How to Check AD Group Membership with Command Line

Best practices advise using Active Directory groups to grant access privileges to users — for example, access to specific computers, tools, and servers. However, over time, AD group configuration can get very complicated, making it challenging to understand who has access to what and ensure each user only has the permissions they need. IT admins often need to check AD group members in Windows 10 or detail all the groups that a particular user belongs to and then either provide that information to departmental leaders for access privilege attestation or analyze it themselves to fix broken inheritance and other security issues.

You can view AD group membership with the Active Directory Users and Computers (ADUC) console snap-in by finding the user or group of interest, drilling down into the object’s properties, and clicking the “Members” or “Member Of” tab. Another option is to get group membership with the command line — you can use the dsget user and dsquery group tools from the Active Directory Domain Services (AD DS) package, or native NET commands from the command line. However, the results of the NET USER and NET LOCALGROUP commands are hard to parse. While dsget and dsquery can be used to query ad group membership and provide more structured output, those commands work only on server versions of Windows and require you to input the distinguished name in LDAP Data Interchange Format. The last option is to use the Get-ADGroupMemberPowerShell cmdlet, which requires some scripting skills. As a result, reviewing Active Directory group membership with native tools can be difficult and time-consuming. 

Netwrix Auditor for Active Directory can save a great deal of precious time. Instead of checking AD group membership with a command line, system operators can get a group membership summary in a few clicks. In addition, Netwrix Auditor also reports on modifications, logon activity, and the configuration of Active Directory and Group Policy, including inactive user and computer accounts, Active Directory object permissions, and more. It will alert you to possible threats and offers an advanced search to speed investigations. You can use various predefined reports, all with filtering, exporting, and subscription options, and easily create your custom reports. This comprehensive functionality streamlines many everyday IT tasks, from change monitoring and access control to privilege review and anomalous behavior detection.