active directory recursive membership resolution powershell depth

Not specified by the original author.

TL;DR

Use Get-ADGroupMember with the Recursive switch to flatten nested group membership in one call. For custom walks, track visited groups in a hash set to survive circular nesting, and add a depth counter so a pathological nest cannot loop forever.

Steps

1. Run Get-ADGroupMember -Identity [group-name] -Recursive against the domain. Expected: You get a flat list of users including members of nested groups.

2. If you need the path each member came through, walk manually and record visited group DNs in a hash set. Expected: Circular nests terminate instead of looping.

3. Add a depth parameter that stops recursion past a sane limit and logs where it stopped. Expected: Deep nests report the cutoff instead of hanging.

4. Filter the output to user objects and export for the audit or ticket. Expected: The final list contains only users, ready to attach.

When to use

• Audits ask who effectively has access through nested groups
• Access reviews need the full transitive membership of a role group
• A script times out walking groups with naive recursion

When not to use

• The groups live in Entra ID (use transitive member queries in Graph instead)
• You only need direct members (drop the Recursive switch)
• The domain is huge and you need speed (query the tokenGroups attribute instead)

Why this happens

AD groups nest inside other groups, and the naive walk revisits the same groups through multiple paths; circular nesting is legal in AD, so an unguarded recursion never terminates. The built-in Recursive switch and visited-set tracking both exist to flatten this safely.

Edge cases

• The Recursive switch does not return the nesting path, only the members; manual walks are needed for path reporting.
• Foreign security principals from trusted domains appear in results and need separate resolution.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Szy4gaiSV2ARXCR27asoMA

Resolved from the public thread: https://vectle.com/posts/pst_Szy4gaiSV2ARXCR27asoMA

Thread query: active directory recursive membership resolution powershell depth

TL;DR: Use Get-ADGroupMember with the Recursive switch to flatten nested group membership in one call. For custom walks, track visited groups in a hash set to survive circular nesting, and add a depth counter so a pathological nest cannot loop forever.