Script to find users that are a member of more than one of a list of specific groups

Question

Hi,
I need to generate a list of users that are members in more than one group, out of a list of specific security groups.  Here's the situation:
1) We have about 1100 users, all nested under a specific OU called CompanyUsers.  There are sub-OUs under CompanyUsers that users may actually be in.
2) We have about 75 groups, all directly under a specific OU called AppGroups.  These groups correspond to a user's role within an internal line of business application.  All these groups start with a specific character prefix "xyz", so the group
name is actually "xyz-approle".
I want to write a script that tells me if a user from point 1) is a member in more than one group in point 2).  So far, I've come up with a way to enumerate the users to an array:
$userlist = get-qaduser -searchroot 'dq.ad/dqusers/doral/remote' | select samaccountname |Format-Table -HideTableHeaders
I also have a way to enumerate all the groups that start with xyz that the user is a member of:
get-QADMemberOf -identity <username> -name xyz* -Indirect
I figure I can use the first code line to start a foreach loop that uses the 2nd code line, outputting to CSV format for easy to see manual verification.  But I'm having two problems:
1) How to get the output to a CSV file in the format <username>,groupa,groupb,etc.
2) Is there any easier way to do this, say just outputting the users in more than one group?
Any help/ideas are welcome.
Thanks in advance!
John

Answer 1

Here is a PowerShell script solution. I can't think of way to make this more efficient. You could search for all groups in the specfied OU that start with "xyz", then filter on all users that are members of at least one of these groups. However, I suspect
that most (if not all) users in the OU are members of at least one such group, and there is no way to filter on users that are members of more than one. This solution returns all users and their direct group memberships, then checks each membership to
see if it meets the conditions. It outputs the DN of any user that is a member of more than one specfied group:
# Search CompanyUsers OU.
strUsersOU = "ou=CompanyUsers,ou=West,dc=MyDomain,dc=com"
$UsersOU = New-Object System.DirectoryServices.DirectoryEntry $strUsersOU
# Use the DirectorySearcher class.
$Searcher = New-Object System.DirectoryServices.DirectorySearcher
$Searcher.SearchRoot = $UsersOU
$Searcher.PageSize = 200
$Searcher.SearchScope = "subtree"
$Searcher.PropertiesToLoad.Add("distinguishedName") > $Null
$Searcher.PropertiesToLoad.Add("memberOf") > $Null
# Filter on all users in the base.
$Searcher.Filter = "(&(objectCategory=person)(objectClass=user))"
$Results = $Searcher.FindAll()
# Enumerate users.
"Users that are members of more than one specified group:"
ForEach ($User In $Results)
    $UserDN = $User.properties.Item("distinguishedName")
    $Groups = $User.properties.Item("memberOf")
    # Consider users that are members of at least 2 groups.
    If ($Groups.Count -gt 1)
        # Count number of group memberships.
        $Count = 0
        ForEach ($Group In $Groups)
            # Check if group Common Name starts with the string "xyz".
            If ($Group.StartsWith("cn=xyz"))
                # Make sure group is in specified OU.
                If ($Group.Contains(",ou=AppsGroup,"))
                    $Count = $Count +1
                    If ($Count -gt 1)
                        # Output users that are members of more than one specified group.
                        $DN
                        # Break out of the ForEach loop.
                        Break
Richard Mueller - MVP Directory Services