< Back
Get-ADPrincipalDetails
Post
NAME Get-ADPrincipalDetails
SYNOPSIS
Gets details about a specific AD principal.
SYNTAX
Get-ADPrincipalDetails [-Identity] <String> [[-Domain] <String>] [-Credential <PSCredential>] [<CommonParameters>]
DESCRIPTION
Gets information about an AD principal to include the principals DistinguishedName, whether it has Domain or
Enterprise admin rights, and its complete group membership.
This cmdlet is used by the Test-IsDomainAdmin, Test-IsEnterpriseAdmin, and
Test-IsEnterpriseOrDomainAdmin, but could be useful for other purposes.
Domain controllers are reported as having Domain Admin privileges.
PARAMETERS
-Identity <String>
The identity of the AD principal to gather details on. This is a string that is matched against AD object
properties:
-Name
-SamAccountName
-CN
-DistinguishedName
-Display Name
-ObjectSID
-ObjectGUID
For user objects, the identity can be provided as a User Principal Name (UPN) or domain\\username format. In
these cases, the domain will be extracted
from the identity and does not need to be specified.
If this parameter is not specified, the current windows identity principal is utilized, which could be a user
or system account, which is translated to the corresponding
computer object.
Required? true
Position? 1
Default value [System.String]::Empty
Accept pipeline input? true (ByValue)
Accept wildcard characters? false
-Domain <String>
Optionally indicates the domain the object exists in. If this parameter is not specified, the domain of the
local user or computer is used, depending on what is specified for
the Identity parameter. If the identity parameter is specified, the current user domain is used. If the
identity parameter is not specified, and the current windows identity is
the system account, the local computer domain is used, otherwise the current user domain is used.
If the Identity parameter is specified with a domain\\username or UPN value, this parameter is ignored.
Required? false
Position? 2
Default value [System.String]::Empty
Accept pipeline input? false
Accept wildcard characters? false
-Credential <PSCredential>
Specifies a user account that has permission to perform this action. The default is the current user.
Type a user name, such as "User01" or "Domain01\\User01", or enter a PSCredential object, such as one generated
by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password.
Required? false
Position? named
Default value [System.Management.Automation.PSCredential]::Empty
Accept pipeline input? false
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
System.String
OUTPUTS
System.Management.Automation.PSCustomObject
NOTES
AUTHOR: Michael Haken
LAST UPDATE: 1/7/2017
-------------------------- EXAMPLE 1 --------------------------
PS C:\\>Get-ADPrincipalDetails -Identity "Domain Admins" -Domain contoso
Gets information about the Domain Admin group
RELATED LINKS
SYNOPSIS
Gets details about a specific AD principal.
SYNTAX
Get-ADPrincipalDetails [-Identity] <String> [[-Domain] <String>] [-Credential <PSCredential>] [<CommonParameters>]
DESCRIPTION
Gets information about an AD principal to include the principals DistinguishedName, whether it has Domain or
Enterprise admin rights, and its complete group membership.
This cmdlet is used by the Test-IsDomainAdmin, Test-IsEnterpriseAdmin, and
Test-IsEnterpriseOrDomainAdmin, but could be useful for other purposes.
Domain controllers are reported as having Domain Admin privileges.
PARAMETERS
-Identity <String>
The identity of the AD principal to gather details on. This is a string that is matched against AD object
properties:
-Name
-SamAccountName
-CN
-DistinguishedName
-Display Name
-ObjectSID
-ObjectGUID
For user objects, the identity can be provided as a User Principal Name (UPN) or domain\\username format. In
these cases, the domain will be extracted
from the identity and does not need to be specified.
If this parameter is not specified, the current windows identity principal is utilized, which could be a user
or system account, which is translated to the corresponding
computer object.
Required? true
Position? 1
Default value [System.String]::Empty
Accept pipeline input? true (ByValue)
Accept wildcard characters? false
-Domain <String>
Optionally indicates the domain the object exists in. If this parameter is not specified, the domain of the
local user or computer is used, depending on what is specified for
the Identity parameter. If the identity parameter is specified, the current user domain is used. If the
identity parameter is not specified, and the current windows identity is
the system account, the local computer domain is used, otherwise the current user domain is used.
If the Identity parameter is specified with a domain\\username or UPN value, this parameter is ignored.
Required? false
Position? 2
Default value [System.String]::Empty
Accept pipeline input? false
Accept wildcard characters? false
-Credential <PSCredential>
Specifies a user account that has permission to perform this action. The default is the current user.
Type a user name, such as "User01" or "Domain01\\User01", or enter a PSCredential object, such as one generated
by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password.
Required? false
Position? named
Default value [System.Management.Automation.PSCredential]::Empty
Accept pipeline input? false
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
System.String
OUTPUTS
System.Management.Automation.PSCustomObject
NOTES
AUTHOR: Michael Haken
LAST UPDATE: 1/7/2017
-------------------------- EXAMPLE 1 --------------------------
PS C:\\>Get-ADPrincipalDetails -Identity "Domain Admins" -Domain contoso
Gets information about the Domain Admin group
RELATED LINKS