Active Directory Nested Group Membership Reports*

IT security analysts and IT administrators very often have a need to determine the complete expanded membership of nested Active Directory security groups. Determining the complete membership of nested security group memberships is essential for determining who all is provisioned access via membership in the group, on all IT assets which use this security group to control access.

Nested security groups are security groups that are members of other security groups. For instance, in the illustration below, Group 1 is a member of Group 2 which is further a member of Groups 3 and 4, and so on and so forth. It is not unusual for security groups to be nested in other security groups.

Manual determination of Active Directory nested group memberships can be complicated because security groups could be easily nested to 4 or 5 levels, and some nested security groups could be members of each other thus creating loops which can be problematic when using scripts.

In addition, the expansion of certain well-known groups such as Domain Users can create additional work as these group memberships may have to be dynamically calculated. Finally, because nested group members could belong to multiple domains, IT administrators may need to query each of these domains to arrive at the final fully expanded group membership of a nested group.

Gold Finger completely automates the generation of accurate Active Directory Nested Group Memberships and lets IT administrators instantly and accurately assess, analyze and print the complete expanded nested group memberships of any nested security group in Active Directory.

Gold Finger automatically takes care of all underlying technical details such as conflict avoidance, well-known group expansions etc. to instantly deliver the complete and accurate expanded set of any nested group membership.

The complete nested group membership of any Active Directory can be viewed by using the the Membership Reports capability.

Gold Finger also provides the ability to filter the completed expanded nested group membership by security principal. You can filter results such that it displays only all user-account members, or all computer-account members, or all security-group members, or display all its members.

In addition, Gold Finger offers 100+ additional Active Directory reports spanning over 8 IT management categories, and the industry's only accurate Active Directory delegated access reports, so IT administrators can efficiently and reliably fulfill all their security and access reporting needs.