Nested groups in Active Directory can create hidden privilege escalation and make permissions hard to audit. In this guide, I’ll show you how to find nested groups using PowerShell and the AD Pro Toolkit. I’ll also cover why nested groups are a security risk and how to remove risky nested memberships.
What are Nested Groups
Nested groups are when one Active Directory group is a member of another group. Nested groups inherit the permissions of the group it is a member of.
For example, I have a group called “it_wrk_admins” and it is a member of the “Domain Admins” group. All of the members of the it_wrk_admins group will inherit the permissions of the Domain Admins group.
Nested AD Groups can simplify assigning permissions to network resources but can be a huge risk if not closely managed. In the examples below, I’ll show you how you can review nested groups and group members.
Get Nested Group Membership with AD Pro Toolkit
The AD Pro Toolkit makes it very easy to find all nested groups in your Active Directory environment. In addition, there are multiple group membership reports that can be run manually or on a schedule.
To find all nested group membership in Active Directory, browse to Group Membership > Nested Group Membership and click “Run Report”.
- Group Name = The Parent Group
- Logon Name = The user that has indirect membership to the parent group
- Risk = If user has indirect membership to a privileged group the risk will be set to high.
- Nest Path = Shows the full nested path to the parent group
- Account Status = Shows if the user account is enabled or disabled.
Let’s look at an example from the report.
Andew.Qualls has indirect membership to the Administrators group which is a high risk because it’s a privileged group.
The nested path breakdown:
- Andrew.Qualls is a member of it_global
- it_global is a member of it_wrk_admins
- it_wrk_admins is a member of Domain Admins
- Domain Admins is a member of Administrators
If the parent group is not a privileged group, the risk level will be set to low.
Download a Free Trial of the AD Pro Toolkit and try these reports in your domain.
Get Nested Group Members with PowerShell
In this example, I’ll use the Get-ADGroup command to find nested groups in Active Directory.
Step 1. Open PowerShell as Administrator.
Step 2. Copy and run the command below.
Get-ADGroup -filter * -Properties MemberOf | Where-Object {$_.MemberOf -ne $null} | Select-Object Name,MemberOf
You can see this will display all nested groups in the domain. For example, the group “Account_Local” has a member that is a group called “Accounting_Folders”.
You can also use the Get-ADGroupMember cmdlet which supports recursive lookups, this will return the members of any nested group.
Get-ADGroupMember nest_group1 -recursive | select name, objectclass
The problem with the above command is that it doesn’t show group membership. The Get-ADGroup command is a better option to see which groups are a member of another group.
Limitations of the PowerShell Method
PowerShell gets the job done for basic nested group queries, but it has some limitations. Get-ADGroupMember -Recursive returns the users nested within a group, but it doesn’t show you the actual nesting structure, meaning you can’t see which groups are nested inside other groups, only the final user list. This makes it hard to identify where the risky nesting originates.
You also can’t easily export a tree view of the full nesting hierarchy, and reviewing large groups with many layers of nesting requires custom scripting. For a clearer picture, you need a tool that visualizes the nested structure and highlights privileged chains.
Why Nested Groups Are a Security Risk
Nesting groups inside other groups is common, but it often leads to unintended access. When Group A is added as a member of Group B, every user in Group A inherits the permissions of Group B. If Group B is a privileged group like Domain Admins, every member of Group A silently becomes a domain admin even if that wasn’t the intent.
The problem gets worse with multiple layers of nesting. A user in a simple department group can end up with elevated rights through a chain of nested memberships that no one reviews. This is one of the most common causes of privilege escalation in Active Directory.
Nested groups also make audits difficult. When you look at a group’s direct members, you may not see the full list of users who actually have access. An admin reviewing “who has access to this file share?” can easily miss nested members and assume the permissions are tighter than they are.
With the AD Pro Toolkit, you can easily find nested group membership that creates a risk.
