https://evotec.xyz/de/tags/nested-groups/index.atom.xml2022-08-07T11:57:28.0000000ZEvotec Main Websitehttps://evotec.xyz/de/blog/reporting-group-membership-for-critical-active-directory-groups2022-08-07T11:57:28.0000000Z

I work a lot with Active Directory-related tasks. One of the tasks is to know the group membership of critical Active Directory Groups such as Domain Admins, Enterprise Admins, Schema Admins, Event Log Readers, and a few others that are a bit less known. As I did it, I got bored of typing the group names repeatedly and decided that enough was enough and there must be an easier way for me to do that.

https://evotec.xyz/de/blog/visually-display-active-directory-nested-group-membership-using-powershell2020-09-02T16:06:48.0000000Z

In the Active Directory PowerShell module, you have two commands to your disposal that help display group membership. Those are Get-ADGroup and Get-ADGroupMember. The first command contains property Members, which gives you DistinguishedName of all members, and Get-ADGroupMember can provide you either direct members or with Recursive switch all members recursively (skipping groups). Till a few weeks ago, I was a happy user of those commands until I noticed two things. Member property for Get-ADGroup sometimes misses elements for whatever reason.