How to Find Active Directory Group Membership

When we think of an Active Directory group, the first thing that often comes to mind is a collection of users. However, groups in Active Directory are much more versatile than that. They can encompass not just user accounts but also computers and other objects. This broader understanding is essential, as it allows for more effective management of access and resources within the organization.

The various types of objects that can be added as a member of Active Directory groups

By understanding the types of objects that can be added to AD groups, organizations can streamline access management and maintain better control over their resources.

Adding new employees to the appropriate Active Directory groups is vital for granting access to resources and facilitating effective email communication with their teams. Conversely, when an employee leaves, it’s equally important to remove them from these groups to prevent unauthorized access to sensitive information. Thus, effectively managing AD group memberships is essential for both onboarding and offboarding processes.

To add members to an Active Directory group

• Open the Server Manager and navigate to Tools » Active Directory Users and Computers.
• Double-click on the group to which you wish to add users and go to the Members tab.
• Click Add and enter the object’s name. Click Check Names to verify or search for the name.
• After entering the name, click OK and then select Apply to save the changes.

Note: Objects such as users, groups, computers, contacts, and service accounts can be added to the group in the same manner.

To remove members from an Active Directory group

• Select the group from which you want to remove a member in ADUC.
• Navigate to the Members tab and select the member.
• Click Remove and confirm the removal by clicking Yes in the prompt.
• Click Apply to save the changes.

• The group membership changes report provides a comprehensive audit of all membership changes across all Active Directory groups.
• It details who made changes, members added or removed, group type, group scope, etc.

To ensure users have the access they need, it’s vital to check whether they belong to all necessary groups. Instead of manually reviewing the membership of each group, you can streamline this process by directly identifying the groups they are member of. This approach simplifies access management and helps to maintain security by preventing unnecessary permissions.

Get AD user group membership using ADUC

• Open Active Directory Users and Computers by navigating to Server Manager » Tools.
• Double-click on the user's name and go to the Member Of tab.
• Here, you can find out all the Active Directory groups a user is a member of.

Check the Active Directory group membership of a user using PowerShell

Replace the <Username> with the sAMAccountName or the DistinguishedName of the Active Directory user for whom you want to retrieve group membership.

You can retrieve the sAMAccount name and Distinguished name of the user using the below cmdlet.

Get-ADUser -filter * | Select name, sAMAccountName, DistinguishedName

• With the detailed users’ group membership report from AdminDroid, you can identify the group membership of all AD users in one centralized location.
• This report details every group a user is a member of, along with relevant information such as group type, scope, and more.

Handy tip: AdminDroid empowers you to seamlessly export the report in various formats such as CSV, HTML, XLS, PDF, etc.

Domain local groups are used to include users from any domain within the forest, making it essential to monitor their memberships. Managing external users who belong to thesegroups can be challenging without access to their home domains. Thus, regularly checking the membership of domain local groups ensures that all users in the groups are authorized, thereby maintaining secure access between domains.

Get the group membership of domain local groups using Active Directory PowerShell

You can use this method to list all the users who are members of the domain local groups in your Active Directory environment.

Get-ADGroup -Filter {GroupScope -eq "DomainLocal" -and GroupCategory -eq "<GroupType>"} | Get-ADGroupMember

Replace <GroupType> with the desired group type, such as ‘Security’ or ‘Distribution’. This will list the security domain local groups and distribution domain local groups respectively.

Pro tip: You can replace the "DomainLocal" with other group scopes such as Universal or Global in the PowerShell cmdlet to get the membership of a specified group scope.

• AdminDroid provides group membership reports for each group type and scope, such security groups, domain local groups, global groups, and more. This offers clear insights into user memberships in Active Directory groups.
• Unlike PowerShell, these reports include details like the specific group names each user belongs to within the respective group type or scope. It also lists details such as member type, distinguished name, and more.

Contacts in Active Directory represent external users whose contact information is stored solely in the directory for communication purposes, distinguishing them from guest users. Contacts are typically added to distribution groups, enabling effective communication within the organization. To prevent the unintentional sharing of confidential emails, it is essential to regularly monitor the group memberships of these contacts in Active Directory.

Note: The usual method for retrieving object memberships (GetADPrincipalGroupMembership) did not return the group memberships of contacts in Active Directory, as they are considered a separate object class from users, groups, and computers.

Retrieve the group memberships of all contacts using PowerShell

• Open the Active Directory PowerShell with an administrator account.
• Run the below cmdlet to get the group membership of Active Directory contacts in your environment.

Get-ADObject -Filter {objectClass -eq "contact"} -Properties MemberOf | Select-Object Name, @{"Name=Groups"; Expression={ ($_."MemberOf" | ForEach-Object { (Get-ADGroup $_).Name}) -join ","}}

• Utilize the contacts group membership report from AdminDroid to effectively monitor and manage the groups to which your contacts belong.
• This report provides comprehensive details, including the group name, contact name, email address, department, and more.