Search code examples
powershellactive-directorysam

Find out if a Security Account Manager (SAM) name is a user or a group

edited from original question because the real problem was something unrelated to the question

I got a list of trustees from NTFS permissions and now I want to expand the groups to show membership. If I have a SAM name like MyDomain\name, there's no indication of whether that is a group or not. The Get-ADobject command has an ObjectClass property which will indicate group or user if this is an Active Directory domain object. One can use: Get-ADObject -filter 'SamAccountName -eq "My Users"' or $sam = "My Users" Get-ADObject -filter 'SamAccountName -eq $sam' Thanks to JPBlanc who had an alternate form of writing that with a script block and some other suggestions. And thanks, user2142466. That looks like a good suggestion for my original script.

Solution

  • You can use a variavle using :

    $sam = "My Users"
Get-ADObject -Filter {(SamAccountName -eq $sam)}

    But I agree that using vars in -Filter sometimes results in strange behaviours with vars (see this question), so I prefer to use -LDAPFilter.

    Get-ADObject -LDAPFilter "(SamAccountName =$user)"

    Be careful the -LDAPFilter use polish notation for the filter, it's a bit disconcerting at the begining, but here, it's the natural way of filtering using the underlaying protocol LDAP.

    You can get more information about this syntax in Search Filter Syntax, you can also get corresponding filters in About_ActiveDirectory_Filter.