How to get ALL AD user groups (recursively) with Powershell or other tools?

powershell active-directory active-directory-group
esserafael picture esserafael · May 8, 2014 · Viewed 17.5k times · Source

I'm trying to get ALL the groups a user is member, even the nested ones (recusively), in Powershell I'm using:

(Get-ADUser <username> -Properties MemberOf | Select-Object MemberOf).MemberOf

But it only returns the groups the user is a "direct" member, like you get when using the AD users console. I single list of ALL the groups is very helpful, like the output from "gpresult -r", where it shows ALL the groups the user is a member.

Is there a way to get it from any AD user? (Doesnt need to be exclusively in Powershell, maybe theres another tool that I dont know yet)

Answer

Joseph Alcorn picture Joseph Alcorn · May 8, 2014

You can use the LDAP_MATCHING_RULE_IN_CHAIN:

Get-ADGroup -LDAPFilter "(member:1.2.840.113556.1.4.1941:=CN=User,CN=USers,DC=x)"

You can use it anywahere that you can use an LDAP filter.

Example:

$username = 'myUsername'
$dn = (Get-ADUser $username).DistinguishedName
Get-ADGroup -LDAPFilter ("(member:1.2.840.113556.1.4.1941:={0})" -f $dn) | select -expand Name | sort Name

Related questions

Is there a way to check AD group membership for a computer?

I am trying to check computer group membership through Powershell. I want to be able to specify a certain computer name and find which groups that computer is in but from a Powershell script. I am planning on running the …

Read More
Add multiple users to multiple groups from one import csv

I have a csv with 2 columns, one column is AD group names and one is user account names. I am trying to read the csv and import the users into their corresponding group. Here is what i have to so …

Read More
Listing users in ad group recursively with powershell script without CmdLets

I'm trying to list everyone in a security group in an active directory without using CmdLets in PowerShell. The weird thing with my script is that it works if I list the entire directory but if I try and specify …

Read More