1

if A user is in domain B and user is a member of groups in domain A.how to get all groups the user is a member of?

7 Spice ups
2

Is this a homework question?

3

No it is not a homework question

4

When I enter this command (get-aduser -Server domainBcontroller -Identity username -Credential $p -Properties MemberOf).memberof. I am getting domain B groups only.

5

You will because domainb only knows about the groups on that domain. You’ll need to run the query on both domains.

1 Spice up
6

Combine them then ouput the combined variable.

$user = get-aduser -Server domainBcontroller -Identity username -Credential $p -Properties MemberOf).memberof
$user += get-aduser -Server domainAcontroller -Identity username -Credential $p -Properties MemberOf).memberof

write-host $user
7

I am getting below error when running get-aduser -Server domainAcontroller -Identity username -Credential $p -Properties MemberOf).memberof

get-aduser : Cannot find an object with identity: ‘user’ under: ‘DomainA’.

User is in domain B.

8

Oh, I thought the user was in DomainA. According to this, if there is a domain trust, you should already see all the groups in the user’s memberOf of DomainB.

9

There is a two way trust between the domains.
The groups which user is a member of in domain A are domain local.

10

there is an account in foreignsecurityprincipals with the user in domainB

11

$Groups = Get-ADGroup -Properties * -Filter * -SearchBase “DC=DomainA,DC=com”
Foreach($G In $Groups)
{
if($g.members -contains “CN=UserSID,CN=ForeignSecurityPrincipals,DC=DomainA,DC=com”)
{
Write-Host $G.Name
}
}