Get Active Directory Group Members Recursively

A very common scenario when assigning permissions is having nested security groups. Although this is an easier way to manage the permission delegation, is adds complexity when there's the need to determine whether a principal is granted the permission or getting a list with all the principles involved.

The CPolydorou.ActiveDirectory module now includes a function that is the solution to the problem.

The Get-ActiveDirectoryGroupMember function will return all the objects that are members of a specified Active Directory group. The "-Recurse" parameter will query Active Directory and return all the members of the group recursively.

This way, we are able to get a list of all the objects that are granted a permission without having to consider the nested groups.

Let's take a quick look at an example.

We have a group named "NestedGroup" that the user CPolydorou is a member of. This group is also a member of another group named "Group".

PS C:\> Get-ActiveDirectoryGroupMember -Identity NestedGroup

DistinguishedName                              Name               ObjectClass ObjectGUID
-----------------                              ----               ----------- ----------
CN=Christos Polydorou,CN=Users,DC=lab,DC=local Christos Polydorou user        7fe5245b-893a-4dd1-97fb-4f5c0d9df96d

The group named "Group" has only one member, the Administrator user.

PS C:\> Get-ActiveDirectoryGroupMember -Identity Group

DistinguishedName                         Name          ObjectClass ObjectGUID
-----------------                         ----          ----------- ----------
CN=Administrator,CN=Users,DC=lab,DC=local Administrator user        b0519259-8d4f-4e71-830b-c583285e6ff1
CN=NestedGroup,OU=Groups,DC=lab,DC=local  NestedGroup   group       2048c14a-a5d8-4a16-9eaf-5577a9709259

When listing the members of the "Group" group recursively we get all three objects.

PS C:\> Get-ActiveDirectoryGroupMember -Identity Group -Recurse

DistinguishedName                              Name               ObjectClass ObjectGUID
-----------------                              ----               ----------- ----------
CN=Administrator,CN=Users,DC=lab,DC=local      Administrator      user        b0519259-8d4f-4e71-830b-c583285e6ff1
CN=Christos Polydorou,CN=Users,DC=lab,DC=local Christos Polydorou user        7fe5245b-893a-4dd1-97fb-4f5c0d9df96d
CN=NestedGroup,OU=Groups,DC=lab,DC=local       NestedGroup        group       2048c14a-a5d8-4a16-9eaf-5577a9709259