Gets the accounts token group information.
The Get-ADAuthorizationGroup cmdlet gets the security groups from the specified user, computer or service accounts token. This cmdlet requires a global catalog to perform the group search. If the forest that contains the account does not have a global catalog, the cmdlet returns a non-terminating error.
The Identity parameter specifies the user, computer, or service account. You can identify a user, computer, or service account object by its distinguished name (DN), GUID, security identifier (SID), Security Account Manager (SAM) account name or user principal name. You can also set the Identity parameter to an account object variable, such as $, or pass an account object through the pipeline to the Identity parameter. For example, you can use the Get-ADUser, Get-ADComputer, Get-ADServiceAccount or Search-ADAccount cmdlets to retrieve an account object and then pass the object through the pipeline to the Get-ADAccountAuthorizationGroup cmdlet.
Parameters
-AuthType
Specifies the authentication method to use. Possible values for this parameter include:
Required? false
Position? named
Default value Microsoft.ActiveDirectory.Management.AuthType.Negotiate
Accept pipeline input? false
Accept wildcard characters? false
-Credential <PSCredential>
Specifies the user account credentials to use to perform this task. The default credentials are the credentials of the currently logged on user unless the cmdlet is run from an Active Directory PowerShell provider drive. If the cmdlet is run from such a provider drive, the account associated with the drive is the default.
Required? false
Position? named
Default value
Accept pipeline input? false
Accept wildcard characters? false
-Identity <ADAccount>
Specifies an Active Directory account object by providing one of the following property values. The identifier in parentheses is the LDAP display name for the attribute.
Required? true
Position? 1
Default value
Accept pipeline input? True (ByValue)
Accept wildcard characters? false
-Partition <String>
Specifies the distinguished name of an Active Directory partition. The distinguished name must be one of the naming contexts on the current directory server. The cmdlet searches this partition to find the object defined by the Identity parameter.
Required? false
Position? named
Default value
Accept pipeline input? false
Accept wildcard characters? false
-Server <String>
Specifies the Active Directory Domain Services instance to connect to, by providing one of the following values for a corresponding domain name or directory server. The service may be any of the following: Active Directory Lightweight Domain Services, Active Directory Domain Services or Active Directory Snapshot instance.
Required? false
Position? named
Default value
Accept pipeline input? false
Accept wildcard characters? falseSyntax
This cmdlet does not work with an Active Directory Snapshot.
C:\PS>Get-ADAccountAuthorizationGroup Workers
GroupScope : DomainLocal
objectGUID : 00000000-0000-0000-0000-000000000000
GroupCategory : Security
SamAccountName : Everyone
name : Everyone
objectClass :
SID : S-1-1-10
distinguishedName :
GroupScope : DomainLocal
objectGUID : 00000000-0000-0000-0000-000000000000
GroupCategory : Security
SamAccountName : Authenticated Users
name : Authenticated Users
objectClass :
SID : S-1-4-19
distinguishedName :
GroupScope : Global
objectGUID : 25u6l6e3-6k5l-3l84-e332-85a006b92902
GroupCategory : Security
SamAccountName : Domain Users
name : Domain Users
objectClass : group
SID : S-1-5-21-23412583-6124275193-2465856258-632
distinguishedName : CN=Domain Users,CN=Users,DC=TOSSolution,DC=com
GroupScope : DomainLocal
objectGUID : 869fb7ad-8cf2-4dd0-ac0f-4bd3bf324669
GroupCategory : Security
SamAccountName : Pre-Windows 2000 Compatible Access
name : Pre-Windows 2000 Compatible Access
objectClass : group
SID : S-1-4-21-632
distinguishedName : CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=TOSSolution,DC=com
GroupScope : DomainLocal
objectGUID : e1l621c5-6s31-6589-23r6-88d6c4b78ee6
GroupCategory : Security
SamAccountName : Users
name : Users
objectClass : group
SID : S-1-3-23-532
distinguishedName : CN=Users,CN=Builtin,DC=TOSSolution,DC=com
C:\PS>Get-ADAccountAuthorizationGroup “cn=Karthik,dc=Delhi” -Server :50000
distinguishedName : CN=AdminGroup,DC=AppNC
GroupCategory : Security
GroupScope : Global
name : AdminGroup
objectClass : group
objectGUID : 4d72873f-fe09-4834-9ada-a905636d10df
SamAccountName :
SID : S-1-356456259-254632589-6325412983-1253703389-3958791574-3542197427
C:\PS>Get-ADAccountAuthorizationGroup -Server :50000 -Identity Administrator | where { $_.objectClass -ne $null } | ft name, objectClass
name objectClass
---- -----------
Domain Users group
Administrators group
Users group
Pre-Windows 2000 Compatible Access group
Group Policy Creator Owners group
Domain Admins group
Enterprise Admins group
Schema Admins group
Denied RODC Password Replication Group groupGet-Command Get-ADAccountAuthorizationGroup
. Get-ADComputer
. Get-ADServiceAccount
. Get-ADUser
. Search-ADAccount