Tired of untangling nested Active Directory security groups? Learn how to go from quick PowerShell fixes to robust, automated auditing solutions to finally get a handle on who has access to what.

I See Your Nested AD Group, and I Raise You a Production Outage

I’ll never forget the Monday morning call. It was one of those “all hands on deck, production is on fire” situations. A critical database, prod-db-01, had its configuration altered over the weekend, and it took us two hours to figure out who did it. The culprit? An intern who had left the company two weeks prior. His account was still active and, worse, he was a member of a group that gave him admin rights to that server. How? Because his “Interns-Summer2023” group was added to the “All-Dev-Contractors” group for a temporary project, which was nested inside the “Global-Dev-Team” group, which… you get the picture. It was a Matryoshka doll of permissions, and we had no idea how deep it went. We’ve all been there, staring at an access list, wondering how on earth that user got those permissions.

The Root of the Problem: Privilege Creep and the Nesting Nightmare

Let’s be real, this isn’t about one person making a mistake. This is a systemic issue in almost every Active Directory environment I’ve ever touched. It boils down to two things:

• Privilege Creep: Over time, users accumulate permissions as they change roles or work on projects, but those permissions are rarely revoked.
• Nested Groups: What starts as a convenient way to manage access (“Just add the Devs group to the DB Admins group for this project”) becomes an un-auditable mess. You can’t just look at the members of sg-prod-db-admins; you have to recursively unpack every group within that group, and every group within *those* groups.

When security asks “Who has access to this resource?”, you can’t just send them a screenshot of the group’s “Members” tab. You need to provide a full, accurate, and recursive list. So, how do we get there without losing our minds?

Solution 1: The “I Need an Answer NOW” PowerShell Quick Fix

It’s 4:45 PM on a Friday and a compliance manager is standing at your desk. You don’t need a perfect report; you need a fast answer. This is where a simple PowerShell command comes to the rescue. It’s not pretty, but it’s effective for a one-off query.

The magic here is the -Recursive switch for Get-ADGroupMember. It does the heavy lifting of unwrapping all those nested groups for you.

# Fire up PowerShell with the Active Directory module loaded
# Replace 'sg-prod-db-admins' with your target group name

Get-ADGroupMember -Identity "sg-prod-db-admins" -Recursive | Select-Object name, samaccountname | Sort-Object name

This command will spit out a simple list of every single user account that is a member of that group, no matter how deeply nested they are. You can copy-paste this into an email and be on your way to the weekend. It’s a reactive, manual fix, but sometimes that’s all you need.

Solution 2: The Proactive, “Let’s Get Ahead of This” Scheduled Report

Okay, the quick fix is great, but you can’t build a proper audit process on it. The next logical step is to automate this process. We can build a more robust PowerShell script that checks a list of critical groups and emails a report on a schedule (say, every Monday morning). This moves you from being reactive to proactive.

This script will loop through a list of your “crown jewel” security groups, get the recursive membership for each, and then export it all to a CSV file that can be reviewed by security or management.

# Define your critical groups
$CriticalGroups = @(
    "sg-prod-db-admins",
    "Domain Admins",
    "Enterprise Admins",
    "sg-azure-global-admins"
)

# Prepare a container for all the results
$AllMembers = @()

# Loop through each group and get its members
foreach ($Group in $CriticalGroups) {
    Write-Host "Processing group: $Group"
    try {
        $Members = Get-ADGroupMember -Identity $Group -Recursive -ErrorAction Stop
        foreach ($Member in $Members) {
            # We only care about users, not other groups
            if ($Member.objectClass -eq 'user') {
                $Properties = [ordered]@{
                    CheckedGroup = $Group
                    UserName     = $Member.Name
                    SAMAccountName = $Member.SamAccountName
                }
                $AllMembers += New-Object psobject -Property $Properties
            }
        }
    }
    catch {
        Write-Warning "Could not find or process group: $Group"
    }
}

# Export the results to a timestamped CSV file
$Timestamp = Get-Date -Format "yyyyMMdd-HHmm"
$ReportPath = "C:\AuditReports\ADGroupAudit_$Timestamp.csv"
$AllMembers | Export-Csv -Path $ReportPath -NoTypeInformation

Write-Host "Report complete! Saved to $ReportPath"

You can set this script up as a Scheduled Task on a utility server to run weekly. Now, when the auditor comes asking, you have a historical record ready to go.

Pro Tip: Use the “Description” field in Active Directory for your security groups! A group named sg-project-x-temp is meaningless in six months. A description like “Gives temp contractor team RDP access to web-tier servers for Project X, expires 2024-12-31. See JIRA-123” is a lifesaver.

Solution 3: The “We’re a Grown-Up Company Now” Option

At some point, scripts just don’t cut it anymore. When your company grows, when you have hundreds of critical groups, strict compliance requirements (like SOX or HIPAA), and a dedicated security team, you’ve outgrown the DIY approach. Manually reviewing CSV files becomes a full-time job, and it’s still prone to error.

This is where you invest in a dedicated Identity and Access Management (IAM) or Privileged Access Management (PAM) tool. Think of solutions like:

Yes, these tools cost money. But you have to weigh that cost against the salary of an engineer spending half their time managing audit scripts, or the cost of a single security breach caused by an intern with forgotten admin rights. At TechResolve, we hit this point about three years ago, and investing in a proper PAM solution was one of the best decisions we ever made for our security posture.

The journey from a one-liner script to a full-blown IAM solution is a natural one. Start where you are, automate what you can, and know when it’s time to call in the big guns. Good luck.

Darian Vance

Lead Cloud Architect & DevOps Strategist

With over 12 years in system architecture and automation, Darian specializes in simplifying complex cloud infrastructures. An advocate for open-source solutions, he founded TechResolve to provide engineers with actionable, battle-tested troubleshooting guides and robust software alternatives.

🤖 Frequently Asked Questions