Returns data representing all the AD groups a given user belongs to, flattened into an array, but retaining information about whether membership in the groups are direct, nested, or both.
The key thing about this module is that, while it flattens the list of results for easier consumption and export, those results preserve data gathered while recursively searching all groups of which the given user is a member.
As a result, some groups may be listed more than once, but each instance represents a different nesting path. Each nesting path denotes whether the given user is a direct member, or a nested member. In cases where both are true, or where users are a member of a group for multiple reasons, then there a nesting path returned for each reason.
As such, it becomes easy to determine how and why the given user is a nested member of any given group, which is not possible simply by listing that user's normal group memberships.
In the following example, the user ewsguest899 is a direct member of engr-ews-testgroup, engr-ews-testgroup2, and engr-ews-testgroup3. Additionally engr-ews-testgroup2 and engr-ews-testgroup3 are both members of engr-ews-testgroup. So you can easily see that ewsguest899 is a member of engr-ews-testgroup for 3 separate reasons: once as a direct member, and twice as a nested member.
Must be run as your SU account in order for it to see and return all groups. Running as an account without full provileges will return only a subset of group memberships.
- Download
Get-AdUserGroupMembershipTree.psm1to the appropriate subdirectory of your PowerShell modules directory. - Run it using the examples and documentation provided below.
Get-AdUserGroupMembershipTree -UserName "username"Required string.
The name of the AD user for which to pull group membership data.
Required string.
Specify your domain for this.
E.g. ad.uillinois.edu.
This module relies on the Get-ADPrincipleGroupmembership cmdlet. As of sometime around 2025, this cmdlet now throws a The operation being requested was not performed because the user has not been authenticated. error for some reason unless the -ResourceContextServer parameter is specified. Source: https://www.reddit.com/r/PowerShell/comments/10fbr33/comment/j4weozs/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button.
Optional validated string.
Specifying ParentsThenChild lists each group membership alphabetically by the name of the most distantly-nested membership. E.g. If user user is included in group dept1, which is included in group company, then the line will look like company { dept1 { user. This is more useful is you want to identify all of the different groups a user is a ultimately a member of, and easily locate a specific group from that list, or if you want to identify which memberships are the root cause of being nested into a given group.
Specifying ChildThenParents lists each group membership alphabetically by the name of the youngest ancestor. E.g. If user user is included in group dept1, which is included in group company, then the line will look like user } dept1 } company. This is more useful if you want to identify which groups a user is nested into by virtue of a given direct membership.
Default is ParentsThenChild.
Optional switch.
Includes the username as part of each group membership line.
E.g. company { dept1 would become company { dept1 { user, or dept1 } company would become user } dept1 } company.
Optional switch.
By default group membership nesting is denoted by either a { or a }, depending on the given value of NestingDisplayDirection.
Specifying -UserForwardSlashes replaces these with /.
If both -UseForwardSlashes and -UseBackSlashes are specified, -UseForwardSlashes takes precedence.
Optional switch.
By default group membership nesting is denoted by either a { or a }, depending on the given value of NestingDisplayDirection.
Specifying -UserForwardSlashes replaces these with \.
If both -UseForwardSlashes and -UseBackSlashes are specified, -UseForwardSlashes takes precedence.
Optional switch.
If specified returns all of the flattened group data as an array of PowerShell objects.
Optional string.
The directory where a CSV will be saved, containing all of the flattened group data, if specified.
- See also: https://github.com/engrit-illinois/Test-ADUserIsMemberOfGroup
- By mseng3. See my other projects here: https://github.com/mmseng/code-compendium.