How to get repitative group a user is member of

Question

Hi,
i have a user in our domain who is member of number of groups. This means in MemberOF tab of the user there are larg number of groups. Now i want to remove some groups which are repitated.
Example -
1. In MemberOf Tab - properties  tab -- of John, there are 3 DL/SG "Group_1" and "Group_2" and "Group_3".   
2. Now "Group_3" is a member of "group_1". So i want to remove "Group_3" from the MemberOf Tab of John properties. This will reduce the MemberOf List.  
3. how to do i find this repetative Groups using powershell ?
Please let me know if my query is not clear.
Thanks for your help.

Answer 1

The following PowerShell script worked well in my test domain. I did not use the AD Module cmdlets, as they are generally slower when you deal with large resultsets (all groups and all users in the domain). This script simply outputs all cases where any
user is a member of both a group, and a nested member of the group. This will reveal the extent of issue, and whether you want to "correct" all such cases. In place of the statement that outputs the cases, you can add code to "correct"
it (remove membership in $Member, the child group, for the user).
# UserNestedGroups.ps1
# Script to find cases where users are members of both a group and a
# nested group member of the group.
# Hash table of groups and their direct group members.
$GroupMembers = @{}
# Search entire domain.
$Domain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
$Root =
$Domain.GetDirectoryEntry()
$Searcher = [System.DirectoryServices.DirectorySearcher]$Root
$Searcher.PageSize
= 200
$Searcher.SearchScope
= "subtree"
$Searcher.PropertiesToLoad.Add("distinguishedName") >
$Null
$Searcher.PropertiesToLoad.Add("member") >
$Null
# Filter on all group objects.
$Searcher.Filter =
"(objectCategory=group)"
$Results =
$Searcher.FindAll()
# Enumerate groups and populate Hash table. The key value will be
# the Distinguished Name of the group. The item value will be an array
# of the Distinguished Names of all members of the group that are groups.
# The item value starts out as an empty array, since we don't know yet
# which members are groups.
ForEach ($Group
In $Results)
    $DN
= [string]$Group.properties.Item("distinguishedName")
    $Script:GroupMembers.Add($DN, @())
# Enumerate the groups again to populate the item value arrays.
# Now we can check each member to see if it is a group.
ForEach ($Group
In $Results)
    $DN
= [string]$Group.properties.Item("distinguishedName")
    $Members
= @($Group.properties.Item("member"))
    # Enumerate the members of the group.
    ForEach ($Member
In $Members)
        # Check if the member is a group.
        If ($Script:GroupMembers.ContainsKey($Member))
            # Add the Distinguished Name of this member to the item value array.
            $Script:GroupMembers[$DN] +=
$Member
# Retrieve all user objects and their direct group memberships (except primary).
$Searcher2 = [System.DirectoryServices.DirectorySearcher]$Root
$Searcher2.PageSize
= 200
$Searcher2.SearchScope
= "subtree"
$Searcher2.PropertiesToLoad.Add("distinguishedName") >
$Null
$Searcher2.PropertiesToLoad.Add("memberOf") >
$Null
# Filter on all user objects.
$Searcher2.Filter =
"(&(objectCategory=person)(objectClass=user))"
$Results =
$Searcher2.FindAll()
# Enumerate users and their direct group memberships.
ForEach ($User
In $Results)
    $DN
= [string]$User.properties.Item("distinguishedName")
    $Groups
= @($User.properties.Item("memberOf"))
    ForEach ($Group
In $Groups)
        # Enumerate all group members of $Group.
        ForEach ($Member
In $Script:GroupMembers[$Group])
            # Check if user is also a member of $Member.
            If ($Groups
-Contains $Member)
                "User $DN is a member of:`n  Parent: $Group`n  Child: $Member"
Note, if you copy the script above you will need to correct the cases of word wrapping. I try to avoid using scroll bars, even for code.
Richard Mueller - MVP Directory Services