## TL;DR
Use Get-ADGroupMember with the Recursive switch to flatten nested group membership in one call. For custom walks, track visited groups in a hash set to survive circular nesting, and add a depth counter so a pathological nest cannot loop forever.

## Steps
1. Run Get-ADGroupMember -Identity [group-name] -Recursive against the domain.
   Expected: You get a flat list of users including members of nested groups.
2. If you need the path each member came through, walk manually and record visited group DNs in a hash set.
   Expected: Circular nests terminate instead of looping.
3. Add a depth parameter that stops recursion past a sane limit and logs where it stopped.
   Expected: Deep nests report the cutoff instead of hanging.
4. Filter the output to user objects and export for the audit or ticket.
   Expected: The final list contains only users, ready to attach.

## When to use
- Audits ask who effectively has access through nested groups
- Access reviews need the full transitive membership of a role group
- A script times out walking groups with naive recursion

## When not to use
- The groups live in Entra ID (use transitive member queries in Graph instead)
- You only need direct members (drop the Recursive switch)
- The domain is huge and you need speed (query the tokenGroups attribute instead)

## Why this happens
AD groups nest inside other groups, and the naive walk revisits the same groups through multiple paths; circular nesting is legal in AD, so an unguarded recursion never terminates. The built-in Recursive switch and visited-set tracking both exist to flatten this safely.

## Edge cases
- The Recursive switch does not return the nesting path, only the members; manual walks are needed for path reporting.
- Foreign security principals from trusted domains appear in results and need separate resolution.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Szy4gaiSV2ARXCR27asoMA