Adding a column to destinguish between user and group

Question

The Following script generate a breakdown of access and inheritance (true.false)
I want to modify the script to add a column representing whether the access level is a user or a group?

$AllFolders = Get-ChildItem -Directory -Path "R:\" -Recurse -Force

$Results = @()
Foreach ($Folder in $AllFolders) {
$Acl = Get-Acl -Path $Folder.FullName
foreach ($Access in $acl.Access) {
if ($Access.IdentityReference -notlike "BUILTIN\Administrators" -and $Access.IdentityReference -notlike "domain\Domain Admins" -and $Access.IdentityReference -notlike "CREATOR OWNER" -and $access.IdentityReference -notlike "NT AUTHORITY\SYSTEM") {
$Access.IdentityReference
$Properties = [ordered]@{'FolderName'=$Folder.FullName;'AD Group'=$Access.IdentityReference; 'NameIs'=$Access.Name; 'Permissions'=$Access.FileSystemRights;'Inherited'=$Access.IsInherited}
$Results += New-Object -TypeName PSObject -Property $Properties
}
}
}

$Results | Export-Csv -path "C:\Temp\ACL-Report.csv"

Answer 1

Assuming the IdentityReference property refers only to Active Directory object, use Get-ADObject to retrieve the object and use either objectClass or objectCategory to determine what they are. You may want to use both, though. There are objects in the AD (like a computer account) that have an objectClass of "User" and an objectCategory of "Computer". If you need that level of distinction, it'd probably be better to report them both to avoid surprises.

If, on the other hand, you have LOCAL users in the ACL then if you fail to find the object in the AD you have to use Get-LocalUser and Get-LocalGroup in addition to Get-ADObject to report the type.