I have a set of nested AD groups:


I'm using "group" to grant access to a server. Now I want to know why my "userXY" has access to the server. How can I use powershell to find out that the user is member of "subsubgroup2a"?

  • If group is granted access to a server. userXY is a member of subsubgroup2a, which is a member of subgroup2, which is a member of group, which you granted access to your server. "Now I want to know why my "userXY" has access to the server." You gave him access.
    – Nixphoe
    Oct 20 '15 at 16:39
  • There are many scripts online readily for this. Just make sure it covers cross domain membership scenarios if you have multiple domains or external trust. -Very few script takes that into consideration
    – strongline
    Oct 20 '15 at 20:04

Update: Technically if you don't mind building a bulky function,

    function GetGroups ($object)
    Get-ADPrincipalGroupMembership $object | ForEach `
        Get-ADPrincipalGroupMembership $_

Then you can run:

GetGroups username | select name -Unique

I've used that one in the past. Takes a while too. Or

Here's a prebuilt script to find nested group data: https://gallery.technet.microsoft.com/scriptcenter/Get-nested-group-15f725f2

Update 2: Admin friend uses this script. It does list all sec groups but still does work and you can dump to CSV for easy nav: http://practical-admin.com/blog/powershell-recursively-show-user-membership-in-an-active-directory-group/

  • The first one only tells if the user is in any subgroup nested into my top group. The second one only lists all users in the group and subgroups. That's not exactly what I'm looking for but I'll try if I can use this.
    – jlai
    Oct 20 '15 at 18:04

If your DC publishing ADWS is 2012 or later, you have the latest RSAT, and at least Powershell v4 you can do this:

$Filter = "Name -eq TestUser"
$User = Get-ADUser -filter $Filter -Properties memberof | select memberof

We use the following function to retrieve the recursive AD Group Memberships:

Function Get-GroupMembershipRecurse {

$memberships = @()
    $obj = Get-ADObject -Identity $DistinguishedName -Properties SamAccountName,MemberOf
} catch {
    Write-Warning "Error while retrieving object details for $DistinguishedName"
    return [string[]]$memberships
if ($obj.ObjectClass -eq "group") {
    Write-Verbose "$($obj.name) is of ObjectClass Group. Adding to list of memberships."
    $memberships += $obj

$obj.MemberOf | Sort-Object | %{
    # prevent a loop if the group is a member of itself
    if ( $_ -ne $obj.DistinguishedName ) {
        $recursiveMembers = Get-GroupMembershipRecurse $_

        # Add all retrieved memberOf entries to the membership list
        $recursiveMembers | %{
            $memberships += $_

return [string[]]$memberships

Above function will return all groups an object (in your case a user account) is member of, direct or indirect.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.