# collects all users of the local domain and exports their groupmember count and estimated tokensize

$root = [system.directoryservices.activedirectory.forest]::getcurrentforest().rootdomain.name
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]"GC://$root")
$objSearcher.PageSize = 1000
$objSearcher.Filter = "(&(objectclass=user))"

$colResults = $objSearcher.FindAll()

$psoresult = New-Object PSObject
$psoresult | Add-Member NoteProperty "path" ""
$psoresult | Add-Member NoteProperty "groupcount" 0
$psoresult | Add-Member NoteProperty "tokensize" 0

foreach ($objResult in $colResults) {
	Write-Host "Processing" $objResult.path
	$UserAccount = [ADSI]$objResult.path
	[int]$domainstart = $UserAccount.Path.ToLower().IndexOf(",dc=")
	[string]$userdomain = $UserAccount.Path.Substring($domainstart+1)
	$UserAccount.GetInfoEx(@("tokengroups"),0) | Out-Null
	$groups = $UserAccount.Get("tokengroups")
	Write-Host "Total Groups " $groups.Count

	[int]$tokensize = 1200;
	foreach($group in $groups) {
		$strSID = [System.BitConverter]::ToString($group).replace("-","")
		$grp = [ADSI]"LDAP://<SID=$strSID>"
		Write-Host "Group: " $grp.SAMAccountName
		[int]$domainstart = $grp.distinguishedName.tostring().ToLower().IndexOf(",dc=")
		[string]$groupdomain = $grp.distinguishedName.tostring().Substring($domainstart+1)

		if ($grp.groupType.psbase.value -band 0x80000000){	
			Write-Host " Securitygroup" -NoNewline

			if ($grp.groupType.psbase.value -band 1){
				Write-Host " BuildIn" -NoNewline
				$tokensize = $tokensize + 40
			}
			if ($grp.groupType.psbase.value -band 2){
				Write-Host " Global" -NoNewline
				$tokensize = $tokensize + 8
			}
			if ($grp.groupType.psbase.value -band 4){
				Write-Host " Local" -NoNewline
				$tokensize = $tokensize + 40
			}
			if ($grp.groupType.psbase.value -band 8){	
				Write-Host " Universal" -NoNewline
				if ($userdomain -eq $groupdomain) {
					Write-Host " SameDomain" -NoNewline
					$tokensize = $tokensize + 8
				}
				else {
					$tokensize = $tokensize + 40
				}
				
			}
		}
		else {	
			Write-Host " Distributiongroup" -NoNewline
		}

		Write-Host " Ende"
	}	

	$psoresult.path = $UserAccount.distinguishedName.tostring()
	$psoresult.groupcount = $groups.Count
	$psoresult.tokensize = $tokensize;
	$psoresult
}