Get AD Group Members Recursively

Many of us use PowerShell Active Directory Module and have been stumbled upon this issue as this module does not have option to get indirect membership.

I have utilized Quest Active Directory module a lot and that has nice option to get nested group membership with -indirect parameter.

Get-QADGroupMember -Identity “Test Nested Group members” -Indirect

How to achieve the same behavior with inbuilt Active Directory module without relying on Third-party?

You can use Get-ADGroupMember -Identity “Test Nested Group” but it will not extract the members recursively.

 

I have written a function to extract the members recursively from any group that has nested groups.

Get-ADGroupMembersRecursive -Groups “Test Nested Group”

 

You can even extract different properties apart from default by using below example cmdlet

Get-ADGroupMembersRecursive -Groups “Test Nested Group” -Properties employeeid

You can also extract members from multiple groups recursively at the same time.

Get-ADGroupMembersRecursive -Groups “Test Nested Group1″ ,”Test Nested Group2”

I have updated this function in the new version of vsadmin module

Here is the function code:

Function Get-ADGroupMembersRecursive{
Param(
[Parameter(Mandatory = $true,ValueFromPipeline=$true)]
[ValidateNotNullOrEmpty()]
[String[]]$Groups,
[ValidateNotNullOrEmpty()]
[String[]]$Properties
)
Begin{
$Results = @()
[String[]]$defaultproperties = "distinguishedName","name","objectClass","objectGUID","SamAccountName","SID"
$Properties+=$defaultproperties
$Properties = $Properties | Sort-Object -Unique
}
Process{
ForEach($adobj in $Groups){
$getgroupdn = (Get-ADGroup -identity $adobj).DistinguishedName
$findallgroups = Get-ADGroup -identity $getgroupdn -Properties members| Select-Object -ExpandProperty members | get-adobject | Where-Object{$_.objectClass -eq "Group"} |Select DistinguishedName
$Results+=$getgroupdn
ForEach($Object in $findallgroups){
Get-ADGroupMembersRecursive $Object.DistinguishedName -Properties $Properties
}
}
}
End{
$Results = $Results | Select-Object -Unique
$collgroupmembers=@()
foreach($item in $Results){
$arrgroupmembers =@()
$arrgroupmembers = Get-ADGroup -id $item -Properties members | Select-Object -ExpandProperty members |get-adobject | Where-Object{$_.objectClass -eq "user"} | Get-ADUser -properties $Properties | Select-Object $Properties
$collgroupmembers+=$arrgroupmembers
}
$collgroupmembers
}
} #Get-ADGroupMembersRecursive


 

Thanks for reading and utilizing it..

Tech Wizard

https://techwizard.cloud

https://syscloudpro.com/

PowerShell Cheat Book

One thought on “Get AD Group Members Recursively

  1. Pingback: PowerShell System Admin Module | Tech Wizard

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s