$>./get-nestedgroups.ps1 "My Universal Group"
Group_Name Members Group_Type Domain
---------- ------- ---------- ------
MyAdminGroup {jarrettirons, MyAdminGroup-Gl... Universal mydomain
MyAdminGroup-Global {user1,user2,user3,user4,user,... Global subdomain
--Jarrett
# Function get-NestedMembers
# List the members of a group including all nested members of subgroups
# GLOBAL VARIABLES
$adgroups = @()
[array]$disabled_status = @("514", "546", "2", "66050")
[array]$roots = @()
$roots = "LDAP://dc=mydomain,dc=com"
$roots += "LDAP://dc=subdomain,dc=mydomain,dc=com"
# PRIVATE FUNCTIONS
###################################################
function get-NestedMembers ([array]$domaingroup) {
###################################################
foreach ($dgroup in $domaingroup) {
if ($dgroup.objectclass -contains 'group') {
($dgroup | select @{Name="Group_Name"; Expression={$_.cn}},
@{Name="Members"; Expression={foreach ($member in $_.member) {
$admember = new-object DirectoryServices.DirectoryEntry("LDAP://$member");
if ($admember.objectclass -contains "person") {
if ($disabled_status -notcontains $admember.useraccountcontrol) {
[string]$admember.cn
remove-item variable:\admember
}
}
else {[string]$admember.cn}
}
}},
@{Name="Group_Type"; Expression={if (([string]$_.grouptype) -eq '-2147483640') {
return "Universal"
}
if (([string]$_.grouptype) -eq '-2147483646') {
return "Global"
}
}},
@{Name="Domain"; Expression={
$null = ([string]$_.distinguishedname) -match "DC=([^,]+)"; $matches[1]
}})
$dgroup.member | % {
$adobject = new-object directoryservices.directoryentry("LDAP://$_")
if ($adobject.objectclass -ne $null) {
if ($adobject.objectclass -contains 'group') {
get-nestedMembers $adobject
}
}
}
}
}
}
################################
function get-adGroup ($group) {
################################
[array]$roots = @()
$roots = "LDAP://dc=msprod,dc=msp"
$roots += "LDAP://dc=guest,dc=msprod,dc=msp"
$category = "group"
$dom = New-Object System.DirectoryServices.DirectoryEntry
$dirSearcher = New-Object System.DirectoryServices.DirectorySearcher
$dirSearcher.PageSize = 1000
$dirSearcher.Filter = ("(objectCategory=$category)")
foreach ($root in $roots)
{
$dirSearcher.SearchRoot = $root
trap [System.Exception] {continue;}
[array]$items += $dirSearcher.FindAll() | ?{$_.properties.name -like $group}
}
foreach ($item in $items){
[array]$results += new-object DirectoryServices.DirectoryEntry($item.path);
}
return $results
}
##############################
function get-adUser ($user) {
##############################
$category = "Person"
$dom = New-Object System.DirectoryServices.DirectoryEntry
$dirSearcher = New-Object System.DirectoryServices.DirectorySearcher
$dirSearcher.PageSize = 1000
$dirSearcher.Filter = "(&(objectCategory=Person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))"
foreach ($root in $roots)
{
$dirSearcher.SearchRoot = $root
trap [System.Exception] {continue;}
$results = $dirSearcher.FindAll() | ?{$_.properties.name -like "$user"} | sort-object properties.cn
}
foreach ($item in $results) {
$object = $item.Properties
}
return $results.properties
}
#=========================================================
# MAIN
$name = get-adGroup $args
get-NestedMembers $name
