How to Check AD Group Membership with Command Line

Best practices advise using Active Directory groups to grant access privileges to users — for example, access to specific computers, tools and servers. But over time, AD group configuration can get very complicated, making it challenging to understand who has access to what and ensure each user has only the permissions they need. IT admins often need to list the membership of each security group or detail all the groups that a particular user belongs to, and then either provide that information to departmental leaders for access privilege attestation, or analyze it themselves to fix broken inheritance and other issues.

You can check group membership with the Active Directory Users and Computers (ADUC) console snap-in by finding the user or group of interest and drilling down into the object’s properties and clicking the “Members” or “Member Of” tab. Another option is to get group membership with command line — you can use the dsget user and dsquery group tools from the Active Directory Domain Services (AD DS) package, or native NET commands from the command line. However, the results of the NET GROUP, NET USER and NET LOCALGROUP command are hard to parse, and while dsget and dsquery provide more structured output, those commandswork only on server versions of Windows and require you to input the distinguished name in LDAP Data Interchange Format. The last option is to use the Get-ADGroupMember PowerShell cmdlet, but that requires some scripting skills. As a result, reviewing Active Directory group membership with native tools can be both difficult and time consuming. 

Netwrix Auditor for Active Directory can save a great deal of precious time. Instead of checking AD group membership with command line, system operators can get a summary of group membership in a few clicks. In addition, Netwrix Auditor also reports on modifications, logon activity, and the configuration of Active Directory and Group Policy, including inactive user and computer accounts, Active Directory object permissions, and more. It will alert you to possible threats and offers an advanced search to speed investigations. You can take advantage of a wide variety of predefined reports, all with filtering, exporting and subscription options, and easily create your own custom reports. This comprehensive functionality streamlines many common IT tasks, from change monitoring and access control to privilege review and anomalous behavior detection.