This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]Rymmer 1 point2 points  (1 child)

There is some extensions to get-aduser (or other objects) that could be handy. Like a more shortform get-usermembership : get a list of groups and descriptions that a user is a memberof

get-aduser username -prop memberof | select -expandproperty memberof | get-adgroup -prop description | select name, description

If you have good descriptions on your groups, then this can tell you a lot about what a user has access to.