Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to be able to see a nice picture of nested groups in AD. Are there any products that do that for me?

share|improve this question
Do you mean the actual ACLs on AD Objects, or AD Security Group permissions assigned to something like a file share? – MDMarra Oct 19 '11 at 22:16
I was thinking AD Security Group permissions assigned to a file share but both would be nice :) – blsub6 Oct 19 '11 at 22:20

I created a HTA script which displays the nested groups in a GUI. I hope this helps.


You can download it at:

share|improve this answer

I am not sure if this is what you are looking for, but my application SetACL Studio has a very nice user interface and is designed to replace the built-in Windows ACL Editor.

It displays permissions on files and folders, registry keys, network shares, printers, services and WMI objects. Changing permissions and ownership is easily possible, too, of course.

share|improve this answer

If you are on a windows machine, you can use the dsget group command with -members -expand to expand the groups with membership via nesting. I'm not sure if this is what you want, but I hope it helps in some way, if you have not already found a more elegant solution. As a warning, this code is off the top of my head, as I no longer have access to a Windows machine:

$all_members = []
$nested_groups = []

dsquery group -limit 0 | ?{$_ -imatch "cn=$your_groupname,"} | dsget group -members -expand | % {
    # these are all the members of the group, including those groups with
    # membership via nesting

    # you could omit the users by extracting the group name from $_
    # and testing that they are a group

    $possible_group = $_

    if ( $possible_group -imatch "cn=([^,]+)," ) {
        $possible_group_name = $matches[1]
        $all_members += $possible_group_name

        # this condition may or may not work.  if not, get sample output
        # from calling dsquery group on a user and use that as the condition
        # instead

        if ( dsquery group -name $possible_group_name -ne $null ) {

            # alternatively, you could make each member of $nested_groups
            # an array, make this a function, and recursively collect
            # the entire nesting of this and all sub-groups

            $nested_groups += $possible_group_name

write-host "groups in $your_groupname, via nesting"

$nested_groups | % {
    write-host "`t$_"

Write-host "groups and users in $your_groupname, via nesting"

$all_members |  % {
    write-host "`t$_" 

I hope the code works for you, and if not, there is probably a small typo from bad memory on my part.

Good luck! :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.