title: Get user permissions to folder including indirect permissions through AD and local groups
body: <p>I want to check whether a given Active Directory user (specified by username and domain) has read/(write) permissions on a given folder. And this unrelated to having them granted directly by user name or indirectly by some group membership. However I've been googling like 5 hours by now to no avail.</p>
  
  <p>I understand, that <code>Get-Acl</code> Cmdlet is used to read folder permissions. Most likely the user is member of some group, that indirectly grants it permissions.</p>
  
  <p>So my idea was to just match the output of</p>
  
  <pre><code>(Get-Acl &lt;Folder&gt;).Access | ft
  </code></pre>
  
  <p>against the group membership of the user.</p>
  
  <p>I collect the group Information using the command</p>
  
  <pre><code>Get-ADPrincipalGroupMembership "&lt;Username&gt;" | select name
  </code></pre>
  
  <p>but found out, that this features an entirely different set of group names. I assumed, that the groups outputted by <code>Get-Acl</code> are local ones, while the other ones were AD-sided groups.</p>
  
  <p>I found the command <code>whoami /groups</code>, that prints all groups, but only for the currently logged in user.</p>
  
  <p>After quite some additional time I figured out the command (based on .NET):</p>
  
  <pre><code>(New-Object Security.Principal.WindowsIdentity -ArgumentList @(,"&lt;User@fullDomain.com&gt;")).Claims | select Value
  </code></pre>
  
  <p>This however just prints SIDs, while</p>
  
  <pre><code>(Get-Acl &lt;Folder&gt;).Access | ft
  </code></pre>
  
  <p>displays some human friendly output like "NT SERVICE\TrustedInstaller" and such.</p>
  
  <p>I believe I'm pretty close, but I just can't get it to work. 
  On another note: Does this really have to be that complicated?</p>
  
  <p>Other solutions I found only work based on direct user permissions but do not check group permissions.</p>
  
  <p>Oh and one thing: Everything has to run on PowerShell 4.0 on Windows Server 2012&nbsp;R2 and the PowerShell script will be running locally. No NuGet packages or anything requiring an Internet connection are allowed.</p>