Powershell: List Active Directory group hierarchy

You have quite a few questions regarding nested groups.

Here's a function that show nested groups and their offsets. 

It will also deal with circular references.

It would take some effort to get it into the format that you have requested.

function Get-NestedGroups 
{param ($strGroup,$Offset)

  $currentGroupGroups = (Get-ADGroup Identity $strGroup Properties Memberof).Memberof
  
  ForEach ($memGroup in $currentGroupGroups) {
    If ($script:groupList.ContainsKey($memgroup) -eq $False) {
       $strMemGroup = ($memGroup -split ",*..=")[1] 
       $script:GroupList[$memGroup] = $True
       "$Offset$strMemGroup"
       Get-NestedGroups -strGroup $strMemGroup $($Offset + ".")
    }
    Else {
       "$Offset$strMemgroup Circular Reference"
    }
  }
}

# Hash table to track group memberships.

$groupList = @{}

Get-NestedGroups TestGroup


May 30th, 2014 9:01am

This will export to a CSV in a readable format.

function Get-NestedGroups 
{param ($strGroup,$Offset)

  $currentGroupGroups = (Get-ADGroup Identity $strGroup Properties Memberof).Memberof
  
  ForEach ($memGroup in $currentGroupGroups) {
    If ($script:groupList.ContainsKey($memgroup) -eq $False) {
       $strMemGroup = ($memGroup -split ",*..=")[1] 
       $script:GroupList[$memGroup] = $True
       "$Offset$strMemGroup"
       "$Offset$strMemGroup" | Add-Content $logfile
       Get-NestedGroups -strGroup $strMemGroup $($Offset + ",")
    }
    Else {
       "$Offset$strMemgroup Circular Reference" | Add-Content $logfile
    }
  }
}

$logfile = ".\nestedtest.csv"
"Level1,Level2,Level3,Level4,Level5" | Add-Content $logfile # initialise log file.

$groupList = @{} # Hash table to track group memberships.

$group = "level 4"

$group | Add-Content $logfile

Get-NestedGroups $group ","

Free Windows Admin Tool Kit Click here and download it now
May 30th, 2014 9:17am

I'm looking to build a script which would show Active Directory group hierarchy.

Unfortunately simple Get-ADGroupMember $group -Recursive lists only members, not groups.

.

Example:

Group1 is main group - it has 3 subgroups named GroupA,B,C. So GroupA,B,C is MemberOf Group1.

GroupA has no subgroups

GroupB has 2 subgroups named subGroup1,2

GroupC has 1 subgroup named subGroup3

subGroup1,2,3 has no subgroups

Ideally would be great to have output something like this:

Level1     Level2     Level3          Level4
Group1   GroupA 
               GroupB   subGroup1
                              subGroup2
               GroupC   subGroup3

Of course I have Googled it for, I found two Web-Sites:

http://powershell.com/cs/forums/p/9588/15894.aspx

http://www.experts-exchange.com/Programming/Languages/Scripting/Powershell/Q_27346526.html

It's little over my scope to understand them, in first link there is simple script.

function Get-GroupHierarchy ($searchGroup)
{
import-module activedirectory
$groupMember = get-adgroupmember $searchGroup | sort-object objectClass -descending
   foreach ($member in $groupMember)
    {Write-Host $member.objectclass,":", $member.name;
    if ($member.ObjectClass -eq "group")
        {Get-GroupHierarchy $member.name}}
} 

I put $searchGroup = "Administrators" before the script, but script doesn't show any results. It has 3 sub-groups if I do Get-ADGroupMember. Probably I don't know how to work with functions.

How to make those scripts to work or make something similar?




  • Edited by Ph0neutr1a Friday, May 30, 2014 9:50 AM
May 30th, 2014 12:46pm

You have quite a few questions regarding nested groups.

Here's a function that show nested groups and their offsets. 

It will also deal with circular references.

It would take some effort to get it into the format that you have requested.

function Get-NestedGroups 
{param ($strGroup,$Offset)

  $currentGroupGroups = (Get-ADGroup Identity $strGroup Properties Memberof).Memberof
  
  ForEach ($memGroup in $currentGroupGroups) {
    If ($script:groupList.ContainsKey($memgroup) -eq $False) {
       $strMemGroup = ($memGroup -split ",*..=")[1] 
       $script:GroupList[$memGroup] = $True
       "$Offset$strMemGroup"
       Get-NestedGroups -strGroup $strMemGroup $($Offset + ".")
    }
    Else {
       "$Offset$strMemgroup Circular Reference"
    }
  }
}

# Hash table to track group memberships.

$groupList = @{}

Get-NestedGroups TestGroup


Free Windows Admin Tool Kit Click here and download it now
May 30th, 2014 3:58pm

This will export to a CSV in a readable format.

function Get-NestedGroups 
{param ($strGroup,$Offset)

  $currentGroupGroups = (Get-ADGroup Identity $strGroup Properties Memberof).Memberof
  
  ForEach ($memGroup in $currentGroupGroups) {
    If ($script:groupList.ContainsKey($memgroup) -eq $False) {
       $strMemGroup = ($memGroup -split ",*..=")[1] 
       $script:GroupList[$memGroup] = $True
       "$Offset$strMemGroup"
       "$Offset$strMemGroup" | Add-Content $logfile
       Get-NestedGroups -strGroup $strMemGroup $($Offset + ",")
    }
    Else {
       "$Offset$strMemgroup Circular Reference" | Add-Content $logfile
    }
  }
}

$logfile = ".\nestedtest.csv"
"Level1,Level2,Level3,Level4,Level5" | Add-Content $logfile # initialise log file.

$groupList = @{} # Hash table to track group memberships.

$group = "level 4"

$group | Add-Content $logfile

Get-NestedGroups $group ","

May 30th, 2014 4:14pm

Hi Ph0neutr1a,

In addition, just a little clarification, to use the function, after running the function in powershell, you can invoke the function like this:

Get-GroupHierarchy groupname

If you have any feedback on our support, please click here.

Best Regards,

Anna

TechNet Community Support

Free Windows Admin Tool Kit Click here and download it now
June 1st, 2014 10:56pm

Hi Ph0neutr1a,

In addition, just a little clarification, to use the function, after running the function in powershell, you can invoke the function like this:

Get-GroupHierarchy groupname

If you have any feedback on our support, please click here.

Best Regards,

Anna

TechNet Community Support

June 2nd, 2014 5:55am

Hi Ph0neutr1a,

Im writing to just check in to see if the suggestions were helpful. If you need further help, please feel free to reply this post directly so we will be notified to follow it up.

If you have any feedback on our support, please click here.

Best Regards,

Anna

TechNet Community Support

Free Windows Admin Tool Kit Click here and download it now
June 9th, 2014 4:32am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics