PowerShell – Get all nested groups for a user in Active Directory

Alex Ø. T. Hansen

20/11/2018

PowerShell – Get all nested groups for a user in Active Directory

Ever needed to get all nested groups a user belongs in Active Directory?

#Get all recursive groups a user belongs.
Function Get-ADUserNestedGroups
{
    Param
    (
        [string]$DistinguishedName,
        [array]$Groups = @()
    )

    #Get the AD object, and get group membership.
    $ADObject = Get-ADObject -Filter "DistinguishedName -eq '$DistinguishedName'" -Properties memberOf, DistinguishedName;
    
    #If object exists.
    If($ADObject)
    {
        #Enummurate through each of the groups.
        Foreach($GroupDistinguishedName in $ADObject.memberOf)
        {
            #Get member of groups from the enummerated group.
            $CurrentGroup = Get-ADObject -Filter "DistinguishedName -eq '$GroupDistinguishedName'" -Properties memberOf, DistinguishedName;
       
            #Check if the group is already in the array.
            If(($Groups | Where-Object {$_.DistinguishedName -eq $GroupDistinguishedName}).Count -eq 0)
            {
                #Add group to array.
                $Groups +=  $CurrentGroup;

                #Get recursive groups.      
                $Groups = Get-ADUserNestedGroups -DistinguishedName $GroupDistinguishedName -Groups $Groups;
            }
        }
    }

    #Return groups.
    Return $Groups;
}
 
#The user to check.
$User = "<SamAccountName/DN/UserPrincipal>";

#Get all groups.
$Groups = Get-ADUserNestedGroups -DistinguishedName (Get-ADUser -Identity $User).DistinguishedName;

#Output all groups.
$Groups | Select-Object Name | Sort-Object -Property Name;

#Get all recursive groups a user belongs.

Function Get-ADUserNestedGroups

{

Param

(

[string]$DistinguishedName,

[array]$Groups = @()

)

#Get the AD object, and get group membership.

$ADObject = Get-ADObject -Filter "DistinguishedName -eq '$DistinguishedName'" -Properties memberOf, DistinguishedName;

#If object exists.

If($ADObject)

{

#Enummurate through each of the groups.

Foreach($GroupDistinguishedName in $ADObject.memberOf)

{

#Get member of groups from the enummerated group.

$CurrentGroup = Get-ADObject -Filter "DistinguishedName -eq '$GroupDistinguishedName'" -Properties memberOf, DistinguishedName;

#Check if the group is already in the array.

If(($Groups | Where-Object {$_.DistinguishedName -eq $GroupDistinguishedName}).Count -eq 0)

{

#Add group to array.

$Groups += $CurrentGroup;

#Get recursive groups.

$Groups = Get-ADUserNestedGroups -DistinguishedName $GroupDistinguishedName -Groups $Groups;

}

#Return groups.

Return $Groups;

}

#The user to check.

$User = "<SamAccountName/DN/UserPrincipal>";

#Get all groups.

$Groups = Get-ADUserNestedGroups -DistinguishedName (Get-ADUser -Identity $User).DistinguishedName;

#Output all groups.

$Groups | Select-Object Name | Sort-Object -Property Name;

About Alex Ø. T. Hansen

Experienced advanced operations engineer with a demonstrated history of working in the information technology and services industry. Skilled in Windows Server, Azure, Ethical Hacking, Office 365, Exchange, Jenkins, SCCM, Octopus Deploy and PowerShell to name a few. Strong engineering professional with a big passion for knowledge.

10 Comments

pavankumar

26/06/2020 at 04:54

Thank you very much. The script really helped me a lot.

criffo

09/09/2020 at 08:54

very nice presentation and good DFS implementation
I encountered the need as well because of RBAC and external trusts.
I developped as well a powershell function but based on a BFS and set parameters to take into account the scope search forest, domain, domain trusts forest trusts or explicit domains. I used the.net classes so no need for the RSAT and activedirectory module. I shared the function on my github for anyone who might have some interest as well
https://github.com/criffo/getADObjectMEmberOfCustom

1. JRCALOVI
  
  26/06/2021 at 23:03
  
  Criffo, your script is wonderful, big thanks
  
Tim Oosterhoff

12/10/2020 at 07:21

What is the need for the line : If($ADObject) ?
Because if the value is $null the foreach loop does not iterate. That is okay.

henrik holm

25/10/2020 at 09:45

you are forgetting the PrimaryGroup – it is not always domain users.

1. Alex Ø. T. Hansen
  
  25/10/2020 at 10:44
  
  Hi Henrik,
  What are you referring to?
  
  1. Garrett Mattingly
    
    18/01/2021 at 17:31
    
    What Henrik is referring to is that the memberof attribute does not contain the Primary Group. Most often this is Domain Users but it cannot be assumed. Compare output from get-adprincipalgroupmembership versus the contents of the memberof attribute and you can see the discrepancy.
    
Perica Veljanovski

27/11/2020 at 01:42

This function doesn’t work for Irish people 🙂
If the DistinguishedName has a ‘ in the person’s name (like O’Reilly) then it will not work.

Gwyn

16/03/2021 at 16:21

I had a similar problem to what Perica describes, but for the names of OUs. Some of our OUs have ‘single quote’ characters in their names. This script does not like them.

Great job otherwise. Thanks.

Tschabo3000

13/04/2021 at 13:42

Thank you for sharing your function, it helped me out!

Pingback: AD Nested User Permissions – ? About Tech

PowerShell – Get all nested groups for a user in Active Directory

10 Comments

Leave a Reply to henrik holm Cancel reply