PowerShell Logo Small


This is the built-in help made by Microsoft for the command 'Get-ADAccountAuthorizationGroup', in PowerShell version 5 - as retrieved from Windows version 'Microsoft Windows Server 2012 R2 Standard' PowerShell help files on 2016-06-23.

For PowerShell version 3 and up, where you have Update-Help, this command was run just before creating the web pages from the help files.


Gets the accounts token group information.


Get-ADAccountAuthorizationGroup [-Identity] <ADAccount> [-AuthType {Negotiate | Basic}] [-Credential <PSCredential>] [-Partition <String>] [-Server <String>]

Search powershellhelp.space


The Get-ADAccountAuthorizationGroup cmdlet gets the security groups from the specified user, computer or service accounts token. This cmdlet requires a global catalog to
perform the group search. If the forest that contains the account does not have a global catalog, the cmdlet returns a non-terminating error.

The Identity parameter specifies the user, computer, or service account. You can identify a user, computer, or service account object by its distinguished name (DN), GUID,
security identifier (SID), Security Account Manager (SAM) account name or user principal name. You can also set the Identity parameter to an account object variable, such as
$<localAccountobject>, or pass an account object through the pipeline to the Identity parameter. For example, you can use the Get-ADUser, Get-ADComputer,
Get-ADServiceAccount or Search-ADAccount cmdlets to retrieve an account object and then pass the object through the pipeline to the Get-ADAccountAuthorizationGroup cmdlet.



Online Version: http://go.microsoft.com/fwlink/p/?linkid=291015




-------------------------- EXAMPLE 1 --------------------------

PS C:\>Get-ADAccountAuthorizationGroup -Identity GlenJohn
GroupScope : DomainLocal
objectGUID : 00000000-0000-0000-0000-000000000000
GroupCategory : Security
SamAccountName : Everyone
name : Everyone
objectClass : SID : S-1-1-0
distinguishedName : GroupScope : DomainLocal
objectGUID : 00000000-0000-0000-0000-000000000000
GroupCategory : Security
SamAccountName : Authenticated Users
name : Authenticated Users
objectClass : SID : S-1-5-11
distinguishedName : GroupScope : Global
objectGUID : 86c0f0d5-8b4d-4f35-a867-85a006b92902
GroupCategory : Security
SamAccountName : Domain Users
name : Domain Users
objectClass : group
SID : S-1-5-21-41432690-3719764436-1984117282-513
distinguishedName : CN=Domain Users,CN=Users,DC=Fabrikam,DC=com

GroupScope : DomainLocal
objectGUID : 869fb7ad-8cf2-4dd0-ac0f-4bd3bf324669
GroupCategory : Security
SamAccountName : Pre-Windows 2000 Compatible Access
name : Pre-Windows 2000 Compatible Access
objectClass : group
SID : S-1-5-32-554
distinguishedName : CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=Fabrikam,DC=com

GroupScope : DomainLocal
objectGUID : c1e397c5-1e44-4270-94d1-88d6c4b78ee6
GroupCategory : Security
SamAccountName : Users
name : Users
objectClass : group
SID : S-1-5-32-545
distinguishedName : CN=Users,CN=Builtin,DC=Fabrikam,DC=com

This command returns all security groups for the specified account with SamAccountName GlenJohn.

-------------------------- EXAMPLE 2 --------------------------

PS C:\>Get-ADAccountAuthorizationGroup -Identity "cn=GlenJohn,dc=AppNC" -Server <Server>:50000
distinguishedName : CN=AdminGroup,DC=AppNC
GroupCategory : Security
GroupScope : Global
name : AdminGroup
objectClass : group
objectGUID : 4d72873f-fe09-4834-9ada-a905636d10df
SamAccountName : SID : S-1-510474493-936115905-4021890855-1253703389-3958791574-3542197427

This command returns all security groups for the specified account with DistinguishedName cn=GlenJohn,dc=AppNC in the AD LDS instance <Server>:50000.

-------------------------- EXAMPLE 3 --------------------------

PS C:\>Get-ADAccountAuthorizationGroup -Server <Server>:50000 -Identity Administrator | where { $_.objectClass -ne $null } | ft name, objectClass
name objectClass
---- -----------
Domain Users group
Administrators group
Users group
Pre-Windows 2000 Compatible Access group
Group Policy Creator Owners group
Domain Admins group
Enterprise Admins group
Schema Admins group
Denied RODC Password Replication Group group

This command returns a filtered list of built-in security groups which do not have an empty or null setting for objectclass, such as Everyone or Authenticated Users. Note:
This type of filtering of groups in output can be useful when piping the output of this cmdlet to be used as input to other Active Directory cmdlets.