How to Check Active Directory (AD) Group Membership

7.5K

The ADUC console (dsa.msc) allows you to quickly view a user’s direct group membership through the Member Of tab.

To check the current user’s AD group membership:

1. Open Run and type in dsa.msc
2. Find and open the user account
3. Go to the Member Of tab

Keep in mind some important limitations of ADUC:

• Shows only direct group membership
• Does not resolve nested groups
• Does not allow you to export a list of groups in any form (to CSV or TXT)
• Not suitable for reporting or audits

Important. In case a user is a member of a group through another group (nested membership), ADUC won’t display it.

Note. It’s important to mention that you will need the Active Directory module and at least Read permissions on Active Directory objects in order to perform commands in this article. You should install RSAT if the module is not available. The installation method depends on the OS.

For Windows Client (Windows 10/11), use the following command:

Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0"

For Windows Server (2016/2019/2022/2025), use the command:

Install-WindowsFeature RSAT-AD-PowerShell

or full AD DS tools:

Install-WindowsFeature RSAT-ADDS

List AD groups a user is a member of with PowerShell

There are two common ways to get AD group membership, but they work differently:

Get-ADPrincipalGroupMembership

Get-ADPrincipalGroupMembership returns the groups that AD resolves for the specified security principal. In many cases this includes nested group memberships, although the behavior differs from LDAP recursive matching rules and depends on group scope and domain topology.

Here is a usage example:

Get-ADPrincipalGroupMembership jbrion | Select name

Troubleshooting. In some cases, Get-ADPrincipalGroupMembership may fail with errors such as The search filter cannot be recognized, particularly when resolving complex/nested group memberships. The error can be related to how the DC processes the underlying membership query. As a troubleshooting step, you should try querying a specific DC with the -Server parameter:

Get-ADPrincipalGroupMembership jbrion -Server "dc01.contoso.com" |
Select-Object Name

If the problem persists, you should use the LDAP recursive membership query described in the next section.

Get-ADUser -Properties MemberOf

This command reads the MemberOf attribute from the user object. Its advantage is that it shows direct group membership. However, it still does not resolve nested groups and the output of this command is less structured.

Note. The MemberOf attribute does not include:

• nested group membership
• primary group membership (Domain Users, etc.)
• Entra ID/cloud group membership in hybrid environments

Here is the usage example:

Get-ADUser jbrion -Properties MemberOf | Select -ExpandProperty MemberOf

Key notes

You should use both commands only for basic checks. In case you need a full (nested) membership, you should use LDAP recursive filter instead.

Command	Direct Membership	Nested Membership
Get-ADPrincipalGroupMembership	Yes	Partial/Depends
Get-ADUser -Properties MemberOf	Yes	No
LDAP recursive filter (1.2.840.113556.1.4.1941)	Yes	Yes

Multi-Domain Forest Considerations

In a multi-domain AD forest, group membership queries can produce different results depending on which DC/Global Catalog server is used. This is especially important when a user belongs to groups located in other domains. For forest-wide membership queries, you should use a Global Catalog when appropriate.

For example, to query a Global Catalog, you should specify the GC server and port 3268:

Get-ADPrincipalGroupMembership jbrion -Server "gc01.contoso.com:3268" |
Select-Object Name, DistinguishedName

A Global Catalog contains a partial replica of objects from all domains in the forest, making it useful for forest-wide searches.

For queries that should be limited to a specific domain, you need to specify a DC instead:

Get-ADPrincipalGroupMembership jbrion -Server "dc01.contoso.com" |
Select-Object Name, DistinguishedName

When troubleshooting missing group memberships in a multi-domain forest, you should check which DC/Global Catalog is being queried and whether the required group objects and attributes are available there.

Get Nested Group Membership (Recursive)

In order to include nested Active Directory groups (groups inside groups), you need to use a special LDAP matching rule. The following Object Identifier enables recursive search of group membership:

`1.2.840.113556.1.4.1941`

It signals Active Directory to include:

• Direct group membership
• Nested (indirect) group membership

PowerShell example

$username = 'jbrion'
$userDN = (Get-ADUser $username).DistinguishedName
$filter = "member:1.2.840.113556.1.4.1941:=$userDN"
Get-ADGroup -LDAPFilter "($filter)" |
Select SamAccountName, ObjectClass

Note. You should use this method when you need full group membership, when groups are nested in other groups, and you don’t need simple direct membership checks

Hybrid Identity Consideration (Microsoft Entra ID)

Note that in modern enterprise environments, AD is often synced with Microsoft Entra ID using Entra Connect. This means that group membership may originate from:

• On-premises AD groups
• Cloud-only Microsoft Entra ID groups
• Dynamic Entra ID groups (rule-based membership)

Microsoft Entra ID group membership with PowerShell

For Microsoft Entra ID, you should use the Microsoft Graph PowerShell SDK instead of the retired AzureAD and MSOnline PowerShell modules.

Before using the Microsoft Graph PowerShell SDK, you need to install the module and authenticate to Microsoft Graph:

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.Read.All","Group.Read.All"

The first connection requires interactive authentication. Group.Read.All requires administrator consent in many enterprise environments.

In order to retrieve a user’s direct group memberships, use the following command:

Get-MgUserMemberOf -UserId user@contoso.com

To retrieve transitive (nested) group memberships, use the command below:

Get-MgUserTransitiveMemberOf -UserId user@contoso.com

For example, to return only groups:

Get-MgUserTransitiveMemberOf -UserId user@contoso.com -All |
Where-Object { $_.AdditionalProperties.'@odata.type' -eq '#microsoft.graph.group' }

Get-MgUserMemberOf returns direct memberships, while Get-MgUserTransitiveMemberOf includes memberships inherited through nested groups.

The legacy AzureAD and MSOnline PowerShell modules are retired and you should not use them for new automation. Instead we recommend using the Microsoft Graph PowerShell SDK.

Note for bulk queries. Microsoft Graph returns collection results in pages. When using the Microsoft Graph PowerShell SDK, the -All parameter can be used to retrieve all available pages. For large-scale queries across many users, Microsoft Graph throttling may occur. Production scripts should handle throttling and retry requests according to the service’s recommended backoff behavior.

In order to retrieve full user group membership in hybrid environments, you should consider using Microsoft Graph API:

• `GET /users/{id}/memberOf`
• `GET /users/{id}/transitiveMemberOf`

These methods provide authoritative cloud-side membership. This includes:

• nested groups
• dynamic groups
• M365 groups

Also, keep in mind that AD PowerShell cmdlets do not reflect cloud-only group membership.

Export AD Group Members to CSV using PowerShell

In case you want to export results, there are two formats and you can use them depending on your goal. 

TXT export (simple log format)

TXT method is good when you need a quick list without structure. Here is an example on how to export AD Group Members to TXT file:

Get-ADUser jbrion -Properties MemberOf |
Select-Object -ExpandProperty MemberOf |
Out-File -FilePath 'C:\ps\ad_group.txt' -Encoding utf8 -Append

Note that this method is fast and simple, but its main disadvantage is that it is not structured well enough and hard to analyze.

CSV export (recommended for reporting)

In case you need a structured data to create a report or when you need an Excel format of report, you should use Export-CSV cmdlet for CSV export:

Get-ADPrincipalGroupMembership jbrion |
Select-Object Name, GroupCategory, GroupScope, DistinguishedName |
Export-Csv -NoTypeInformation C:\ps\ad_group.csv -Encoding UTF8

This method outputs a convenient structured format, which is great for reporting and audits. Another advantage of this method is that it works with Excel or BI tools. But note that it is slightly more verbose.

Our recommendation

We recommend using TXT when you need to perform quick checks or debugging
And you should use CSV when reporting, preparing documentation, or performing audits.

List Active Directory Group Members with PowerShell

In some cases, you may need to view a full list of AD group members (including nested ones). Use this command:

Get-ADGroupMember -Identity fs01-salary -Recursive | ft SamAccountName, SID, name

Important. Get-ADGroupMember -Recursive does not resolve users whose membership exists only through the Primary Group relationship. In AD, a user’s primary group is stored in the primaryGroupID attribute rather than in the group’s member attribute. As a result, recursive group enumeration may omit such users. Note that this most commonly affects groups such as Domain Users and custom groups configured as a user’s primary group.

Alternative Approach: Querying the group member attribute directly

You have another way to retrieve group membership, you can do that by reading the `member` attribute of the group object.

Here is an example:

(Get-ADGroup "AllStaff" -Properties member).member

This returns the distinguished names (DNs) of all direct members of the group.

In order to resolve user objects, you can pipe the results into Get-ADUser or Get-ADObject:

(Get-ADGroup "AllStaff" -Properties member).member |
ForEach-Object { Get-ADUser $_ }

This method does not require LDAP filters and can be easier to read and use in simple scripts.

Note. This method returns only direct group membership and does not expand nested groups. For full recursive membership, you should use LDAP matching rule/-Recursive parameter.

Note. By default, Get-ADGroupMember returns up to 5000 members.

By default, Get-ADGroupMember may not be efficient for very large groups (tens of thousands of members), and it does not provide paging controls such as -ResultSetSize.

For large environments, you should use one of the following approaches:

• LDAP recursive filter (recommended for performance and scalability)
• Get-ADGroupMember -Recursive combined with filtering
• Microsoft Graph API in hybrid Entra ID environments

Also, keep in mind that the Get-ADGroupMember cmdlet does not support the -ResultSetSize parameter. This parameter is only available in cmdlets that use the -Filter parameter (such as Get-ADUser/Get-ADGroup).

Add User Attributes for Each Group Member

If you need to add specific user attributes for each group member, add the foreach loop:

Get-ADGroupMember -Identity "fs01-salary" -Recursive |
Where-Object objectClass -eq 'user' |
Get-ADUser -Properties company, department, title, mail

Check AD Group Membership via Command Line Tools (CMD)

Command Line Tools are available on all Windows OSs but are somewhat limited compared to PowerShell options.

Using NET USER

In case you need to check a specific user’s group membership, use the following command:

NET USER username /DOMAIN

It is simple and available on all Windows OSs. It gives you an option to quickly check users, but has a few disadvantages: it doesn’t support nested groups and you have a limited options for formatting its output.

Using NET GROUP for Global Groups

You can use NET GROUP to list members of a domain global group:

NET GROUP "group name" /DOMAIN

Keep in mind that NET GROUP is intended for global groups and is not a universal method for enumerating members of every AD group scope. For domain local groups, you should use NET LOCALGROUP where applicable, or use PowerShell/LDAP for a consistent approach across different group scopes. Note that NET GROUP also does not recursively expand nested group membership and provides limited options for filtering and formatting the output.

WHOAMI /GROUPS

In case you need to list groups of the currently logged-in user only, you should use the command:

whoami /groups

This method is great for fast local checks with no Active Directory queries needed. But it also has a disadvantage: it works only for current session user and not useful for other accounts.

Tip. We recommend you to use PowerShell for advanced scenarios.