How to get all Active Directory groups of an user with powershell?

Sometimes it is needed to get all the Active Directory groups for an user. One reason is the calculation of KERBEROS TOKEN size for an user.

On the web are a lot of articles exists where you can see that it is solved with just 3 lines, but it never works fine:

$samAccountName = "a.azubi"

$username = $samAccountName

$dn = (Get-ADUser $username).DistinguishedName

Get-ADGroup -LDAPFilter ("(member:1.2.840.113556.1.4.1941:=)" -f $dn) | select -expand Name | sort Name

During the use of your CARO-Suite Account View you can see that the number and amount of membership is not true.

Here is the output of the command in our environment:

But in the CARO-Suite tool you see:

As you can see the number is 32 AD Groups + 1 (local group membership of a Windows PC). This is a benefit of the CARO-Suite, that you can see the membership of any device or technology you connected with collectors. The PowerShell command gives us just 26 AD Groups and this makes a difference of 6 AD groups.

We’ve adapted the command and then it shows all what the CARO-Suite shows.

Here is the output of the command in our environment:

I hope it helps like you, as it helps a lot of our customers. We support you for scripting and covering all topics around access rights management and specially we are the experts, because we were part of the former Protected Networks GmbH family which developed 8MAN.