active directory - Simplify powershell query -

i learning powershell, , looking query couple of ad groups , determine whether user member of ad group.

• part 1 : query ad group has 10 nested ad groups
• part 2: query user's ad group , pull list
• part 3: not posted, compare output of part 1 , part 2

searched online , found tits , bits. aware of active directory module, avoid using it, since script executed user non-technical , avoid installing rsat that.

i have powershell version 2 , windows 7

part 1

group1 ad group has 10 nested ad groups.

write-host "fetching information groups.please wait.." add-type -assemblyname system.directoryservices.accountmanagement $ct = [system.directoryservices.accountmanagement.contexttype]::domain $group=[system.directoryservices.accountmanagement.groupprincipal]::findbyidentity  ($ct,'group1') $group1 = $group.getmembers | {$_.structuralobjectclass -eq "group"} | select    samaccountname $group1 = $group1 -replace("=", " ") -replace("{", " ") -replace("@", " ") -replace ("}", " ") -replace("samaccountname", " ")  -replace '\s+', ' ' $adgroups = foreach ($l in group1) {$l.trim()} 

to ensure ad group information fetched program or exit script

if (($adgroups | out-string) -like $null) {   write-host "unable fetch ad groups information" -foreground "red"   start-sleep 10   break  } 

part 2

temp location files can written

$location = "c:\ad" $ct = [system.directoryservices.accountmanagement.contexttype]::domain $user = [system.directoryservices.accountmanagement.userprincipal]::findbyidentity($ct, $username) if ($user -like $null) {   write-host "user not exist in ad" -foreground "magenta"   start-sleep 10   break } write-host "please wait...looking user group membership..." $usergroups = $user.getgroups() 

removing file if exists.

remove-item $location\useradgroups.txt $usergroups | select samaccountname | out-file $location\useradgroups.txt -append $testr = gc $location\useradgroups.txt if (($testr | out-string) -like $null) {   write-host "unable fetch user ad groups   information" -foreground "red"   start-sleep 10   remove-item $location\useradgroups.txt   break } $useradgroups = foreach ($l in $testr ) {$l.trim()} $useradgroups | select-string -pattern "\w" | out-file $location\useradgroups.txt $useradgroups = gc $location\useradgroups.txt 

question:

unless trim output, cannot compare it. had write script shown above:

1. avoid writting output text file
2. avoid -replace("=", " ") -replace("{", " ") in part 1
3. simplify code.

any suggestion powershell gurus welcomed. me in learning process

so you're trying recursively adgroupmembers? sort of this or this? there more 1 way things. you can use [asdi] type accelerator.

$groups = [adsi]'ldap://cn=groupname,ou=groups,ou=place,dc=tomorrow,dc=today' $group | get-member  foreach($group in $groups){     $members = $group.member     foreach($member in $members){         #is group or user?         #if group group members         #if user user part of group     } } 

are trying format distinguishedname of user?

$user = "cn=huck finn,ou=users,ou=today,ou=tomorrow,dc=yesterday,dc=com" $splits = ($user -split ',') [pscustomobject]@{username=$splits[0].substring(3);oupath=($splits[1..($splits.count-1)] | % {$_.substring(3)}) -join '\'} 

hope helped.