title: Powershell GPO Login Script checking AD resource group membership
body: <p>The system I have to work with uses AD resource group membership to manage most of the permissions for users and computers. I have been asked to improve the current logon script as it currently contains some VB ADSISEARCHER calls. I started trying to do this purely in powershell but have hit a number of hurdles.</p>
  
  <ul>
  <li>Target machines do not have the Active Directory Module installed</li>
  <li>The users logging into the system have a restricted user accounts</li>
  <li>The resource groups are nested so the script needs to handle this</li>
  </ul>
  
  <p>I have tried a couple of approaches firstly the pure Powershell Cmdlet method of Get-ADGroup or Get-ADPricipalGroupMembership but these Cmdlet's require the Active Directory Module. Then I tried the .net approach with System.DirectoryServices.DirectoryEntry although this is a step away from a pure PowerShell solution at least it isn't as Legacy as the VB route. However when I try to build the object it also appears to be missing the name space.</p>
  
  <p>First Attempt:</p>
  
  <pre><code>function Get-UserResourceMembership
  {
      [CmdletBinding()]
      Param
      (
          # Username or Groupname to Discover Group Membership
          [Parameter(Mandatory=$true,
                     ValueFromPipelineByPropertyName=$true,
                     Position=0)]
          $User
      )
  
      Begin
      {
          $Groups = @(Get-ADPrincipalGroupMembership $User)
      }
      Process
      {
          foreach($ADGroup in $Groups)
              {
                  if($ADGroup.ObjectClass -eq "Group")
                  {
                      Get-UserResourceMembership $ADGroup
                  }
  
                  $GrpMembership = @($ADGroup)
              }
      }
      End
      {
       return ,$GrpMembership
      }
  }
  </code></pre>
  
  <p>Second Attempt:</p>
  
  <pre><code># $rootGroup is passed in from earlier in the script
  
  $groupname = $rootGroup.'Group Name'
  $filter = ("(&amp;(objectCategory=Group)(name=$($groupname)))")
  $searcher.Filter = $filter
  $searcher.SearchScope = "Subtree"
  
  $searchResults = $searcher.FindAll().GetDirectoryEntry().memberOf |
  % { (New-Object System.DirectoryServices.DirectoryEntry("LDAP://"+$_)) } |
  Sort-Object Children | select @{name="Group Name";expression={$_.Name}}
  
  foreach($resource in $searchResults)
      {
          if($resource.'Group Name' -match "&lt;Groupname&gt;")
          {
              $printResource += $resource
          }
      }
  </code></pre>
  
  <p>Does anyone in the community have any suggestions how to pull group membership [nested] from Active Directory from a standard users login script??? Any idea's much appreciated....</p>
  
  <p>PS I can't change the way the system is designed (above my pay grade).</p>