When permissions do not work as expected, it might be necessary to check what groups a user belongs to. Groups are usually used to make the permissions control simpler. Thus, especially in large environments, it could be necessary to have a list of all the groups the user belongs to.
There's no obvious means to do that. To browse the members of a chosen group, especially y if there are many membersin it, can be quite tedious. Especiallyif there are many groups. What's worse, if your domain works under Windows 2003 or in forest functional level, groups can be nested, thus complicating the task even more.
However, there's a simple way: log in as the user, open a command prompt and type
whoami /groups
That will report all the groups the current user belongs to, including special ones like Everyone.
There's a pitfall, though: if the suer belongs to a distribution group, the output of the above command may be incomplete: whoami doesn't display groups nested within distribution groups. Thus, the practical piece of advice is: do not nest distribution groups within security groups, since that can complicate access rights troubleshooting.
There's no obvious means to do that. To browse the members of a chosen group, especially y if there are many membersin it, can be quite tedious. Especiallyif there are many groups. What's worse, if your domain works under Windows 2003 or in forest functional level, groups can be nested, thus complicating the task even more.
However, there's a simple way: log in as the user, open a command prompt and type
whoami /groups
That will report all the groups the current user belongs to, including special ones like Everyone.
There's a pitfall, though: if the suer belongs to a distribution group, the output of the above command may be incomplete: whoami doesn't display groups nested within distribution groups. Thus, the practical piece of advice is: do not nest distribution groups within security groups, since that can complicate access rights troubleshooting.
