-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathget-nestedgroups.ps1
144 lines (113 loc) · 5.81 KB
/
get-nestedgroups.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
#Credit To Compwiz32, have a few ideas that I'd like to add to modify output
<# Example of proposed output
group1
\__group2
\__group3
\____group4
\__group5
#>
###############BEGIN FUNCTION##############
function Get-NestedGroup {
<#
.SYNOPSIS
Gets a list of nested groups inside an Active Directory group
.DESCRIPTION
Gets a list of nested groups inside an Active Directory group using LDAPFilter. Checks for
two levels of nested groups from the parent group.
.PARAMETER Group
The name of an Active Directory group
.PARAMETER Server
The name of Domain controller to use for query. Valid entries are a server name or servername:3268 for a
Global Catalog query.
.EXAMPLE
PS C:\> get-nestedgroup "Server Admins"
ParentGroup : Server Admins
NestedGroup : NYC Server Admins
NestedGroupMemberCount : 8
ObjectClass : group
ObjectPath : contoso.com/Groups/NYC Server Admins
DistinguishedName : CN=NYC Server Admins,OU=Groups,DC=contoso,DC=com
Returns the nested groups that are inside the group named "Server Admins".
NOTE: NestedGroupMemberCount is the number of objects (aka members) inside the nested group.
In this example, "NYC Server Admins" contains 8 objects. This number IS NOT the number of nested groups
inside NYC Server Admins.
.EXAMPLE
PS C:\> $selectprops = "ParentGroup","NestedGroup","NestedGroupMemberCount"
PS C:\> Get-NestedGroup "Exchange Recipient Administrators" | Select-Object $selectprops | format-table
ParentGroup NestedGroup NestedGroupMemberCount
----------- ----------- ----------------------
Exchange Recipient Administrators Exchange Organization Administrators 5
Exchange Recipient Administrators Global Service Desk 117
Exchange Recipient Administrators Mail Admins 1
Returns the nested groups in a table format. Uses a variable to specify the parameters for Select-Object
.EXAMPLE
PS C:\> Get-NestGroup $NYCGrps | Format-Table
There are no nested groups inside NYC-Desktops
There are no nested groups inside NYC-Servers
There are no nested groups inside NYC-Laptops
There are no nested groups inside NYC-Admins
There are no nested groups inside NYC-HelpDesk
Checks the six groups saved in the variable $NYCGrps for nested groups. In this example, none of
six groups have any nested groups.
.INPUTS
Inputs (if any)
.OUTPUTS
Output (if any)
.NOTES
AUTHOR: Mike Kanakos
VERSION: 1.0.4
DateCreated: 2020-04-15
DateUpdated: 2019-07-28
#>
[CmdletBinding()]
param (
[Parameter(ValueFromPipelineByPropertyName, Mandatory = $True)]
[String[]]$Group,
[Parameter()]
[String]$Server = (Get-ADReplicationsite | Get-ADDomainController -SiteName $_.name -Discover -ErrorAction SilentlyContinue).name
)
begin { }
process {
foreach ($item in $Group) {
$ADGrp = Get-ADGroup -Identity $item -Server $Server
$QueryResult = Get-ADGroup -LDAPFilter "(&(objectCategory=group)(memberof=$($ADGrp.DistinguishedName)))" -Properties canonicalname -Server $Server
if ( $null -ne $QueryResult) {
foreach ($grp in $QueryResult) {
$GrpLookup = Get-ADGroup -Identity "$($Grp.DistinguishedName)" -Properties Members, CanonicalName -Server $Server
$NestedGroupInfo = [PSCustomObject]@{
'ParentGroup' = $item
'NestedGroup' = $Grp.Name
'NestedGroupMemberCount' = $GrpLookup.Members.count
'ObjectClass' = $Grp.ObjectClass
'ObjectPath' = $GrpLookup.CanonicalName
'DistinguishedName' = $GrpLookup.DistinguishedName
} #end PSCustomObject
$NestedGroupInfo
} #end of foreach inside if statement
}
else {
Write-Information "There are no nested groups inside $item" -InformationAction Continue
} #end if/else
# checking for groups of nested groups
foreach ($NestedGrp in $QueryResult) {
$NestedADGrp = Get-ADGroup -Identity $NestedGrp -Server $Server
$NestedQueryResult = Get-ADGroup -LDAPFilter "(&(objectCategory=group)(memberof=$($NestedADGrp.DistinguishedName)))" -Properties canonicalname -Server $Server
If ($null -ne $NestedQueryResult) {
foreach ($SubGrp in $NestedQueryResult) {
$SubGrpLookup = Get-ADGroup -Identity "$($SubGrp.DistinguishedName)" -Properties Members, CanonicalName -Server $Server
}
$SubNestedGroupInfo = [PSCustomObject]@{
'ParentGroup' = $NestedADGrp.Name
'NestedGroup' = $SubGrp.Name
'NestedGroupMemberCount' = $SubGrpLookup.Members.count
'ObjectClass' = $SubGrp.ObjectClass
'ObjectPath' = $SubGrpLookup.CanonicalName
'DistinguishedName' = $SubGrpLookup.DistinguishedName
} #end PSCustomObject
$SubNestedGroupInfo
}
}
} #end parent foreach
} #end process block
end {}
}#end function