This is the built-in help made by Microsoft for the command 'Get-ADAccountAuthorizationGroup', in PowerShell version 3 - as retrieved from
Windows version 'Microsoft Windows Server 2012 Standard' PowerShell help files on 2016-06-23.
For PowerShell version 3 and up, where you have Update-Help, this command was run just before creating the web pages from the help files.
Gets the accounts token group information.
Get-ADAccountAuthorizationGroup [-Identity] <ADAccount> [-AuthType <ADAuthType>] [-Credential <PSCredential>] [-Partition <String>] [-Server
<String>] [<CommonParameters>]
The Get-ADAuthorizationGroup cmdlet gets the security groups from the specified user, computer or service accounts token. This cmdlet requires
a global catalog to perform the group search. If the forest that contains the account does not have a global catalog, the cmdlet returns a
non-terminating error.
The Identity parameter specifies the user, computer, or service account. You can identify a user, computer, or service account object by its
distinguished name (DN), GUID, security identifier (SID), Security Account Manager (SAM) account name or user principal name. You can also set
the Identity parameter to an account object variable, such as $<localAccountobject>, or pass an account object through the pipeline to the
Identity parameter. For example, you can use the Get-ADUser, Get-ADComputer, Get-ADServiceAccount or Search-ADAccount cmdlets to retrieve an
account object and then pass the object through the pipeline to the Get-ADAccountAuthorizationGroup cmdlet.
<
Online Version: http://go.microsoft.com/fwlink/?LinkID=219317
Get-ADComputer
Get-ADServiceAccount
Get-ADUser
Search-ADAccount
<
-------------------------- EXAMPLE 1 --------------------------
C:\PS>Get-ADAccountAuthorizationGroup GlenJohn
GroupScope : DomainLocal
objectGUID : 00000000-0000-0000-0000-000000000000
GroupCategory : Security
SamAccountName : Everyone
name : Everyone
objectClass :
SID : S-1-1-0
distinguishedName :
GroupScope : DomainLocal
objectGUID : 00000000-0000-0000-0000-000000000000
GroupCategory : Security
SamAccountName : Authenticated Users
name : Authenticated Users
objectClass :
SID : S-1-5-11
distinguishedName :
GroupScope : Global
objectGUID : 86c0f0d5-8b4d-4f35-a867-85a006b92902
GroupCategory : Security
SamAccountName : Domain Users
name : Domain Users
objectClass : group
SID : S-1-5-21-41432690-3719764436-1984117282-513
distinguishedName : CN=Domain Users,CN=Users,DC=Fabrikam,DC=com
GroupScope : DomainLocal
objectGUID : 869fb7ad-8cf2-4dd0-ac0f-4bd3bf324669
GroupCategory : Security
SamAccountName : Pre-Windows 2000 Compatible Access
name : Pre-Windows 2000 Compatible Access
objectClass : group
SID : S-1-5-32-554
distinguishedName : CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=Fabrikam,DC=com
GroupScope : DomainLocal
objectGUID : c1e397c5-1e44-4270-94d1-88d6c4b78ee6
GroupCategory : Security
SamAccountName : Users
name : Users
objectClass : group
SID : S-1-5-32-545
distinguishedName : CN=Users,CN=Builtin,DC=Fabrikam,DC=com
Description
-----------
Returns all security groups for the specified account with SamAccountName: GlenJohn.
-------------------------- EXAMPLE 2 --------------------------
C:\PS>Get-ADAccountAuthorizationGroup "cn=GlenJohn,dc=AppNC" -Server <Server>:50000
distinguishedName : CN=AdminGroup,DC=AppNC
GroupCategory : Security
GroupScope : Global
name : AdminGroup
objectClass : group
objectGUID : 4d72873f-fe09-4834-9ada-a905636d10df
SamAccountName :
SID : S-1-510474493-936115905-4021890855-1253703389-3958791574-3542197427
Description
-----------
Returns all security groups for the specified account with DistinguishedName: "cn=GlenJohn,dc=AppNC" in the AD LDS instance: <Server>:50000.
-------------------------- EXAMPLE 3 --------------------------
C:\PS>Get-ADAccountAuthorizationGroup -Server <Server>:50000 -Identity Administrator | where { $_.objectClass -ne $null } | ft name,
objectClass
name objectClass
---- -----------
Domain Users group
Administrators group
Users group
Pre-Windows 2000 Compatible Access group
Group Policy Creator Owners group
Domain Admins group
Enterprise Admins group
Schema Admins group
Denied RODC Password Replication Group group
Description
-----------
Returns a filtered list of built-in security groups which do not have an empty or null setting for objectclass (such as Everyone or
Authenticated Users). (Note: This type of filtering of groups in output can be useful when piping the output of this cmdlet to be used as
input to other Active Directory cmdlets.)