Description

A PowerShell script to find any instances of circular nested groups in the domain. The program finds and reports on all groups involved in circular nesting.

A useful feature of Active Directory is that groups can be nested. However, it is possible for the group nesting to be circular. For example, if group "Grade 1" is a member of group "Students", and group "Students" is a member of "School", and group "School" is a member of "Grade 1", the group nesting is circular.

This program efficiently finds all circular nested groups. It uses the System.DirectoryServices.DirectorySearcher class to retrieve all group names and their direct memberships. The member attribute of the groups is a collection of the Distinguished Names of all direct members, but does not reveal "primary" group membership. The program evaluates each group to track down members that are groups. As soon as a nested member is found that is identical to any parent group, the program has found an instance of circular nesting.

The program does not report on how the groups are nested. For example, if the program lists 5 groups, there are several ways the groups could be nested. There could be one instance involving the 5 groups, or one instance involving 2 groups and another
involving 3 groups. Given the group names you will need to track down how they are nested.

Script

PowerShell
Edit|Remove
Function CheckNesting ($Group, $Parents) 
{ 
    # Recursive function to enumerate group members of a group. 
    # $Group is the group whose membership is being evaluated. 
    # $Parents is an array of all parent groups of $Group. 
    # $Count is the number of groups involved in circular nesting. 
    # $GroupMembers is the hash table of all groups and their group members. 
    # $Count and $GroupMembers must have script scope. 
    # If any group member matches any of the parents, we have 
    # detected an instance of circular nesting. 
 
    # Enumerate all group members of $Group. 
    ForEach ($Member In $Script:GroupMembers[$Group]) 
    { 
        # Check if this group matches any parent group. 
        ForEach ($Parent In $Parents) 
        { 
            If ($Member -eq $Parent) 
            { 
                Write-Host "Circular Nested Group: $Parent" 
                $Script:Count = $Script:Count + 1 
                # Avoid infinite loop. 
                Return 
            } 
        } 
        # Check all group members for group membership. 
        If ($Script:GroupMembers.ContainsKey($Member)) 
        { 
            # Add this member to array of parent groups. 
            # However, this is not a parent for siblings. 
            # Recursively call function to find nested groups. 
            $Temp = $Parents 
            CheckNesting $Member ($Temp += $Member) 
        } 
    } 
} 
 
# Hash table of groups and their direct group members. 
$GroupMembers = @{} 
 
# Search entire domain. 
$Domain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() 
$Root = $Domain.GetDirectoryEntry() 
$Searcher = [System.DirectoryServices.DirectorySearcher]$Root 
 
$Searcher.PageSize = 200 
$Searcher.SearchScope = "subtree" 
$Searcher.PropertiesToLoad.Add("distinguishedName") > $Null 
$Searcher.PropertiesToLoad.Add("member") > $Null 
 
# Filter on all group objects. 
$Searcher.Filter = "(objectCategory=group)" 
$Results = $Searcher.FindAll() 
 
# Enumerate groups and populate Hash table. The key value will be 
# the Distinguished Name of the group. The item value will be an array 
# of the Distinguished Names of all members of the group that are groups. 
# The item value starts out as an empty array, since we don't know yet 
# which members are groups. 
ForEach ($Group In $Results) 
{ 
    $DN = [string]$Group.properties.Item("distinguishedName") 
    $Script:GroupMembers.Add($DN, @()) 
} 
 
# Enumerate the groups again to populate the item value arrays. 
# Now we can check each member to see if it is a group. 
ForEach ($Group In $Results) 
{ 
    $DN = [string]$Group.properties.Item("distinguishedName") 
    $Members = @($Group.properties.Item("member")) 
    # Enumerate the members of the group. 
    ForEach ($Member In $Members) 
    { 
        # Check if the member is a group. 
        If ($Script:GroupMembers.ContainsKey($Member)) 
        { 
            # Add the Distinguished Name of this member to the item value array. 
            $Script:GroupMembers[$DN] += $Member 
        } 
    } 
} 
 
# Count the number of circular nested groups found. 
$Script:Count = 0 
# Retrieve array of all groups in the domain. 
$Groups = $Script:GroupMembers.Keys 
# Enumerate all groups and check group membership of each. 
ForEach ($Group In $Groups) 
{ 
    # Check group membership for circular nesting. 
    CheckNesting $Group @($Group) 
} 
 
Write-Host "Number of circular nested groups found = $Script:Count"