Get Active Directory Group Members Recursively
A very common scenario when assigning permissions is having nested security groups. Although this is an easier way to manage the permission delegation, is adds complexity when there's the need to determine whether a principal is granted the permission or getting a list with all the principles involved.
The CPolydorou.ActiveDirectory module now includes a function that is the solution to the problem.
The Get-ActiveDirectoryGroupMember function will return all the objects that are members of a specified Active Directory group. The "-Recurse" parameter will query Active Directory and return all the members of the group recursively.
This way, we are able to get a list of all the objects that are granted a permission without having to consider the nested groups.
Let's take a quick look at an example.
We have a group named "NestedGroup" that the user CPolydorou is a member of. This group is also a member of another group named "Group".
The group named "Group" has only one member, the Administrator user.
When listing the members of the "Group" group recursively we get all three objects.
The CPolydorou.ActiveDirectory module now includes a function that is the solution to the problem.
The Get-ActiveDirectoryGroupMember function will return all the objects that are members of a specified Active Directory group. The "-Recurse" parameter will query Active Directory and return all the members of the group recursively.
This way, we are able to get a list of all the objects that are granted a permission without having to consider the nested groups.
Let's take a quick look at an example.
We have a group named "NestedGroup" that the user CPolydorou is a member of. This group is also a member of another group named "Group".
PS C:\> Get-ActiveDirectoryGroupMember -Identity NestedGroup
DistinguishedName Name ObjectClass ObjectGUID
----------------- ---- ----------- ----------
CN=Christos Polydorou,CN=Users,DC=lab,DC=local Christos Polydorou user 7fe5245b-893a-4dd1-97fb-4f5c0d9df96d
DistinguishedName Name ObjectClass ObjectGUID
----------------- ---- ----------- ----------
CN=Christos Polydorou,CN=Users,DC=lab,DC=local Christos Polydorou user 7fe5245b-893a-4dd1-97fb-4f5c0d9df96d
The group named "Group" has only one member, the Administrator user.
PS C:\> Get-ActiveDirectoryGroupMember -Identity Group
DistinguishedName Name ObjectClass ObjectGUID
----------------- ---- ----------- ----------
CN=Administrator,CN=Users,DC=lab,DC=local Administrator user b0519259-8d4f-4e71-830b-c583285e6ff1
CN=NestedGroup,OU=Groups,DC=lab,DC=local NestedGroup group 2048c14a-a5d8-4a16-9eaf-5577a9709259
DistinguishedName Name ObjectClass ObjectGUID
----------------- ---- ----------- ----------
CN=Administrator,CN=Users,DC=lab,DC=local Administrator user b0519259-8d4f-4e71-830b-c583285e6ff1
CN=NestedGroup,OU=Groups,DC=lab,DC=local NestedGroup group 2048c14a-a5d8-4a16-9eaf-5577a9709259
When listing the members of the "Group" group recursively we get all three objects.
PS C:\> Get-ActiveDirectoryGroupMember -Identity Group -Recurse
DistinguishedName Name ObjectClass ObjectGUID
----------------- ---- ----------- ----------
CN=Administrator,CN=Users,DC=lab,DC=local Administrator user b0519259-8d4f-4e71-830b-c583285e6ff1
CN=Christos Polydorou,CN=Users,DC=lab,DC=local Christos Polydorou user 7fe5245b-893a-4dd1-97fb-4f5c0d9df96d
CN=NestedGroup,OU=Groups,DC=lab,DC=local NestedGroup group 2048c14a-a5d8-4a16-9eaf-5577a9709259
DistinguishedName Name ObjectClass ObjectGUID
----------------- ---- ----------- ----------
CN=Administrator,CN=Users,DC=lab,DC=local Administrator user b0519259-8d4f-4e71-830b-c583285e6ff1
CN=Christos Polydorou,CN=Users,DC=lab,DC=local Christos Polydorou user 7fe5245b-893a-4dd1-97fb-4f5c0d9df96d
CN=NestedGroup,OU=Groups,DC=lab,DC=local NestedGroup group 2048c14a-a5d8-4a16-9eaf-5577a9709259