PowerShell AD groups
Read group membership without confusing a direct member list with effective access.
Documentation: Microsoft Learn
Overview
The example lists direct members of Domain Admins. The objectClass column matters: a group can contain users, computers and other groups. Do not pass every returned object into Get-ADUser without checking its type.
-Recursive expands nested group membership, but a flattened list loses the path that explains how a user became a member. For an access review, keep enough evidence to explain the membership chain.
Group membership alone does not prove access to a resource. The user’s logon token, resource permissions, deny entries and other authorization rules can affect the result. An account added to a group may also need a new logon token before the change affects its session.
For a privileged group review, identify the domain and group by a stable identity, record the collection time and compare with an approved membership baseline. Avoid automatically removing an unexpected member until its ownership and purpose are established.
See the objects move
Inspect this authored example with fictional data in the bounded browser model. The numbered stages show how its objects change.
Get-ADGroupMember -Identity 'Domain Admins' | Where-Object objectClass -eq 'user' | Select-Object SamAccountName- Stage 1Get-ADGroupMember
-Identity - Stage 2Where-Object
-eq - Stage 3Select-Object
Positional values or no named parameters
What happens
Read objectClass before acting on the names. Use the browser query to practice projecting properties; use a controlled directory query to establish actual membership and nested paths.
Worth remembering
Distinguish direct membership, nested membership and effective access; they answer different questions.
Primary documentation
Try it
Browser simulation · fictional data; no changes to your computer.
Your task: Return only direct members whose objectClass is user. Keep SamAccountName in the result.
Follow the objects
Run the command to inspect each stage.
Hint
Do not treat computers and nested groups as user accounts.
Compare a solution
Get-ADGroupMember -Identity 'Domain Admins' | Where-Object objectClass -eq 'user' | Select-Object SamAccountNameLists direct members of a group, showing the type of each member.
Show reference output
Browser dataset output · the real environment will differ
Name SamAccountName objectClass ----------- -------------- ----------- Ada Rao arao user Ravi Sen rsen user Nina Roy nroy user WEB01$ web01$ computer SQL01$ sql01$ computer HelpDesk helpdesk group PrintOps printops group svc-Backup$ svcbak$ computer
Practise this
List group membership
Import ActiveDirectory first. Read members of IT-Admins and return Name and SamAccountName.
The sandbox is visible now. Sign in with Google only when you run or check a task; commands and temporary files are discarded when you leave.
Run a command to inspect its result.