Find Nested Groups in Active Directory

In this guide, I’ll show you how to find nested group membership with PowerShell and the AD Pro Toolkit.

Nested Groups are Active Directory groups that are members of another group. For example, I have two groups, IT_Folders and IT_Local. The IT_Folders group can be a member of the IT_Local group. Below are some options on how to search Active Directory for nested groups.

Get Nested Group Membership using PowerShell

In this example, I’ll use the Get-ADGroupMember command to check a single group for members that are a group.

Step 1. Open PowerShell as Administrator.

Step 2. Copy and paste the command below. Change the group name to the group you want to check.

Get-ADGroupMember -Identity it_printers | where-object {$_.objectClass -eq 'group'}

Option #2 AD Group Management Tool

In this example, I’ll use the AD Group Management Tool to scan all domain groups for nested groups.

Step 1: Click on Group Reports -> Group Membership report and click Run. This will display all groups and their members.

Step 2. To display only nested groups click on objectClass and select group.

The AD Pro Toolkit includes over 200 built in reports.

Get Nested Group Membership for All Domain Groups

Instead of checking each group one at a time for nested groups, it would be much easier to run a command to check all groups. You can use the Get-ADGroup cmdlet and run a simple filter to find nested groups.

Get-ADGroup -filter * -Properties MemberOf | Where-Object {$_.MemberOf -ne $null} | Select-Object Name,MemberOf

You can see this will display all nested groups in the domain. For example, the group “Account_Local” has a member that is a group called “Accounting_Folders”.

Get Nested Groups Using the AD Group Management Tool

The group membership report tool is an easy to use GUI tool I created to simplify finding nested groups and group membership. This tool can display the parent group, subgroups, and members of the subgroup. It also displays several user attributes like email, department, address, phone, city, state, and much more. 

Download Free Trial of the group membership report tool.

Example 1: Get All Nested Active Directory Groups

Click on Group Membership Report, select path, and click Run.

This will give you a group membership report for all users and groups.

To filter the list to only display nested groups, click on the objectClass column and select group.

Now you will have a list of all groups that are members of other groups.

For example, you can see in the screenshot below the “HR_local” group is a member of the “IT_local” group.

For each member its displays you can select to include several user/group attributes.

Username, Name, ObjectClass, Group, Group Type, Scope, Description, First Name, Last Name, Office, Telephone, Street Address, PO Box, City, State, Zip, Email, Title, Department, Company, Manager, Proxy Addresses, Initial, Display, and Homepage.

To export the nest groups to a CSV file click the export button.

Example 2: Get all Nested Groups from an Organization Unit

If you want to get nest groups from an OU click the browse button and select the OU.

You will see your Active Directory Tree, just select the OU you want to report on and click OK. I’m selecting Accounting OU which has about 30 security groups. 

Back at the main screen click run. The tool will now go through all the groups in the OU and display its members. Depending on how many groups you have and how many members are in each group it could take a while to complete. 

Once completed, you can sort the columns to group the different object types. I like to sort on ObjectClass so I can see all the subgroups and parent groups. 

Example 4: Get All Group Membership 

To get all domain groups and their membership just select “All Groups” and click run. 

If you have questions please post them below in the comment section. 

Related: Export Group Members to CSV

1 thought on “Find Nested Groups in Active Directory”

  1. In Example 4, if I wanted to limit this to security groups only, and have the output show how many users are in the nested group is there a way to do this?

    Reply

Leave a Comment