Getting SID from win32_groupuser

Question

I am trying to get the SIDs of users and groups by querying

get-wmiobject -query 'select groupcomponent,partcomponent from win32_groupuser`

output:

__GENUS          : 2
__CLASS          : Win32_GroupUser
__SUPERCLASS     :
__DYNASTY        :
__RELPATH        : Win32_GroupUser.GroupComponent="\\\\COMPUTER\\root\\cimv2:Win32_Group.Domain=\"TESTDOMAIN\",Name=\
                   "Schema Admins\"",PartComponent="\\\\COMPUTER\\root\\cimv2:Win32_UserAccount.Domain=\"TESTDOMAIN\"
                   ,Name=\"Administrator\""
__PROPERTY_COUNT : 2
__DERIVATION     : {}
__SERVER         :
__NAMESPACE      :
__PATH           :
GroupComponent   : \\COMPUTER\root\cimv2:Win32_Group.Domain="TESTDOMAIN",Name="Schema Admins"
PartComponent    : \\COMPUTER\root\cimv2:Win32_UserAccount.Domain="TESTDOMAIN",Name="Administrator"

groupcomponent is a win32_group (https://msdn.microsoft.com/en-us/library/windows/desktop/aa394153%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396).

win32_group is contains an SID (https://msdn.microsoft.com/en-us/library/windows/desktop/aa394151%28v=vs.85%29.aspx#)

However the groupcomponent here is a string and not a win32_group as

get-wmiobject -query 'select groupcomponent.sid from win32_groupuser'

is an invalid query. How can I access groupcomponent's members as a win32_group?

Answer 1

The PartComponent Property contains the SID. Access it by iterating through all objects via WMI:

gwmi win32_groupuser | % { [wmi]$_.partcomponent }

or use

gwmi win32_groupuser | % { [wmi]$_.partcomponent | select SID } 

to only receive the SID.