View User's Group Memberships

This is an interactive task for auditing the group memberships of an Active Directory user account.

It is a read-only task that doesn't require a privileged account on Active Directory.

Playbook Files

This playbook was built for PPA version 3.3

# The task was built to work with these plugin versions.
plugins:
  ppa: ^11.4
  ppa_tools: ^11.0
  hashicorp_vault: ^8.0
  active_directory: ^13.0


set:
  # This gets a default value in case the user chooses direct memberships only.
  nested_memberships: []


steps:

  - name: Greeting
    actions:

      - ppa.ui.output_markdown:
          doc: >
            {{ globals.icons.active_directory.full }}

            #### Active Directory - View User's Group Memberships


            Use this task to view the direct or complete group memberships of an Active Directory user.


            You will need to:


            - Search for and select the Active Directory user account.

            - Choose whether to get **direct** or **all** group memberships.


            You can export the memberships report CSV file when the table is displayed.


            ___Important___: getting **all** memberships can be slow.

      - ppa.ui.input_accept:
          text: Start

  - name: Get Secrets
    actions:

      - hashicorp_vault.key_value.read_secret_keys:
          secret: active_directory
          keys:
            - name: address
            - name: domain
            - name: username
            - name: password
              sensitive: true
          create_missing: true
          reason: Getting Active Directory details
        save: domain_controller

  - name: Select User Account
    actions:

      - active_directory.users.get_interactive:
          search_attribute: sAMAccountName
        load:
          domain_controller: domain_controller
        save: active_directory_user


  - name: Confirm Membership Type
    actions:

      - ppa.ui.input_confirm:
          text: Show direct memberships, or all memberships?
          confirm: All
          cancel: Direct Only
        save: nested


  - name: Get Direct Memberships
    actions:

      - ppa.ui.output_progress:
          text: Getting direct group memberships for {{ active_directory_user.sAMAccountName }}...
          percent: null
          element_id: get_direct_memberships
        save: direct_memberships

      - active_directory.users.group_memberships:
          nested: false
        load:
          distinguishedName: active_directory_user.distinguishedName
          domain_controller: domain_controller
        save: direct_memberships

      - ppa.ui.output_progress:
          text: Got direct group memberships for {{ active_directory_user.sAMAccountName }}
          percent: 100
          element_id: get_direct_memberships


  - name: Get Nested Memberships
    when: nested
    actions:

      - ppa.ui.output_progress:
          text: Getting nested group memberships for {{ active_directory_user.sAMAccountName }}...
          percent: null
          element_id: get_nested_memberships

      - active_directory.users.group_memberships:
          nested: true
        load:
          distinguishedName: active_directory_user.distinguishedName
          domain_controller: domain_controller
        save: nested_memberships

      - ppa.ui.output_progress:
          text: Got nested group memberships for {{ active_directory_user.sAMAccountName }}
          percent: 100
          element_id: get_nested_memberships


  - name: Exit if No Members
    when: not direct_memberships and not nested_memberships
    actions:

      - ppa.ui.output_info:
          text: User '{{ active_directory_user.sAMAccountName }}' is not in any groups.

      - ppa.ui.input_accept:
          text: OK

      - exit:
          exit_code: 0


  - name: Collate Membership Data
    when: nested
    actions:

      # All groups that don't exist in direct memberships will be nested memberships.
      - ppa_tools.lists.difference:
        load:
          first: nested_memberships
          second: direct_memberships
        save: nested_memberships

      # All groups that don't exist in nested memberships will be direct memberships.
      - ppa_tools.lists.difference:
        load:
          first: direct_memberships
          second: nested_memberships
        save: direct_memberships

      # Create the "Direct Memberships" tab
      - ppa_tools.dictionaries.create:
        load:
          Direct: direct_memberships
          Nested: nested_memberships
        save: tabs


  - name: Display Results
    actions:

      - active_directory.groups.display_tabbed:
          text: Direct & nested group memberships for {{ active_directory_user.sAMAccountName }}
        load:
          tabs: tabs
        when: nested

      - active_directory.groups.display:
          text: Direct group memberships for {{ active_directory_user.sAMAccountName }}
        load:
          groups: direct_memberships
        when: not nested

      - ppa.ui.input_accept:
          text: Done

Running this Playbook

Click download playbook
Import the playbook on the Playbooks page in PPA
Build the playbook from the Edit & Build tab
Run the playbook from the Preview & Deploy tab

Integrations

PPA User Interface
Hashicorp Vault Key-Value engine
Active Directory Users & Groups

Required Vault Details

Active Directory

IP/DNS address of a Domain Controller
Domain FQDN
Username
Password

As this is a read-only task, the Active Directory credentials do not require write permissions.

Vault Configuration Wizard

The first time you run a task built from this playbook, PPA will check the required Vault details exist.

If they don't exist, PPA will ask you to supply the details at the start of the task.

Below you can see a user providing details the first time they run an Active Directory task.

vault-config-wizard

Once the details are added to Vault, the task won't ask for them again.

If you don't know the required details, ask an administrator to run the task or configure Vault manually.

What the Task Does

Once started, this task allows the operator to:

Search for and select an Active Directory user account
Choose whether to audit direct or all security group memberships
View & download the resultant group membership table

See our other playbooks

Get PPA for free!

Start automating your estate with a free 30 day trial today. No signup required!

Get PPA Express

Documentation

Installation Guide
See how easy it is to get started with our installation guide
Playbooks
View our task writing reference guide
Plugins
See how to integrate with different systems using our plugins reference guide.