Find Nested Groups in Active Directory

In this guide, I’ll show you how to find nested groups and get nested group membership.

First I’ll show you how to get nested group membership using PowerShell. Then I’ll show you the Group Membership report tool that can search all groups, a single group, all groups in an OU, or all users in an OU. 

Method 1: Using PowerShell to get Nested Group Membership

Method 2: Using the Group Membership Report Tool to get Nested Group Membership

Video Tutorial

If you don’t like video tutorials or want more details, then continue reading the guide below. 

Method 1: Using PowerShell to find Nested Groups

There are several ways to find nested groups with PowerShell. The examples below are simple one-line PowerShell commands to get nested groups and group membership. 

Example 1: Get Members of a Group

This command will simply get the members of a group. In this example, I’m checking the members of a group named “pdrive_marketing” 

Get-ADGroupMember -Identity pdrive_marketing

You can see it returned all the members of the “pdrive_marketing” group. The problem is it is returning both user and group members. I just want members that are groups (aka.. nested groups). In example 2, I’ll show you how to filter this to just display groups. 

Example 2: Get only Nested Group Membership

You can add a filter to so the command will only display members that are a group. The group type is defined by the objectClass so you can create a filter using the “where-object”  cmdlet to just display members that are a group. 

Get-ADGroupMember -Identity pdrive_marketing | where-object {$_.objectClass -eq 'group'}

Now its only displaying members that are a group, all users have been filtered out. 

Example 3: Get Nested Group and Group Members

At this point, you have learned how to find nested groups using Powershell. What if you wanted to know the membership of the nested group?

No problem. 

You can pipe the results to another command “Get-ADGroupMember”  that will return the membership of the group.

Get-ADGroupMember -Identity pdrive_marketing | ?{$_.ObjectClass -eq "Group"} | %{Write-Host $_.Name;Get-ADGroupMember $_ }

Let’s break down what this command is doing. 

First, it gets the membership of the group “pdrive_marketing”, then it filters for only objects that are a group (nested groups), this returns the group “Marketing_local”. Lastly, Marketing_local is sent down the pipe to the  “Get-ADGroupMember” command that displays the membership of the group. 

PDrive_Marketing = Parent Group
Marketing_local = Subgroup (nested group)
Users displayed are members of the Marketing_local group. 

Example 4: Find all Nested Groups in the Domain

The first 3 examples all displayed nested groups for a single group. But you probably want to get nested group membership for more than a single group. To find all groups that have nested groups use this command. 

Get-ADGroup -filter * -Properties MemberOf | Where-Object {$_.MemberOf -ne $null} | Select-Object Name,MemberOf

You can see this will display all nested groups in the domain. For example, the group “IT_Local” is a member of the group “PDrive_temp. You can also see the group “Accounting_Local” is a member of the “PDrive_temp” group. 

The above PowerShell commands are simple one-line commands to find nested groups. There are a bunch of scripts online for finding nested groups, some of them can get pretty complicated. 

To simplify finding nested groups I created the group membership report tool. See the example below. 

Method 2: Group Membership Report Tool

The group membership report tool is an easy to use GUI tool I created to simplify finding nested groups and group membership. This tool can display the parent group, subgroups, and members of the subgroup. It also displays several user attributes like email, department, address, phone, city, state, and much more. 

Example 1: Get Nested Groups for a Single Group

Click single group then click the select button

You will get a popup to search for a group to report on. Type the name, click search, click the group, and then click the select button. 

In this example, I’m going to get the nested group membership for the PDrive_Temp group. 

Back to the main screen click run the button. The group report tool will get all members of the group you selected. 

You can see above all the members of the Pdrive_temp group. The ObjectClass column makes it really easy to find groups that are members of the group..aka the nested groups. You can click on any of the columns to sort the results. 

To display the members of the subgroups just select the “recurse groups” option and click run again. 

With the recurse option selected you can now see the subgroup members. In the above screenshot, Account_Local is the subgroup and PDrive_temp is the parent group. Then it displays the membership for each nested group. 

For each member its displays the following attributes from Active Directory:

Username, Name, ObjectClass, Group, Group Type, Scope, Description, First Name, Last Name, Office, Telephone, Street Address, PO Box, City, State, Zip, Email, Title, Department, Company, Manager, Proxy Addresses, Initial, Display, and Homepage.

Here are a few screenshots showing some of the attributes that are included in the report. 

Example 2: Get all Nested Groups from an Organization Unit

Now let’s get group membership from all groups in an OU. 

Select the “All Groups in OU” radio button then click the select button. 

You will see your Active Directory Tree, just select the OU you want to report on and click OK. I’m selecting my OU “ADPRO Groups” that has about 30 security groups. 

Back at the main screen click run. The tool will now go through all the groups in the OU and display its members. Depending on how many groups you have and how many members are in each group it could take a while to complete. 

Once completed, you can sort the columns to group the different object types. I like to sort on ObjectClass so I can see all the subgroups and parent groups. 

You can export all results to CSV by clicking on the Export button. 

Example 3: Check Group Membership for a Single User

To find group membership for a single user just select “Single User”, enter in the user’s logon name, and click run. 

Example 4: Get All Group Membership 

To get all group membership just select “All Groups” and click run. 

About the Active Directory Pro Toolkit. 

The group membership report tool is one of ten tools included in the Active Directory Pro Toolkit. This toolkit simplifies and automates many routine AD tasks. Tools included: 

  • AD Last Logon Report
  • Bulk User Creation Tool
  • AD Cleanup Tool
  • AD User Export
  • Bulk User Update
  • Bulk Group Management
  • Computer/Server Uptime Report
  • NTFS Permissions Reporter
  • User Unlock and account lockout troubleshooting Tool

If you have questions please post them below in the comment section. 

Recommended Tool: Permissions Analyzer for Active Directory

This FREE tool lets you get instant visibility into user and group permissions. Quickly check user or group permissions for files, network, and folder shares.

Analyze user permissions based on an individual user or group membership.

Leave a Comment