A while back (almost 7 years 😲) I wrote a post on finding the common AD groups of a set of users using T-SQL. This is pretty handy when you need to set up permissions for

• A group of people
• Only want to use AD groups for your security (it’s a good idea)
• They have no idea what AD group they should use (virtually. every. single. time.)

The T-SQL version works great, but it does have a couple of flaws. The biggest one being you need to be able to impersonate each of the users. The other is that it’s T-SQL which is great, but when you only have T-SQL it’s a bit restrictive. Recently one of my co-workers (Thanks Andrew!) gave me a handy dandy little PowerShell script that does almost exactly the same thing.

Initially I had planned on having you run a script to create some windows users and groups, but I discovered that one of these commands (guess which 😉) will only work if AD is set up, and I didn’t have time (or the knowledge) to get it set up on my Azure VM. So instead let’s go straight to the PowerShell script.

$ADGroups=Get-ADPrincipalGroupMembership Dopey | select name
$ADGroups2=Get-ADPrincipalGroupMembership Sleepy | select name

#Compare-Object $ADGroups $ADGroups2
Compare-Object $ADGroups $ADGroups2 -IncludeEqual

I will note that I had a hard time getting this to run initially. I found some answers here. Specifically I ran this script.

Import-Module ServerManager
Add-WindowsFeature RSAT-AD-PowerShell

Import-Module ActiveDirectory

And I ended up with this output:

InputObject                                  SideIndicator
-----------                                  -------------
@{name=Dwarves}                              =>           
@{name=DwarvesLikeKen}                       =>  

Which are the two groups that Dopey and Sleepy belong to. The important commands are:

Get-ADPrincipalGroupMembership : Pretty obvious what this one does.
Compare-Object : This is a pretty neat command that compares two sets of objects. It returns any differences with <= or => to tell you which set of objects the value is in. If you include -IncludeEqual then you will also see == in any cases where the value is in both sets.