Audit privileged groups
Documentation: Microsoft Learn
An array holds the four group names worth watching, and the loop calls Get-ADGroupMember with -Recursive on each so nested membership is flattened into leaf members.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
$Groups = "Domain Admins" , "Enterprise Admins" , "Administrators" , "Schema Admins"; foreach($g in $Groups){ Get-ADGroupMember $g -Recursive | Select-Object @{ Name = "Group"; Expression = { $g } },SamAccountName,ObjectClass }- Stage 1$Groups
Positional values or no named parameters
How it works
An array holds the four group names worth watching, and the loop calls Get-ADGroupMember with -Recursive on each so nested membership is flattened into leaf members. A calculated property named Group stamps the loop variable onto every row, which keeps each result traceable to its source group once everything is combined.
Adapting it
Extend the array with Account Operators and any delegated admin groups your organization created, then pipe the whole thing into Export-Csv using a datestamped filename so successive runs build a change history.
Requirements
ActiveDirectory module plus rights to read privileged group membership; Enterprise Admins needs a forest root DC.
If the result is unexpected
A privileged-group report does not match the accounts that can perform an administrative action.
Nested membership, domain scope and rights assigned outside the selected groups can alter effective access.
- Resolve the selected groups and inspect nested members while recording the queried domain.
Validate the result
Every row identifies its source group and the membership method used.
Keep the check reliable
Treat membership inventory as one input to access review rather than a complete effective-permissions calculation.
