How to Get Nested Group Membership Report in Active Directory

Nesting groups in Active Directory provide an efficient way to manage permissions within larger groups with specific scopes. Instead of assigning permissions to each user individually, administrators can assign them to groups. As a result, nested groups automatically inherit those permissions. This structure creates a clear hierarchy that simplifies access management across the environment.

Create a nested group in Active Directory

• Open the Active Directory Users and Computers console, navigate to the respective OU, and double-click the group you want to nest.
• In the Properties window, go to the Member Of tab, and click Add.
• Specify the parent group’s name in the Enter the object names to select field, click Check Names, and select the group.
• If you want to add more than one group, repeat this step to add all the required groups.
• After selecting all the required groups, click OK.
• Finally, click Apply and then OK to save your changes.

Configure a nested group in Active Directory using PowerShell

• Utilize AdminDroid’s Active Directory management actions to configure nested group memberships instantly.
• With this feature, you can nest multiple groups at once and ensure efficient, hassle-free Active Directory management.

Over time, nested groups can accumulate redundant memberships, which complicate access management. Additionally, in certain cases, circular nesting occurs, where groups become members of each other in a loop. This creates a confusing web of inherited permissions that may result in chaotic permission assignments in Active Directory.

Remove a group from a nested group in Active Directory

• Open the ADUC console, navigate to the desired parent group, and doube-click it.
• In the Properties window, go to the Members tab, then select the nested group you want to remove.
• Click Remove, then choose Yes in the confirmation dialog box to proceed, and finally select OK to save the changes.

Remove a group from a nested group using PowerShell

Handy tip💡: In addition to robust reporting, AdminDroid’s management capabilities allow you to remove nested group memberships directly from the report. Just navigate to Remove From Group option under Active Directory Management Actions»Membership to remove the nested group.

Group nesting is one of the most powerful techniques to effectively manage permissions and access in Active Directory. However, without a clear strategy, it can quickly become complex and difficult to manage permissions in Active Directory.

Note: Distribution groups are meant for email communication, not for permissions. Avoid nesting them into security groups to prevent security vulnerabilities in permission management.

For users within a single domain (AGDLP Model)

When all members belong to the same Active Directory domain, follow these steps to structure group nesting effectively:

For users across multiple domains (AGUDLP Model)

For environments with multiple trusted domains, implement nesting using this approach:

In large organizations, administrators often rely on group nesting to simplify the assignment of resource access for their members. By identifying all groups that are nested within a particular group, organizations can gain complete visibility into group hierarchies and ensure that each group inherits only the necessary privileges. Since native methods fall short in this regard, we can use PowerShell to list all nested groups in Active Directory.

Find all nested groups in Active Directory using PowerShell

Execute the script below to get a list of groups within a nested Active Directory group.

$AllGroups = Get-ADGroup -Filter *
$GroupsWithNested = foreach ($Group in $AllGroups) {
    $NestedGroups = Get-ADGroupMember -Identity $Group.SamAccountName -Recursive:$false | Where-Object { $_.objectClass -eq 'group' }
    if ($NestedGroups) {
        [PSCustomObject]@{
            GroupName    = $Group.SamAccountName
            NestedGroups = ($NestedGroups | Select-Object -ExpandProperty SamAccountName) -join ", "
        }}}
  $GroupsWithNested | Format-Table -AutoSize

Stay informed in real time with AdminDroid by getting email and Teams notifications for unauthorized changes in all nested groups.

In Active Directory, it's common to have a group as a member of another group at multiple levels. Unfortunately, it is also possible to create a group as a member of itself, directly or indirectly, which forms a circular relationship. These circular nestings turn a neat system into a tangled mess and make it difficult for administrators to track its membership details.

Detect circular nested groups in Active Directory using PowerShell

Run the following PowerShell script to find all circularly nested groups in Active Directory.

function Find-CircularGroups {
    param($Group, $Path = @($Group))
    try {
        $groupInfo = Get-ADGroup $Group -ErrorAction Stop
        $members = Get-ADGroupMember $Group -ErrorAction Stop | Where-Object { $_.objectClass -eq 'group' }
    } catch { return }
    foreach ($member in $members) {
        if ($Path -contains $member.Name) {
            [PSCustomObject]@{
                CircularNestedGroup = $Group
                GroupScope          = $groupInfo.GroupScope
                GroupType           = $groupInfo.GroupCategory
                CircularType        = if ($Path[-1] -eq $member.Name) { "Direct" } else { "Indirect" }
                NestedPath          = ($Path + $member.Name) -join " / "
            }
        } else {
            Find-CircularGroups $member.Name ($Path + $member.Name)
        }}}
  $CircularNested = Get-ADGroup -Filter * | ForEach-Object { Find-CircularGroups $_.Name }
if (!$CircularNested.Count) { 
    Write-Host "No circular nested groups found." 
} else { 
    $CircularNested | Format-Table -AutoSize
}

While nested groups simplify the process of giving access to resources, they also introduce certain complexities such as group policy inconsistencies, authentication & authorization failures and more. Therefore, administrators must understand both the advantages and disadvantages of using nested group features to leverage them effectively and avoid potential pitfalls.

Advantages of nesting groups in Active Directory

Disadvantages of nested groups in Active Directory