Suppose I have the user id of a user in Active Directory. I'd like to get a list of all AD groups in which that user is currently a member of. How can I do this from the Windows command line?

I've tried the following:

dsget user "DC=jxd123" -memberof


dsquery failed:'-memberof' is an unknown parameter.
type dsquery /? for help.
  • 3
    You certainly won't get an error for dsquery when you execute dsget. Copy&Paste fail?
    – mfinni
    Aug 19, 2013 at 18:57
  • FYI, found the same question on StackOverflow with a couple more answers.
    – Nic
    Aug 20, 2013 at 7:42
  • 1
    I don't have enough reputation to answer, but assuming you are using powershell, you can write this: Get-ADPrincipalGroupMembership username | select name
    – A P
    Sep 10, 2019 at 7:29
  • See also: stackoverflow.com/questions/5072996/…
    – Ben Creasy
    Apr 25, 2023 at 6:05

15 Answers 15


You can do this in PowerShell pretty easily. I'm sure you can do it with the ds tools too, but they're old and crusty and PowerShell should be used for everything possible nowadays.

Import-Module ActiveDirectory
(Get-ADUser userName –Properties MemberOf | Select-Object MemberOf).MemberOf

Shorter version

(Get-ADUser userName –Properties MemberOf).MemberOf
  • I downloaded Powershell, and now have a *.msu file. How do I install it using the *.msu file? Aug 19, 2013 at 18:51
  • What operating system are you on? PowerShell is built into anything newer than XP and is available to XP as an optional Windows Update.
    – MDMarra
    Aug 19, 2013 at 18:53
  • Windows XP .. My company is slow :-\ Aug 19, 2013 at 18:57
  • 1
    Thanks for the info! I work for a hospital, so we have hundreds of thousands of workstations. They are upgrading to Windows 7 next April. I don't have any control over hot fixes unfortunately. It's done via some Novell scripts. I just work in research. Aug 19, 2013 at 19:18
  • 2
    Get-ADPrincipalGroupMembership is another way to do this in PowerShell.
    – Nic
    Aug 20, 2013 at 7:43

Or with the net user command...

net user /domain username
  • 4
    I love the simplicity that some of the "old" DOS commands offer. And, they've always been there so even if you don't have PoSH loaded on an old machine, DOS comes to the rescue! Thanks for posting this.
    – Jeff Moden
    Nov 4, 2014 at 21:06
  • 5
    This will only return explicit, but not implicit group memberships. Nov 5, 2014 at 22:45
  • 19
    Slick command, BUT, the groups names in the output are truncated to 21 characters... :-(
    – t0r0X
    Mar 16, 2015 at 13:37
  • 1
    Yes, there are limitations. Nested group memberships are not shown and you are right, the output is truncated. Admittedly, I had not considered the latter.
    – Jack
    Jun 23, 2015 at 0:18
  • Worked great but why would it be truncated? Is there a config/parameter that can be added for full group name?
    – ThinkCode
    Aug 17, 2016 at 14:44

Single line, no modules necessary, uses current logged user $($env:username), runs from other windows machines:

(New-Object System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$($env:username)))")).FindOne().GetDirectoryEntry().memberOf

Qudos to this vbs/powershell article: http://technet.microsoft.com/en-us/library/ff730963.aspx

  • 7
    Very good solution, the only one which worked for me without installing any additional softwar! Thanks!
    – t0r0X
    Mar 16, 2015 at 13:46
  • 7
    +1 for working on a restricted system without any additional software!
    – Saustrup
    Aug 11, 2016 at 7:50
  • 4
    Another +1 here for both working on a restricted system and having better output than net.exe. Thanks a bunch! Feb 22, 2021 at 21:38
  • 1
    Thanks a lot! This is just perfect solution indeed. It gets non-truncated group names and works with limited permissions. For quick ad hoc view I use net group <name> /domain. But when full group names are critical this PS snippet is a life-saver. Feb 10, 2023 at 10:39
  • Perfect Solution
    – Shemeer BK
    Oct 16, 2023 at 8:12

If you need to see your own groups, there's whoami /groups:

Displays the user groups to which the current user belongs.

The advantage of this command over net user /domain username is that implicit group memberships are also displayed with whoami.

  • 5
    Best solution. Upvoted. Short and sweet. Doesn't truncate. Personally I like best the LIST format, i.e. whoami /groups /fo list, because it is the easiest to read with the eye.
    – peterh
    Feb 17, 2017 at 14:15
  • 1
    Best answer here especially on corporate systems where utilities are severely limitied.
    – Carlos
    Nov 30, 2021 at 0:26
  • Only works for current use though
    – MikeKulls
    Nov 8, 2022 at 4:12
  • @peterh The default format is better when you search for something, as in whoami /groups | findstr LICENSE Sep 14, 2023 at 7:05

Found a good resource:


Here's how to do it from Windows command prompt:

dsquery user -samid jxd123 | dsget user -memberof | dsget group -samid


Get-ADPrincipalGroupMembership -Identity jdoe | Format-Table -Property name

Another approach: a PowerShell script that lists all implicit group memberships from the Windows account token. Works on a restricted system.

$token = [System.Security.Principal.WindowsIdentity]::GetCurrent() 
ForEach($group in $token.Groups){
dsquery user -samid "user id" | dsget user -memberof > userid_memberof.txt
  • Add the -expand parameter to include indirect group memberships Aug 9, 2022 at 4:02
$ADUser = Read-Host "Provide the AD User account"
Get-ADPrincipalGroupMembership -Identity $ADUser | Sort-Object name | Format-Table -Expand name

adfind is another great tool for this sort of thing. It is a free tool from MVP Joe Richards


You can use one of the shortucts

adfind -sc u:username memberof

This PowerShell version returns just the AD group names, rather than the DN of the group. The 'select-object' output can easily be piped to a CSV or test file.

(Get-ADUser ExampleUser –Properties MemberOf).memberof | Get-ADGroup | Select-Object name


Powershell, gives a nice and clean output.

(get-aduser USER -Properties MemberOf | select MemberOf).MemberOf | % {$_.split(",")[0].replace("CN=","")}

Try this:

gpresult -V /user blah
  • I use gpresult and find it simple and effective. I don't know why this is downvoted.
    – Andrew E
    Jul 13, 2022 at 5:54

Here's a solution searching all domains under the given domain (assuming proper permission for each domain):

# provide the logon name here:

foreach ( $d in (Get-ADForest example.net).domains ) { Write-Output "Looking up $user in domain $d"; $allGroups += Get-ADPrincipalGroupMembership $user -ResourceContextServer $d }

$allGroups | ft name,GroupScope,distinguishedName -AutoSize

Using Get-ADPrincipalGroupMembership


Try adquery (if you're on Linux/RHEL)

#To find All AD groups a user "XXXX" is a part of:

adquery user -a XXXX  

Conversely, to find all users an Active Directory group "ABCD" has:

adquery group -a ABCD  

You can pipe with grep to refine further.

These commands can be run when you are logged on as a standard user without elevated privileges.

For windows operating system, Jack's answer is relevant.

More info here: https://docs.centrify.com/Content/auth-unix-user/CommandLineUsers.htm

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .