We use the following function to retrieve the recursive AD Group Memberships:
Function Get-GroupMembershipRecurse {
[CmdletBinding()]
Param(
[Parameter(Mandatory=$true,ValueFromPipelineByPropertyName=$true,Position=0)]
[string]$DistinguishedName
)
$memberships = @()
try{
$obj = Get-ADObject -Identity $DistinguishedName -Properties SamAccountName,MemberOf
} catch {
Write-Warning "Error while retrieving object details for $DistinguishedName"
return [string[]]$memberships
}
if ($obj.ObjectClass -eq "group") {
Write-Verbose "$($obj.name) is of ObjectClass Group. Adding to list of memberships."
$memberships += $obj
}
$obj.MemberOf | Sort-Object | %{
# prevent a loop if the group is a member of itself
if ( $_ -ne $obj.DistinguishedName ) {
$recursiveMembers = Get-GroupMembershipRecurse $_
# Add all retrieved memberOf entries to the membership list
$recursiveMembers | %{
$memberships += $_
}
}
}
return [string[]]$memberships
}
Above function will return all groups an object (in your case a user account) is member of, direct or indirect.