{"id":1337,"date":"2014-05-27T01:18:00","date_gmt":"2014-05-26T17:18:00","guid":{"rendered":"http:\/\/www.jhouseconsulting.com\/?p=1337"},"modified":"2014-05-27T01:18:00","modified_gmt":"2014-05-26T17:18:00","slug":"script-to-create-a-report-on-the-primary-groups-primarygroupid-in-use","status":"publish","type":"post","link":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/2014\/05\/27\/script-to-create-a-report-on-the-primary-groups-primarygroupid-in-use-1337","title":{"rendered":"Script to Create a Report on the Primary Groups (primaryGroupID) in Use"},"content":{"rendered":"

This PowerShell script will enumerate all user accounts in a Domain and report\u00a0on the primary groups (primaryGroupID)\u00a0in use.<\/span><\/p>\n

It will also total up the number of\u00a0enabled and disabled user accounts that each group is applied to.<\/p>\n

The output of this script helps with remediation tasks and perhaps\u00a0even a redesign to implement some standards for the many different use cases.<\/p>\n

As the output is reasonably small and manageable, it outputs to both the screen and a CSV for convenience.<\/p>\n

You can use the $ProcessDisabledUsers variable to exclude disabled accounts, but I personally prefer to do a full report across all enabled and disabled user accounts.<\/p>\n

The following screen shot is from a recent health check I completed.<\/p>\n

\"Primary-Groups-Report\"<\/a><\/p>\n

Here is the Get-PrimaryGroupsReport.ps1<\/a> script:<\/p>\n

\r\n<#\r\n  This script will enumerate all user accounts in a Domain and report\r\n  on the primary groups in use. It will also total up the number of\r\n  enabled and disabled user accounts that each group is applied to.\r\n\r\n  The output of this script helps with remediation tasks and perhaps\r\n  even a redesign to implement some standards for the many different\r\n  use cases.\r\n\r\n  Syntax examples:\r\n\r\n  - To execute the script in the current Domain:\r\n      Get-PrimaryGroupsReport.ps1\r\n\r\n  - To execute the script against a trusted Domain:\r\n      Get-PrimaryGroupsReport.ps1 -TrustedDomain mydemosthatrock.com\r\n\r\n  Script Name: Get-PrimaryGroupsReport.ps1\r\n  Release 1.1\r\n  Written by Jeremy@jhouseconsulting.com 27\/12\/2013\r\n  Modified by Jeremy@jhouseconsulting.com 26\/05\/2014\r\n\r\n#>\r\n#-------------------------------------------------------------\r\nparam([String]$TrustedDomain)\r\n#-------------------------------------------------------------\r\n\r\n# Set this value to true if you want to see the progress bar.\r\n$ProgressBar = $True\r\n\r\n# Set this to true to include disabled user accounts.\r\n$ProcessDisabledUsers = $True\r\n\r\n#-------------------------------------------------------------\r\n# Get the script path\r\n$ScriptPath = {Split-Path $MyInvocation.ScriptName}\r\n$ScriptName = [System.IO.Path]::GetFilenameWithoutExtension($MyInvocation.MyCommand.Path.ToString())\r\n$ReferenceFile = $(&$ScriptPath) + "\\" + $ScriptName + ".csv"\r\n\r\n$TrustedDomain = ""\r\nif ([String]::IsNullOrEmpty($TrustedDomain)) {\r\n  # Get the Current Domain Information\r\n  $domain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()\r\n} else {\r\n  $context = new-object System.DirectoryServices.ActiveDirectory.DirectoryContext("domain",$TrustedDomain)\r\n  Try {\r\n    $domain = [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($context)\r\n  }\r\n  Catch [exception] {\r\n    write-host -ForegroundColor red $_.Exception.Message\r\n    Exit\r\n  }\r\n}\r\n\r\n# Get AD Distinguished Name\r\n$DomainDistinguishedName = $Domain.GetDirectoryEntry() | select -ExpandProperty DistinguishedName\r\n\r\n$array = @()\r\n$primarygroups = @{}\r\n$TotalUsersProcessed = 0\r\n$UserCount = 0\r\n\r\nIf ($ProcessDisabledUsers) {\r\n  # Create an LDAP search for all users not marked as criticalsystemobjects to avoid system accounts\r\n  $ADFilter = "(&(objectClass=user)(objectcategory=person)(!(isCriticalSystemObject=TRUE))(!name=IUSR*)(!name=IWAM*)(!name=ASPNET))"\r\n  $AccountStatus = "enabled and disabled"\r\n} else {\r\n  # Create an LDAP search for all enabled users not marked as criticalsystemobjects to avoid system accounts\r\n  $ADFilter = "(&(objectClass=user)(objectcategory=person)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!(isCriticalSystemObject=TRUE))(!name=IUSR*)(!name=IWAM*)(!name=ASPNET))"\r\n  $AccountStatus = "enabled"\r\n}\r\n# There is a known bug in PowerShell requiring the DirectorySearcher\r\n# properties to be in lower case for reliability.\r\n$ADPropertyList = @("distinguishedname","samaccountname","objectsid","primarygroupid")\r\n$ADScope = "SUBTREE"\r\n$ADPageSize = 1000\r\n$ADSearchRoot = New-Object System.DirectoryServices.DirectoryEntry("LDAP:\/\/$($DomainDistinguishedName)")\r\n$ADSearcher = New-Object System.DirectoryServices.DirectorySearcher\r\n$ADSearcher.SearchRoot = $ADSearchRoot\r\n$ADSearcher.PageSize = $ADPageSize\r\n$ADSearcher.Filter = $ADFilter\r\n$ADSearcher.SearchScope = $ADScope\r\nif ($ADPropertyList) {\r\n  foreach ($ADProperty in $ADPropertyList) {\r\n    [Void]$ADSearcher.PropertiesToLoad.Add($ADProperty)\r\n  }\r\n}\r\n$colResults = $ADSearcher.Findall()\r\n$UserCount = $colResults.Count\r\n\r\nif ($UserCount -ne 0) {\r\n  foreach($objResult in $colResults) {\r\n    $lastLogonTimeStamp = ""\r\n    $lastLogon = ""\r\n    $UserDN = $objResult.Properties.distinguishedname[0]\r\n    $samAccountName = $objResult.Properties.samaccountname[0]\r\n\r\n    # Get user SID\r\n    $arruserSID = New-Object System.Security.Principal.SecurityIdentifier($objResult.Properties.objectsid[0], 0)\r\n    $userSID = $arruserSID.Value\r\n\r\n    # Get the SID of the Domain the account is in\r\n    $AccountDomainSid = $arruserSID.AccountDomainSid.Value\r\n\r\n    # Get User Account Control & Primary Group by binding to the user account\r\n    # ADSI Requires that \/ Characters be Escaped with the \\ Escape Character\r\n    $UserDN = $UserDN.Replace("\/", "\\\/")\r\n    $objUser = [ADSI]("LDAP:\/\/" + $UserDN)\r\n    If (($objUser.useraccountcontrol | Measure-Object).Count -gt 0) {\r\n      $UACValue = $objUser.useraccountcontrol[0]\r\n    } else {\r\n      $UACValue = ""\r\n    }\r\n    $primarygroupID = $objUser.primarygroupid\r\n    # Primary group can be calculated by merging the account domain SID and primary group ID\r\n    $primarygroupSID = $AccountDomainSid + "-" + $primarygroupID.ToString()\r\n    $primarygroup = [adsi]("LDAP:\/\/<SID=$primarygroupSID>")\r\n    $primarygroupname = $primarygroup.name[0]\r\n    $objUser = $null\r\n\r\n    $Enabled = $True\r\n    switch ($UACValue)\r\n    {\r\n      {($UACValue -bor 0x0002) -eq $UACValue} {\r\n        $Enabled = $False\r\n      }\r\n    }\r\n\r\n    $obj = New-Object -TypeName PSObject\r\n    $obj | Add-Member -MemberType NoteProperty -Name "Name" -value $primarygroupname\r\n    # Create a hashtable to capture a count of each Primary Group\r\n    If (!($primarygroups.ContainsKey($primarygroupname))) {\r\n      $TotalCount = 1\r\n      If ($Enabled -eq $True) { $EnabledCount = 1;$DisabledCount = 0 }\r\n      If ($Enabled -eq $False) { $DisabledCount = 1;$EnabledCount = 0 }\r\n      $obj | Add-Member -MemberType NoteProperty -Name "Total" -value $TotalCount\r\n      $obj | Add-Member -MemberType NoteProperty -Name "Enabled" -value $EnabledCount\r\n      If ($ProcessDisabledUsers) {\r\n        $obj | Add-Member -MemberType NoteProperty -Name "Disabled" -value $DisabledCount\r\n      }\r\n      $primarygroups = $primarygroups + @{$primarygroupname = $obj}\r\n    } else {\r\n      $value = $primarygroups.Get_Item($primarygroupname)\r\n      $TotalCount = $value.Total + 1\r\n      If ($Enabled -eq $True) { $EnabledCount = $value.Enabled + 1;$DisabledCount = $value.Disabled }\r\n      If ($Enabled -eq $False) { $DisabledCount = $value.Disabled + 1;$EnabledCount = $value.Enabled }\r\n      $obj | Add-Member -MemberType NoteProperty -Name "Total" -value $TotalCount\r\n      $obj | Add-Member -MemberType NoteProperty -Name "Enabled" -value $EnabledCount\r\n      If ($ProcessDisabledUsers) {\r\n        $obj | Add-Member -MemberType NoteProperty -Name "Disabled" -value $DisabledCount\r\n      }\r\n      $primarygroups.Set_Item($primarygroupname,$obj)\r\n    } # end if\r\n\r\n    $TotalUsersProcessed ++\r\n    If ($ProgressBar) {\r\n      Write-Progress -Activity 'Processing Users' -Status ("Username: {0}" -f $samAccountName) -PercentComplete (($TotalUsersProcessed\/$UserCount)*100)\r\n    }\r\n  }\r\n\r\n  write-host -ForegroundColor Green "`nA breakdown of the $($primarygroups.count) Primary Groups applied to $TotalUsersProcessed $AccountStatus user objects in the $domain Domain:"\r\n  $Output = $primarygroups.values | ForEach {$_ } | ForEach {$_ } | Sort-Object Total -descending\r\n  $Output | Format-Table -AutoSize\r\n\r\n  # Write-Output $Output | Format-Table\r\n  $Output | Export-Csv -Path "$ReferenceFile" -Delimiter ',' -NoTypeInformation\r\n\r\n  # Remove the quotes\r\n  (get-content "$ReferenceFile") |% {$_ -replace '"',""} | out-file "$ReferenceFile" -Fo -En ascii\r\n\r\n} else {\r\n  write-host -ForegroundColor Red "`nNo user objects found!"\r\n}\r\n<\/pre>\n
Enjoy!<\/p>\n","protected":false},"excerpt":{"rendered":"
This PowerShell script will enumerate all user accounts in a Domain and report\u00a0on the primary groups (primaryGroupID)\u00a0in use. It will also total up the number of\u00a0enabled and disabled user accounts that each group is applied to. The output of this script helps with remediation tasks and perhaps\u00a0even a redesign to implement some standards for the … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[202,5],"tags":[428,284,337,341,340,342],"class_list":["post-1337","post","type-post","status-publish","format-standard","hentry","category-active-directory","category-scripting","tag-active-directory","tag-ad","tag-adds","tag-posh","tag-powershell","tag-primarygroupid"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t