CODEWITHSUNDEEP
powershell
0xShin
0xShin

Reputation: 1

How do you get to compare the output of whoami /groups to check whether a certain value is present in powershell?

I would like to ask a little bit of assitance with my code, what I am trying to do is check if a certain group SID value is present to the user running the file. I have tried the one below but the if statement part doesn't work. Any help would be really appreciated.

function IsPartAdmin {
    if ((whoami /groups) -like "S-1-5-32-544") {
        Write-Host "User is part of the admin group"
    }else{
        Write-Host "User is not part of the admin group"
    }

}

Upvotes: 0

Views: 2240

Answers (1)

Doug Maurer
Doug Maurer

Reputation: 8868

As the legend, Lee Daily, commented.. why whoami vs other options? However, to help answer your specific question, we need to address a couple of things.

First, the output of whoami /groups is just a mess of text. If this was our only option, you'd need to do some text parsing, possibly regex matching, etc. Luckily there is a parameter to control the output format. Thus we will change the command to

whoami /groups /FO csv

Now we can do stuff easily with that output in powershell.

whoami /groups /FO csv | convertfrom-csv

You'll see well formed objects with properties, one is the SID of the groups. Now we can use one of many operators to find what we are looking for. I chose to use -contains

function IsPartAdmin {
    if ((whoami /groups /FO csv | convertfrom-csv).sid -contains "S-1-5-32-544") {
        Write-Host "User is part of the admin group"
    }else{
        Write-Host "User is not part of the admin group"
    }
}

-eq and -match would work the same as -contains in the previous example. You could also flip it like this with -in

function IsPartAdmin {
    if ("S-1-5-32-544" -in (whoami /groups /FO csv | convertfrom-csv).sid) {
        Write-Host "User is part of the admin group"
    }else{
        Write-Host "User is not part of the admin group"
    }
}

Upvotes: 1

Related Questions