sqmSQLTool › Commands › Get-sqmADMemberGroups

Get-sqmADMemberGroups Configuration

Inverse of Get-sqmADGroupMembers — finds all AD groups that contain a specified user, group, or computer. Resolves parent groups up to a configurable depth. Falls back from Get-ADPrincipalGroupMembership to a LDAP DirectorySearcher query. Pipeline-capable.

Execution Flow

START ADSI RootDSE check ADSI OK? throw ERROR NO foreach $member in $Identity [pipeline] Resolve domain, clean identity Find-ParentGroups (recursive helper, Depth-limited, cycle-safe) Check $Visited → skip if already processed Try: Get-ADPrincipalGroupMembership → parent groups Skip "Domain Users" Catch: LDAP fallback → (objectClass=group)(member=DN) Recurse parent groups up to $MaxDepth Return groups[] with Depth + GroupScope Sort-Object -Unique by SamAccountName ShouldProcess → write TXT + CSV Build result: Identity/Depth/GroupCount/Groups[] Return $allResults[] DONE

Synopsis

Finds all AD groups that a given identity (user, group, or computer) belongs to, optionally traversing parent groups up to -Depth levels. Inverse operation to Get-sqmADGroupMembersRecursive. Useful for auditing SQL Server access when a login is granted via nested group membership.

Does not require dbatools. Requires LDAP connectivity to a domain controller. "Domain Users" is always excluded from results.

Syntax

Get-sqmADMemberGroups
    -Identity <String[]>    # required, pipeline
    [-Domain <String>]
    [-Depth <Int>]           # 0-10, default 2
    [-OutputPath <String>]

Parameters

ParameterTypeDefaultDescription
-IdentityString[]RequiredSamAccountName, UPN, or DistinguishedName of the user/group/computer. Pipeline-capable.
-DomainStringauto-detectAD domain. Auto-detected from current domain if omitted.
-DepthInt2Maximum nesting depth for parent group traversal (0–10).
-OutputPathStringC:\System\WinSrvLog\MSSQLDirectory for TXT and CSV report files.

Return Value

PropertyDescription
IdentityResolved identity (domain prefix stripped).
DomainAD domain used.
DepthMaximum depth used for parent traversal.
GroupCountNumber of unique parent groups found.
GroupsList with SamAccountName, DisplayName, GroupScope, Depth.
TxtFile / CsvFileWritten report file paths.
StatusOK / NoGroups / Error.

Examples

# Which groups does john.doe belong to? (up to 2 levels)
Get-sqmADMemberGroups -Identity "john.doe" -Depth 2

# Check group membership of a computer account
Get-sqmADMemberGroups -Identity "SQL01$"

# Multiple identities via pipeline
"john.doe","svc_sql" | Get-sqmADMemberGroups -Depth 3