Check if user is member of AD group via BATCH

von

A common requirement in logon scripts is to detect whether the current user is a member of a specific Active Directory group and then trigger a matching action. When third-party tools are not allowed, a pure batch solution can still do the job by using only built-in Windows commands.

In this example, the script checks whether the logged-on user is a member of the AD group Mobile. If the user is in the group, the script executes one action; if not, it follows a default path.

How the check works

The solution uses net user together with find. The net user %username% /DOMAIN command queries the domain account of the current user and returns group membership information. The output is then piped into find, which searches for the group name.

If find finds the text Mobil, it returns a successful exit code, and the script jumps to the MOBIL label. If the text is not found, the script continues with the default branch.

Script example

@echo off
net user %username% /DOMAIN |find "Mobil"
if not errorlevel = 1 (GOTO MOBIL)
 
:DEFAULT
echo USer is not member of the group "Mobil"
goto END
 
:MOBIL
echo User is member of the group "Mobil"
 
:END

What the script does

The logic is straightforward:

  • net user %username% /DOMAIN queries the user account in the domain.
  • find "Mobil" searches the output for the group name.
  • errorlevel determines whether the string was found.
  • goto MOBIL or goto DEFAULT controls the script flow.

This makes the script suitable for a simple logon-time check where a specific group membership should trigger a different behavior.

Practical use cases

Instead of echo, the script can start an application, set an environment-specific action, or launch another command. That makes it useful for role-based logon behavior without needing PowerShell or external utilities.

Examples include:

  • starting a mapped drive or application only for certain users.
  • showing a custom message for a specific group.
  • launching a special tool for mobile users, helpdesk users, or administrators.

Technical notes

The group name in the search must match the text that appears in the net user output. If the group name is longer or contains special characters, the search string may need to be adjusted.

It is also worth noting that this method is simple, but not the most robust way to query group membership. It works best in environments where a lightweight batch-only solution is sufficient and the group list is stable.

Conclusion

Using net user and find is a practical batch-only way to check whether a user belongs to an AD group during logon. It keeps the script self-contained, avoids third-party dependencies, and allows different actions based on group membership.

For basic conditional logon logic, this approach is simple and effective.

Schreibe einen Kommentar