Home » PowerShell » Get AdGroup Managed by User in Active Directory

Get AdGroup Managed by User in Active Directory

PowerShell Get-AdGroup get one or multiple active directory groups based on search criteria. Get-AdGroup gets information of ad group name, description, adgroup managed by user, members in the group and many more.

In this article, I will explain how to get-adgroup managed by user and adgroup properties.

Active directory group has ManagedBy property which provides information ad group managed by users or group. In the below SalesLeader ad group, ManagedBy tab in AD group properties dialog display ad user name ( Tom Smith who managed this group)

Ad-Group Managed by User
Ad-Group Managed by User

Let’s find all ad groups managed by user with an example using Get-ADGroup cmdlet in PowerShell.

Get-AdGroup Managed by User

Let’s get adgroup managed by user using PowerShell Get-ADGroup cmdlet.

 Get-ADGroup -LDAPFilter "(ManagedBy=$((Get-ADuser -Identity Toms).distinguishedname))"

In the above PowerShell script, Get-ADGroup cmdlet in active directory uses LDAPFilter parameter to find all groups managed by aduser Toms specified in Get-AdUser Identity parameter.

Above commands get all ad groups managed by user Toms, output of above script as below

Find all groups managed by user
Find all groups managed by user

Find all groups managed by user in OU

In the above, we find all groups managed by user in entire active directory, however in large organization it has active directory structure like domain, trees, forest and ad objects are configured within it.

If you want to find all groups managed by user in specific OU ( organizational unit), run below command

 Get-ADGroup -LDAPFilter "(ManagedBy=$((Get-ADuser -Identity Toms).distinguishedname))" -SearchBase "OU=SALES,DC=SHELLPRO,DC=LOCAL"

In the above PowerShell script, Get-AdGroup uses LDAPFilter parameter to find all ad groups managed by user specified by Get-ADUser Identity parameter in OU specified by Get-ADGroup SearchBase parameter.

It retrieves all the groups managed by user and output as below

PS C:\Windows\system32> Get-ADGroup -LDAPFilter "(ManagedBy=$((Get-ADuser -Identity Toms).distinguishedname))" -SearchBase "OU=SALES,DC=SHELLPRO,DC=LOCAL"


DistinguishedName : CN=SALESLeader,OU=SALES,DC=SHELLPRO,DC=LOCAL
GroupCategory     : Security
GroupScope        : Global
Name              : SALESLeader
ObjectClass       : group
ObjectGUID        : 5735e7da-2b27-44cb-a91d-96d648eaa8fc
SamAccountName    : SALESLeader
SID               : S-1-5-21-1326752099-4012446882-462961959-3105

Conclusion

In the above article on get-adgroup managed by user, we learned how to find all group managed by user in active directory or specific OU using Get-ADGroup and Get-ADUser cmdlet in PowerShell.

Get-ADGroup cmdlet in active directory get ad group properties and Get-AdUser get user properties. Using Get-ADGroup LDAPFilter parameter, it finds all groups in active directory.

You can find more topics about PowerShell Active Directory commands and PowerShell basics on ShellGeek home page.

Leave a Comment