Get-ADGroupMember -Recursive: list all members of an AD group, including nested groups

Get-ADGroupMember -Identity 'Sales' lists the direct members of a group: users, computers and other groups. Add -Recursive to expand nested groups and return only the leaf objects (users and computers), each listed once:

Import-Module ActiveDirectory
Get-ADGroupMember -Identity 'Sales' -Recursive |
  Where-Object objectClass -eq 'user' |
  Select-Object Name, SamAccountName |
  Sort-Object Name

-Identity accepts the group's name (sAMAccountName), distinguished name, GUID or SID.

Direct vs recursive

The objects returned are ADPrincipal objects with a few properties (Name, SamAccountName, objectClass, distinguishedName, SID). To get more user attributes, pipe them to Get-ADUser:

Get-ADGroupMember 'Sales' -Recursive |
  Where-Object objectClass -eq 'user' |
  Get-ADUser -Properties EmailAddress, Department |
  Select-Object Name, EmailAddress, Department |
  Export-Csv sales-members.csv -NoTypeInformation

Large groups

Get-ADGroupMember goes through Active Directory Web Services, which limits how many members it returns for one group (5,000 by default, the ADWS MaxGroupOrMemberEntries setting). Larger groups fail with a size-limit error. Alternatives that do not hit that limit:

# users that are members of the group, directly or through nesting (LDAP_MATCHING_RULE_IN_CHAIN)
$dn = (Get-ADGroup 'All Staff').DistinguishedName
Get-ADUser -LDAPFilter "(memberOf:1.2.840.113556.1.4.1941:=$dn)" | Select-Object Name, SamAccountName

# direct members only, from the member attribute
(Get-ADGroup 'All Staff' -Properties Member).Member.Count

The matching-rule OID 1.2.840.113556.1.4.1941 makes the domain controller walk the nested membership, which is also faster than -Recursive for deep nesting.

Which groups is a user in?

Get-ADPrincipalGroupMembership -Identity jdoe | Select-Object Name | Sort-Object Name

This lists direct group memberships only. Members through a user's primary group (usually Domain Users) are not stored in the member attribute, so attribute-based queries do not show them.

Requirements

The cmdlet belongs to the ActiveDirectory module, which is part of the Remote Server Administration Tools (RSAT) on Windows 10 and 11 and is installed with the AD DS tools on Windows Server; see install RSAT on Windows 11. It talks to Active Directory Web Services (ADWS) on a domain controller over TCP port 9389, not over plain LDAP. Reading group membership normally needs only a domain user account, because authenticated users can read the member attribute of most groups; protected groups and delegated OUs can be more restrictive.

Errors you may see

Fixes are on Get-ADUser is not recognized (same module), Unable to find a default server and Cannot find an object with identity.

Pitfalls

• Display name versus account name. -Identity does not search display names. If the group's display name differs from its sAMAccountName, look it up first with Get-ADGroup -Filter "Name -eq 'Sales Team'".
• Primary group. Users whose primary group is the queried group are not listed through the member attribute, so attribute-based counts can be lower than what Active Directory Users and Computers shows.

FAQ