Backup User GroupMembership

‘Sup PSHomies,

When implementing or updating a Role Based Access Control (RBAC) model, being able to do a roll back has to be part of your process.

I’ve seen junior admins break out in a sweat when asked to roll back a user’s membership. “Eh… which groups was the user a member of again?”


It’s a rookie mistake… Hehe…

Here’s how to make a JIT backup before you start changing user membership.

Author: I.C.A. Strachan
Version History:
Purpose: Backup User group membership to file on a per user base
$exportFolder = '.\export\dsa\UserMemberOf\backup\',
$Encoding = 'UTF8',
$Delimiter = "`t"
#region Verify folder exists
$LogDate = get-date uformat '%d-%m-%Y'
if(!(test-path "$exportFolder\$logDate")) {
$null = New-Item "$exportFolder\$logDate" ItemType Directory Force
#region Define Hashtables for splatting
$csvParam = @{
Path = ".\source\csv\$csvFile"
Delimiter = $Delimiter
Encoding = $Encoding
$exportParam = @{
Delimiter = $Delimiter
Encoding = $Encoding
NoTypeInformation = $true
#region Main
Import-Csv @csvParam |
Get-ADUser Identity $_.SamAccountName Properties MemberOf |
Select-Object ExpandProperty Memberof |
Get-ADGroup |
Select-Object SamAccountName, DistinguishedName |
Export-Csv @exportParam Path "$exportFolder\$logDate\$($_.SamAccountName).csv"

The csv should have a SamAccountName column.

$csvContent = @'

This will get you all the direct group memberships and save them to a file named SamAccountName.csv, per user.

Next blog I’ll show you how to restore! 😉

Hope it’s worth something to you.




Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s