How to Get All Group Membership of a User Using PowerShell

To list a user’s Active Directory memberships, choose among the legacy net command, ADSI, DirectorySearcher, or the Active Directory module. The first three use Windows directory services without installing that module; the cmdlet is the most direct option when the module is available. These methods require connectivity to a domain controller and an account allowed to read the directory. “All” here means the memberships each query returns: directory memberOf attributes and these examples show direct group links, not a complete transitive membership expansion. They also do not necessarily include a user’s primary group.

Get a User’s Group Membership With net Legacy Commands

Run net user /domain to ask the domain for the signed-in account’s information. The result includes its global domain group memberships. Supply a username to query another domain account with net user username /domain.

This is a legacy command-line tool that PowerShell can invoke directly; it is not a PowerShell alias. Its output is formatted for display, so use an Active Directory query when you need structured objects or to process group names in a script. This command reports domain information rather than the user’s local computer-group membership.

Get a User’s Group Membership With ADSI

ADSI is a Windows directory-services interface available through PowerShell’s [adsisearcher] type. This query uses the signed-in account name and returns its memberOf values as distinguished names. In a domain-connected PowerShell session, run $searcher = [adsisearcher]"(samAccountName=$($env:USERNAME))"; $result = $searcher.FindOne(); if ($null -ne $result) { $result.Properties.memberof }.

Each value identifies a group by its LDAP distinguished name, including its organizational path. The filter targets the account whose name is in $env:USERNAME; it does not select a different user. memberOf represents direct links and does not list the primary group. This approach needs no separate PowerShell module, but it still needs a directory connection and permission to read the account. The query depends on the environment’s ability to resolve and search Active Directory; this article provides no domain-runtime results to claim otherwise.
To display the common-name portion from sample distinguished names, apply a regular expression to the returned strings:

$memberOf = @(
    "CN=Finance,OU=Groups,DC=example,DC=com",
    "CN=Engineering,OU=Groups,DC=example,DC=com"
)
$memberOf -replace '^CN=([^,]+).+$', '$1'

Finance
Engineering

This transformation removes the LDAP path from each supplied string; it does not run a directory query. The regular expression assumes the common name contains no escaped comma.

Get a User’s Group Membership With a New Object

DirectorySearcher provides another built-in way to search for a named account. This example deliberately accepts only an ASCII sAMAccountName made of letters, digits, periods, underscores, or hyphens, with a maximum of 20 characters. Reject any other input before building the LDAP filter: if ($username -notmatch '^[A-Za-z0-9._-]{1,20}$') { throw 'Use a valid account name.' }. Once validated, run $searcher = New-Object System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$username))"); $result = $searcher.FindOne(); if ($null -ne $result) { $result.Properties.memberof }. The restricted character set prevents the supplied value from adding LDAP filter syntax; use LDAP filter escaping instead if your directory allows account names outside this example’s set.

The returned values are LDAP distinguished names, not just group names. Replace user01 with the target account’s logon name. Like the ADSI example, this reads the memberOf attribute and therefore does not expand nested membership or include the primary group. It requires access to a domain directory; no separate module installation is involved.

Get a User’s Group Membership With the Active Directory Module

The Active Directory module supplies cmdlets designed for directory administration. It must already be available on the computer; Install-Module by itself does not install this Windows module. Install RSAT by following the Microsoft instructions that apply to the Windows version in use. This article does not establish version-specific RSAT commands or compatibility, so no such command is included here.

Installing the Active Directory Module

After installing the applicable RSAT component, import the module in the PowerShell session with Import-Module -Name ActiveDirectory.

If the module is unavailable, the import command cannot load it. Installation steps vary by Windows release, so consult Microsoft’s current RSAT guidance for that release instead of reusing a command for a different version.

Using the Get-ADPrincipalGroupMembership Cmdlet

Pass a user’s account name to Get-ADPrincipalGroupMembership, then select the group names for a concise display with Get-ADPrincipalGroupMembership -Identity "user01" | Select-Object -ExpandProperty Name.

Replace user01 with the target identity. The cmdlet returns group objects for groups associated with that principal; selecting Name displays their names rather than LDAP distinguished names. The command requires the Active Directory module, suitable directory connectivity, and read access. These examples have no execution evidence from a Windows domain environment, so their domain-dependent output and behavior are not presented as tested.