Get-ADGroupMember processing for non domain members - powershell

Question

We have a trusted domain that we administer and users are given acceess to a file server on our domain through groups on the trusted domain added to the local domain group which controls permissions e.g.
For the path "\server\folder\folder" the permissions might look like
MyDomain\FolderXReadWrite
Then within that group a group from the trusted domain would be included
TrustedDomain\FolderXReadWrite
I'd like to write a script to "reverse engineer" this so that I can derive both the local and trusted domain groups that have access from a given folder path and list them - I've got the following:
$path = '\\server\path\path'
$Permissions = (Get-Item -Path $path -ErrorAction Stop | Get-Acl -ErrorAction Stop).Access | Where-Object { $_.IdentityReference -like "MyDomain\*" } | ForEach-Object {
$TrustedDomGroup = Get-ADGroupMember ($_.IdentityReference.Value -split '\\')[1] -Verbose | Where-Object { ($_.DistinguishedName -split 'DC=', 2)[-1] -like "*TrustedDomain*" -and ($_.objectClass -eq 'group') }
If ($TrustedDomGroup) {
[pscustomobject]#{Name=("TrustedDomain\" + $TrustedDomGroup.SamAccountName);Rights=("Member of " + $_.IdentityReference);Domain='PHS'}
}
[pscustomobject]#{Name=$_.IdentityReference;Rights=$_.FileSystemRights;Domain='NSS'}
}
$Permissions | Sort-Object Name -Unique
This produces the output I require, however, the domain group in the above example has LOTS of users therefore processing "Get-ADGroupMember" takes a long time. Does anyone have suggestions for a faster method?

Answer 1

you can try to retrieve all group members with this command:
(Get-ADGroup $ADGroup -Properties members).members
I don't know if it's faster in your environment then Get-AdGroupMember.
A measurement via Measure-Command may give you more information:
Measure-Command, Microsoft Docs

Answer 2

Ok, so the best method to improve the lookup speed seems to be using LDAP so I put together a small function to get Foreign Security Principal group names from a local AD group:
Function List-FSPGroupMembers {
# Use LDAP search to find and resolve Foreign Security Principals from an AD group - faster than native cmdlet
[CmdletBinding()]
Param(
[Parameter(Mandatory=$true,Position=1)][string]$GroupName="",
[Parameter(Mandatory=$true,Position=2)][string]$Domain
)
[regex]$SIDmatch = "S-\d-(?:\d+-){1,14}\d+"
Function fGetADGroupObjectFromName([System.String]$sGroupName,[System.String]$sLDAPSearchRoot) {
$oADRoot = New-Object System.DirectoryServices.DirectoryEntry($sLDAPSearchRoot)
$sSearchStr ="(&(objectCategory=group)(name="+$sGroupName+"))"
$oSearch=New-Object directoryservices.DirectorySearcher($oADRoot,$sSearchStr)
$oFindResult=$oSearch.FindAll()
If($oFindResult.Count -eq 1) {
Return($oFindResult)
}
Else{
Return($false)
}
}
$sSearchRoot="LDAP://" + $Domain + ":3268"
If($oSearchResult=fGetADGroupObjectFromName $groupname $sSearchRoot) {
$oGroup=New-Object System.DirectoryServices.DirectoryEntry($oSearchResult.Path)
$oGroup.Member | Where-Object {($_.ToString()) -match $SIDmatch } | ForEach-Object {
$SID = (Select-String -Pattern $SIDmatch -InputObject $_.ToString()).Matches.Value
Try {
(New-Object System.Security.Principal.SecurityIdentifier($SID)).Translate([System.Security.Principal.NTAccount]).Value
}
Catch {
$_
}
}
}
Else {
Write-Warning ("Group "+$groupname+" not found at "+$domain)
}
}