3

I need to list all the AD groups used in all the site collection. Can any one please help.

$SPWebApp = Get-SPWebApplication https://*******.com/

foreach ($SPSite in $SPWebApp.Sites)
{
    write-host -foregroundcolor green "Working on Site Collection: "$SPsite.RootWeb.Title 
    ##write-host -foregroundcolor green "Working on Site Collection: "$SPsite.RootWeb.URL
    $SiteURL = $SPsite.RootWeb.URL
    $ADgroup=Get-SPUser -Web $SiteURL  | Where { $_.IsDomainGroup }
    foreach($group in $ADgroup)
    {
        write-host $group.DisplayName
        $Output += ($group.DisplayName)
        $users = new-object psobject
        $users | add-member noteproperty -name "Site Collection" -value $SPsite.RootWeb.Title
        $users | add-member noteproperty -name "Groups" -value $group.DisplayName
        $combinedusers += $users
    } 
    $combinedusers | export-csv "F:\group.csv" -notypeinformation
}
5

You can use below snippet

Get-SPUser -Web http://server/sites/yoursite | Where { $_.IsDomainGroup }

AD group is treated as a special user. So this can be find using the filter IsDomainGroup

Update

$SPWebApp = Get-SPWebApplication https://*******.com/

foreach ($SPSite in $SPWebApp.Sites)
{
    write-host -foregroundcolor green "Working on Site Collection: "$SPsite.RootWeb.Title 
    ##write-host -foregroundcolor green "Working on Site Collection: "$SPsite.RootWeb.URL
    $SiteURL = $SPsite.RootWeb.URL
    $ADgroup=Get-SPUser -Web $SiteURL -Limit ALL | Where { $_.IsDomainGroup }
    foreach($group in $ADgroup)
    {
        if($Output -notcontains $group.DisplayName)
        {
            write-host $group.DisplayName
            $Output += ($group.DisplayName)
            $users = new-object psobject
            $users | add-member noteproperty -name "Site Collection" -value $SPsite.RootWeb.Title
            $users | add-member noteproperty -name "Groups" -value $group.DisplayName
            $combinedusers += $users
        }
    } 
    $combinedusers | export-csv "F:\group.csv" -notypeinformation
}
| improve this answer | |
  • Thanks Amal...it worked. I have one more requirement. Right now the code I have done lists all the groups from all the site collections. But I want single list of groups used within all the site collection. I have added my code above. please suggest any changes. let me know if need is not clear. – Rajeev K Jan 16 '15 at 13:09
  • What you mean by single list? You mean remove duplicates? – Amal Hashim Jan 16 '15 at 13:10
  • correct. I have added code above in my post. – Rajeev K Jan 16 '15 at 13:13
  • @RajeevK I added an if statement to check if the group is already added or not. – Amal Hashim Jan 16 '15 at 13:21
  • Thanks Amal..I will check this.. will let you know in some time...:) – Rajeev K Jan 16 '15 at 13:26
2

You need to cycle one way or the other, by this I mean iterate either through AD groups or through SharePoint groups and compare the two.... I'm lazy and created a console application that explains how to do it. When I get the chance I will post PS code!

.cs code is checking against AD and looping SharePoint as I think you could have many AD groups and fewer SharePoint groups. This is up to you as you can use site.RootWeb.EnsureUser() to check against, but either way you're still going to have to call AD to get groups.

        try
        {
            //get the web application via url, only need the host header and port its using. Look in central admin at webapplication list to see what it's using. 
            SPWebApplication webapp = SPWebApplication.Lookup(new Uri("http://webapplicationUrl:80/"));
            //get all the site collections within the web application. Add it into SPSiteCollection for better speed , get it once for less calls and stored locally
            SPSiteCollection siteCol = webapp.Sites;
            //loop through each site colleciton
            foreach (SPSite site in siteCol)
            {
                //use try block to finish with the spsite object at the end so there is no memory leaks.
                try
                {
                    //get the whole group at the root level for the site collection, get it once for less calls and stored locally
                    SPGroupCollection groupCol = site.RootWeb.Groups;
                    //loop thorough each sharepoint group to check against.
                    foreach (SPGroup group in groupCol)
                    {
                        //change principal context to a domain account 
                        //  "mydomain.com" is the domain name the you are trying to access in active directory 
                        //  "wilma" is the account name that is a domain account that has access to active directory
                        //  "wilma's Password" this is where you put in the domain account password
                        var principalContext = new PrincipalContext(ContextType.Domain, "easyas.com", "wilma", "wilma's Password");
                        GroupPrincipal groupPrincipal = GroupPrincipal.FindByIdentity(principalContext, group.Name);

                        //if null than it doesn't exist in AD! 
                        if (groupPrincipal != null)
                        {
                            //show message that it exists
                            Console.WriteLine("Group '" + group.Name + "' exists");
                        }
                        {
                            //show message that it doesn't exist
                            Console.WriteLine("Group '" + group.Name + "' does not exists in AD");
                        }
                    }
                }
                finally
                {
                    //when finished disposed of the spsite object
                    site.Dispose();
                }
            }
        }
        catch (Exception a)
        {
            Console.WriteLine("error caught : " + a.Message);
        }

        Console.ReadLine();

The PS code (as I can't be arsed to write it as it's Friday). I found what I'm pretty much doing above; It's in no way complete and needs amending to get from webapplication rather than from one site collection. The majority of the work is there though so shouldn't be hard to figure out.

#--------------------------------------------------#
# modules
#--------------------------------------------------#
if(-not (Get-PSSnapin "Microsoft.SharePoint.PowerShell" -ErrorAction SilentlyContinue)){Add-PSSnapin "Microsoft.SharePoint.PowerShell"}
Import-Module ActiveDirectory
#--------------------------------------------------#
# main
#--------------------------------------------------#
# get spweb object
$SPWeb = Get-SPweb $(Get-SPUrl $Identity).Url
# get spsite object
$SPSite = $SPWeb.Site
# get root web object
$SPRootWeb = $SPSite.RootWeb
# get role definition by id
$SPRole = $SPWeb.RoleDefinitions | where{$_.Name -eq $Role -or $_.ID -eq $Role}
# get adgroup format domain\name
$ADGroup = "$((Get-ADDomain).Name)" + "`\" + $(Get-ADGroup $ADGroup).Name
# create a new role assignment object
$SPGroup = $SPRootWeb.EnsureUser($ADGroup)
# abort if group doesn't exist
if($SPGroup -eq $Null)
{
     throw "Group not found!"
}
else
{  
     group found so print to .csv or screen!
}

https://github.com/janikvonrotz/PowerShell-PowerUp/blob/master/functions/SharePoint/Set-SPADGroupPermission.ps1#L105

| improve this answer | |
  • Thanks a lot...:) I am not much familiar with PS..so I will try this.. and will let you know :) – Rajeev K Jan 9 '15 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.