PowerShell for Windows Admins

Dec 3 2012   4:58PM GMT

Comparing group membership

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

A question on the forum asked about comparing the memberships of two groups & displaying information about the users that are in both. The normal reaction is that you have to iterate through the two groups but then I remembered Compare-Object and came up with this

$group1 = Get-ADGroupMember -Identity ADL-group1 | select SamAccountName            
            
$group2 = Get-ADGroupMember -Identity ADL-group2 | select SamAccountName            
            
Compare-Object -ReferenceObject $group1 -DifferenceObject $group2 -IncludeEqual |             
where SideIndicator -eq "==" |            
foreach {            
 $sam = ($_.InputObject).SamAccountName             
             
 Get-ADUser -Identity $sam -Properties *            
            
}

Get the group membership of each group into a variable – I’m using the Microsoft cmdlets and just selecting the samaccountname to compare.

Using Compare-Object I used the –IncludeEqual parameter to make sure I got the matches and then filtered on the SideIndicator value of “==” .  That gets me the matches.

I then loop through them and use Get-ADUser to pull back the properties I need.

If you want to do this with the quest cmdlets use distinguished name instead of samaccountname

6  Comments on this Post

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when other members comment.
  • CyberShell
    Richard, 

    Thanks for this, but when i try looking out with a EmployeeID instead of a SamName it fails. 

    Can you help to see that it can compare the 2 group membership based on "EmployeeID" instead of SamAccountname.

    Also if that output can be emailed to a particular email address it would be great.
    10 pointsBadges:
    report
  • CyberShell
    Richard.,

    I ran into a problem and i hope you can help, when i trying running this script using EmployeeID property it does not give me a desired output.

    The reason i have to do with EmployeeID property is that in our ogranization we have mutiple administrator and operator ID but they all have a common attribute employeeID.

    So for example an user called John Doe can have Jdoe, A-JDoe, O-JDoe as his ID in either of the group but his employeeID would be same in all the groups.

    Also if i can email this output to someone it would be great help.
    Please can you help, any help would be appreciated.
    10 pointsBadges:
    report
  • CyberShell
    Richard, 

    I am trying to get it to compared to "EmployeeID" property instead of SamAccountname, but somehow it fails and does not give me the desired output.

    Here is my situation my organization has multiple account type for example a person called John Doe would have JDoe, A-JDoe, O-JDoe according to the function of his role that he has to perform. so as you can see the SamAccountname would be different but every user object will have a EmployeeID for sure.



    10 pointsBadges:
    report
  • CyberShell
    Richard, 

    I am trying to get it to compared to "EmployeeID" property instead of SamAccountname, but somehow it fails and does not give me the desired output.

    Here is my situation my organization has multiple account type for example a person called John Doe would have JDoe, A-JDoe, O-JDoe according to the function of his role that he has to perform. so as you can see the SamAccountname would be different but every user object will have a EmployeeID for sure.

    10 pointsBadges:
    report
  • Richard Siddaway
    See: http://itknowledgeexchange.techtarget.com/powershell/comparing-ad-group-membership-employeeid/
    7,725 pointsBadges:
    report
  • CyberShell
    Thank you.
    10 pointsBadges:
    report

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

Share this item with your network: