$samAccountName = "a.azubi" $global:groupList = New-Object System.Collections.ArrayList function Get-GroupNameFromDn { [cmdletbinding()] param([string]$Dn) $a = $Dn.split(",") $b = $a[0] $name = $b.substring(3) return $name } function Get-ADNestedGroupMembersOf { [cmdletbinding()] param ( [String] $GroupName, [Int] $Depth ) $dn = (Get-ADGroup $GroupName).DistinguishedName $MemberOfs = Get-ADGroup -LDAPFilter ("(member:1.2.840.113556.1.4.1941:={0})" -f $dn) -ResultPageSize 1000 | select -expand DistinguishedName | sort DistinguishedName foreach($parent in $MemberOfs) { if($parent -notin $global:groupList) { $global:groupList.Add($parent) | Out-Null Get-GroupNameFromDn $parent } if($Depth -le 4) { Get-ADNestedGroupMembersOf -GroupName $parent -Depth ($Depth + 1) } } } $username = $samAccountName $dn = (Get-ADUser $username).DistinguishedName $groups = Get-ADGroup -LDAPFilter ("(member:1.2.840.113556.1.4.1941:={0})" -f $dn) | select -expand DistinguishedName | sort DistinguishedName foreach($group in $groups) { if($null -ne $group -and $group -notin $global:groupList) { $global:groupList.Add($group) | Out-Null Get-GroupNameFromDn $group Get-ADNestedGroupMembersOf -GroupName $group -Depth 1 } } $groups = Get-ADPrincipalGroupMembership $samAccountName | select -expand DistinguishedName | sort DistinguishedName foreach($group in $groups) { if($null -ne $group -and $group -notin $global:groupList) { $global:groupList.Add($group) | Out-Null Get-GroupNameFromDn $group Get-ADNestedGroupMembersOf -GroupName $group -Depth 1 } }