如何用PowerShell快速查询同时属于两个特定AD组的用户？

方法一：使用Compare-Object对比集合 #

通过获取两个组的用户成员，再利用Compare-Object命令筛选出交集：

# 获取两个组的一级用户成员（排除嵌套组）
$group1Users = Get-ADGroupMember -Identity "ADGroup1" | Where-Object { $_.objectClass -eq "user" }
$group2Users = Get-ADGroupMember -Identity "ADGroup2" | Where-Object { $_.objectClass -eq "user" }

# 筛选同时存在于两个组的用户，返回账号名和姓名
Compare-Object -ReferenceObject $group1Users -DifferenceObject $group2Users `
    -Property SamAccountName -IncludeEqual -ExcludeDifferent | 
    Select-Object SamAccountName, Name

如果需要包含嵌套组里的用户，在Get-ADGroupMember后添加-Recursive参数即可。

方法二：利用数组交集判断 #

先提取两个组的用户账号名集合，再筛选出共同存在的账号，可选获取完整用户信息：

# 获取两个组的用户账号名集合（含嵌套组）
$group1Sams = (Get-ADGroupMember -Identity "ADGroup1" -Recursive | Where-Object { $_.objectClass -eq "user" }).SamAccountName
$group2Sams = (Get-ADGroupMember -Identity "ADGroup2" -Recursive | Where-Object { $_.objectClass -eq "user" }).SamAccountName

# 找出共同账号名
$commonSams = $group1Sams | Where-Object { $group2Sams -contains $_ }

# 可选：查询共同账号的完整用户属性
Get-ADUser -Filter { SamAccountName -in $commonSams } | 
    Select-Object SamAccountName, Name, EmailAddress, Enabled

内容的提问来源于stack exchange，提问作者Christopher Cass