Output "`n" 
 Write-Output "$UserName AD Group Membership:" 
 Write-Output "===========================================================" 
 Get-ADPrincipalGroupMembership $UserName | Select-Object -Property Name, GroupScope, GroupCategory | Sort-Object -Property Name | FT -A 
 } 
}
</code></pre>

blocks|key|994449|text|如果您没有咨询其他成员组的权限，但有咨询组成员的权限，则可以执行以下操作来构建哪些用户有权访问哪些组的映射。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|994450|$groups+=+get-adgroup+-Filter+*+%7C+sort+name+%7C+select+Name
$users+=+@{}
foreach($group+in+$groups)+{
++++$groupUsers+=+@()
++++$groupUsers+=+Get-ADGroupMember+-Identity+$group.Name+%7C+Select-Object+SamAccountName
++++$groupUsers+%7C+%25+{
++++++++if(!$users.ContainsKey($_.SamAccountName)){
++++++++++++$users[$_.SamAccountName]+=+@()
++++++++}
++++++++($users[$_.SamAccountName])+%2B=+($group.Name)
++++}
}|code-block|syntax|javascript|994451|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

When you do not have privileges to consult other member groups but you do have the privilege to consult group members, you can do the following to build a map of which user has access to which groups.

<pre><code>$groups = get-adgroup -Filter * | sort name | select Name
$users = @{}
foreach($group in $groups) {
 $groupUsers = @()
 $groupUsers = Get-ADGroupMember -Identity $group.Name | Select-Object SamAccountName
 $groupUsers | % {
 if(!$users.ContainsKey($_.SamAccountName)){
 $users[$_.SamAccountName] = @()
 }
 ($users[$_.SamAccountName]) += ($group.Name)
 }
}
</code></pre>

blocks|key|994479|text|把这个放在这里以备将来参考。我正在进行电子邮件迁移。我需要知道每个用户帐户及其各自的组成员身份，还需要知道每个组及其各自的成员。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|994480|我使用下面的代码块为每个用户的组成员身份输出CSV。|994481|Get-ADUser+-Filter+*+%7C`
++ForEach-Object+{+`
++++$FileName+=+$_.SamAccountName+%2B+".csv"+;+`
++++$FileName+;+`
++++Get-ADPrincipalGroupMembership+$_+%7C+`
++++++Select-Object+-Property+SamAccountName,+name,+GroupScope,+GroupCategory+%7C+`
++++++++Sort-Object+-Property+SamAccountName+%7C+`
++++++++++Export-Csv+-Path+$FileName+-Encoding+ASCII+;+`
++}|code-block|syntax|javascript|994482|组及其各自成员的导出过程有点复杂，但下面的工作是可行的。输出文件名包括组的类型。因此，我需要的电子邮件通讯组是/应该是通用通讯组和全局通讯组。我应该能够删除或移动不需要的TXT文件。|994483|Get-ADGroup+-Filter+*+%7C+`
+Select-Object+-Property+Name,+DistinguishedName,+GroupScope,+GroupCategory+%7C+`
++Sort-Object+-Property+GroupScope,+GroupCategory,+Name+%7C+`
+++Export-Csv+-Path+ADGroupsNew.csv+-Encoding+ASCII

$MyCSV+=+Import-Csv+-Path+.\ADGroupsNew.csv+-Encoding+ASCII

$MyCSV+%7C+`
+ForEach-Object+{+`
++$FN+=+$_.GroupScope+%2B+",+"+%2B+$_.GroupCategory+%2B+",+"+%2B+$_.Name+%2B+".txt"+;+`
++$FN+;+`
++Get-ADGroupMember+-Identity+$_.DistinguishedName+%7C+`
+++Out-File+-FilePath+$FN+-Encoding+ASCII+;+$FN="";+`
++}|994484|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|Q|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|R|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|S|8|@]|9|@]|A|$G|H]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

Putting this here for future reference. I'm in the midst of an email migration. I need to know each user account and its respective group membership, and also I need to know each group and its respective members.

I'm using the code block below to output a CSV for each user's group membership.

<pre><code>Get-ADUser -Filter * |`
 ForEach-Object { `
 $FileName = $_.SamAccountName + ".csv" ; `
 $FileName ; `
 Get-ADPrincipalGroupMembership $_ | `
 Select-Object -Property SamAccountName, name, GroupScope, GroupCategory | `
 Sort-Object -Property SamAccountName | `
 Export-Csv -Path $FileName -Encoding ASCII ; `
 }
</code></pre>

The export process for the groups and their respective members was a little convoluted, but the below works. The output filenames include the type of group. Therefore, the email distribution groups I need are/should be the Universal and Global Distribution groups. I should be able to just delete or move the resulting TXT files I don't need.

<pre><code>Get-ADGroup -Filter * | `
 Select-Object -Property Name, DistinguishedName, GroupScope, GroupCategory | `
 Sort-Object -Property GroupScope, GroupCategory, Name | `
 Export-Csv -Path ADGroupsNew.csv -Encoding ASCII

$MyCSV = Import-Csv -Path .\ADGroupsNew.csv -Encoding ASCII

$MyCSV | `
 ForEach-Object { `
 $FN = $_.GroupScope + ", " + $_.GroupCategory + ", " + $_.Name + ".txt" ; `
 $FN ; `
 Get-ADGroupMember -Identity $_.DistinguishedName | `
 Out-File -FilePath $FN -Encoding ASCII ; $FN=""; `
 }
</code></pre>

blocks|key|994536|text|如果您不能让Get-ADPrincipalGroupMembership为您工作，您可以尝试以该用户身份登录，然后使用。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|994537|$id+=+[Security.Principal.WindowsIdentity]::GetCurrent()
$groups+=+$id.Groups+%7C+foreach-object+{$_.Translate([Security.Principal.NTAccount])}
$groups+%7C+select+*|code-block|syntax|javascript|994538|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

If you cannot get Get-ADPrincipalGroupMembership to work for you could try logging in as that user then use.

<pre><code>$id = [Security.Principal.WindowsIdentity]::GetCurrent()
$groups = $id.Groups | foreach-object {$_.Translate([Security.Principal.NTAccount])}
$groups | select *
</code></pre>

blocks|key|780236|text|研究所有提出的评论给了我一个起点(感谢)，但也给我留下了几个未解决的问题。因此，这就是我的答案。所提供的代码片段比所要求的要多一点，但它提供了有用的调试信息。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|780237|[array]+$script:groupsdns+=+@()
function+Get-ADPrincipalGroupMembershipRecursive()+
{
++Param(+[string]+$dn,+[int]+$level+=+0,+[array]+$groups+=+@()+)

++#if(($groupsdns+%7C+where+{+$_.DistinguishedName+-eq+$dn+}).Count+-ne+0+)+{+return+$groups+}+#+dependency+on+next+statement
++#$groupsdns+%2B=+(Get-ADObject+$dn+-Properties+MemberOf)+#+Get-ADObject+cannot+find+an+object+with+identity
++if+($script:groupsdns.Contains($dn))+{+return+$groups+}
++$script:groupsdns+%2B=+$dn
++$mo+=+$Null
++$mo+=+Get-ADObject+$dn+-Properties+MemberOf+#+Get-ADObject+cannot+find+an+object+with+identity
++$group+=+($dn+%2B+"+("+%2B+$level.ToString())
++if+($mo+-eq+$Null)+{+$group+%2B=+"!"+}
++$group+%2B=+")"
++$groups+%2B=+$group
++foreach(+$groupdn+in+$mo.MemberOf+)
++{
++++$groups+=+Get-ADPrincipalGroupMembershipRecursive+-dn+$groupdn+-level+($level%2B1)+-groups+$groups
++}
++if+($level+-le+0)+
++{+
++++$primarygroupdn+=+(Get-ADUser+-Identity+$dn+-Properties+PrimaryGroup).PrimaryGroup+
++++$groups+=+Get-ADPrincipalGroupMembershipRecursive+-dn+$primarygroupdn+-level+($level%2B1)+-groups+$groups
++}
++return+$groups
}
$adusergroups+=+Get-ADPrincipalGroupMembershipRecursive+-dn+$aduser.DistinguishedName
$adusergroups+%7C+ft+-AutoSize+%7C+`
++++++++++++++Out-File+-Width+512+Get-ADPrincipalGroupMembershipRecursive.txt+#-Append+#-Wrap+#+%7C+Sort-Object+-Property+Name|code-block|syntax|javascript|780238|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Studying all comments presented gave me a starting point (thanks for such) but left me with several unresolved issues. As result here is my answer. The code snippet provided does a little more than what is asked for but it provides helpful debugging info.

<pre><code>[array] $script:groupsdns = @()
function Get-ADPrincipalGroupMembershipRecursive() 
{
 Param( [string] $dn, [int] $level = 0, [array] $groups = @() )

 #if(($groupsdns | where { $_.DistinguishedName -eq $dn }).Count -ne 0 ) { return $groups } # dependency on next statement
 #$groupsdns += (Get-ADObject $dn -Properties MemberOf) # Get-ADObject cannot find an object with identity
 if ($script:groupsdns.Contains($dn)) { return $groups }
 $script:groupsdns += $dn
 $mo = $Null
 $mo = Get-ADObject $dn -Properties MemberOf # Get-ADObject cannot find an object with identity
 $group = ($dn + " (" + $level.ToString())
 if ($mo -eq $Null) { $group += "!" }
 $group += ")"
 $groups += $group
 foreach( $groupdn in $mo.MemberOf )
 {
 $groups = Get-ADPrincipalGroupMembershipRecursive -dn $groupdn -level ($level+1) -groups $groups
 }
 if ($level -le 0) 
 { 
 $primarygroupdn = (Get-ADUser -Identity $dn -Properties PrimaryGroup).PrimaryGroup 
 $groups = Get-ADPrincipalGroupMembershipRecursive -dn $primarygroupdn -level ($level+1) -groups $groups
 }
 return $groups
}
$adusergroups = Get-ADPrincipalGroupMembershipRecursive -dn $aduser.DistinguishedName
$adusergroups | ft -AutoSize | `
 Out-File -Width 512 Get-ADPrincipalGroupMembershipRecursive.txt #-Append #-Wrap # | Sort-Object -Property Name
</code></pre>

blocks|key|994635|text|这将为您提供当前用户的详细信息。不需要Powershell。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|994636|whoami+/groups|offset|length|style|CODE|994637|entityMap^0|0|0|E|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@$D|L|E|M|F|G]]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

This should provide you the details for current user. Powershell not needed.

<code>whoami /groups</code>

blocks|key|780327|text|我使用这个简单的一行程序递归地搜索用户所属的所有组：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|780328|Get-ADPrincipalGroupMembership+$UserName+%7C+foreach-object+{+Get-ADPrincipalGroupMembership+$_.SamAccountName+%7C+select+SamAccountName+}|code-block|syntax|javascript|780329|要筛选组以确定用户是否为特定组的成员，我使用以下命令：|780330|if+(+Get-ADPrincipalGroupMembership+$UserName+%7C+foreach-object+{+Get-ADPrincipalGroupMembership+$_.SamAccountName+%7C+select+SamAccountName+}+%7C+where-object+{$_.SamAccountName+-like+"*$Groupname*"}+)+{+write-host+"Found"+}+else+{+write-host+"not+a+member+of+group+$Groupname"+}|780331|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

I use this simple oneliner to recursively search all the groups a user is member of:
<pre><code>Get-ADPrincipalGroupMembership $UserName | foreach-object { Get-ADPrincipalGroupMembership $_.SamAccountName | select SamAccountName }
</code></pre>
To filter the groups to find out if user is member of a specific group i use this:
<pre><code>if ( Get-ADPrincipalGroupMembership $UserName | foreach-object { Get-ADPrincipalGroupMembership $_.SamAccountName | select SamAccountName } | where-object {$_.SamAccountName -like &quot;*$Groupname*&quot;} ) { write-host &quot;Found&quot; } else { write-host &quot;not a member of group $Groupname&quot; }
</code></pre>

blocks|key|780423|text|对于本地用户和组(即不在Active+Directory中)，如果你不想，或者不被允许，或者不能安装RSAT和/或Install-WindowsFeature+RSAT-AD-PowerShell和/或import-module+activedirectory，那么这里有一个纯粹的，预先安装的powershell+(5.1%2B)方法。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|780424|(注意:下面使用的Get-LocalGroup*仅适用于Powershell+v5.1及更高版本。"...v5.1与Windows10周年纪念更新一起于2016年8月2日发布，并在Windows+Server+2016中发布。Windows+7、Windows+Server+2008、Windows+Server+2008+R2、Windows+Server+2012和Windows+Server+2012+R2于2017年1月19日发布。“(wikipedia)|780425|$username+=+"user002"
Get-LocalGroup+%7C+ForEach-Object+{
++++#+the+usernames+are+returned+in+the+string+form+"computername\username"
++++if+(Get-LocalGroupMember+-Group+$_+%7C+Where-Object+name+-like+"*\$username")+{
++++++++$_.name
++++}+
}|code-block|syntax|javascript|780426|输出示例：|780427|Administrators
Users|780428|entityMap|0|LINK|mutability|MUTABLE|url|https://en.wikipedia.org/wiki/PowerShell^0|1L|15|2T|T|0|9|F|68|9|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@$9|Z|A|10|B|C]|$9|11|A|12|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|13|8|@$9|14|A|15|B|C]]|D|@$9|16|A|17|1|18]]|E|$]]|$1|H|3|I|5|J|7|19|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|1A|8|@]|D|@]|E|$]]|$1|O|3|P|5|J|7|1B|8|@]|D|@]|E|$K|L]]|$1|Q|3|-4|5|6|7|1C|8|@]|D|@]|E|$]]]|R|$S|$5|T|U|V|E|$W|X]]]]

For LOCAL users and groups (ie not in Active Directory), and if you don't want to, or aren't allowed to, or can't install RSAT and/or <code>Install-WindowsFeature RSAT-AD-PowerShell</code> and/or <code>import-module activedirectory</code> then here's a pure, pre-installed powershell (5.1+) way to do it.
(Note: <code>Get-LocalGroup*</code> used below are only available Powershell v5.1 and above. &quot;...v5.1 was released along with the Windows 10 Anniversary Update on August 2, 2016, and in Windows Server 2016. ...[F]or Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 [it] was released on January 19, 2017.&quot; (<a href="https://en.wikipedia.org/wiki/PowerShell" rel="nofollow noreferrer">wikipedia</a>))
<pre><code>$username = &quot;user002&quot;
Get-LocalGroup | ForEach-Object {
 # the usernames are returned in the string form &quot;computername\username&quot;
 if (Get-LocalGroupMember -Group $_ | Where-Object name -like &quot;*\$username&quot;) {
 $_.name
 } 
}
</code></pre>
Example output:
<pre><code>Administrators
Users
</code></pre>

blocks|key|994836|text|(Get-ADUser+$env:username+-Properties+MemberOf).MemberOf+%7C+%25+{$_.split(",")[0].replace("CN=","")}

Domain+Users
Domain+Computers
Workstation+Admins
Company+Users
Company+Developers
AutomatedProcessingTeam|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|994837|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>(Get-ADUser $env:username -Properties MemberOf).MemberOf | % {$_.split(&quot;,&quot;)[0].replace(&quot;CN=&quot;,&quot;&quot;)}

Domain Users
Domain Computers
Workstation Admins
Company Users
Company Developers
AutomatedProcessingTeam
</code></pre>

PowerShell's <a href="https://technet.microsoft.com/en-us/library/ee617193.aspx"><code>Get-ADGroupMember</code></a> cmdlet returns members of a specific group. Is there a cmdlet or property to get all the groups that a particular user is a member of? 

<hr/>

I fixed my mistake: <a href="http://technet.microsoft.com/en-us/library/hh849928.aspx"><code>Get-Member</code></a> should be <code>Get-ADGroupMember</code>.

How to get all groups that a user is a member of?

Windows Server

Windows

PowerShell的 cmdlet返回特定组的成员。是否有cmdlet或属性可以获取特定用户所属的所有组？我修正了我的错误：应该是Get-ADGroupMember。

问如何获取用户所属的所有群组？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何获取用户所属的所有群组？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何获取用户所属的所有群组？
EN