COMMAND EVERYTHING.
Review group memberships for a directory principal during an access investigation.
Active Directory · Risk: Low · Documentation VerifiedLast verified: 2026-10-26
Returns directory groups for the selected principal. This cmdlet requires a global catalog; results do not establish effective access to a resource.
Get-ADPrincipalGroupMembership [-AuthType <ADAuthType>] [-Credential <PSCredential>] [-Identity] <ADPrincipal>
[-Partition <String>] [-ResourceContextPartition <String>] [-ResourceContextServer <String>]
[-Server <String>] [<CommonParameters>]Directory read access appropriate to the requested objects is required. Replication diagnostics may require additional delegated directory permissions; use an approved administrative account where necessary.
Windows / ActiveDirectory module · Windows Server 2025 PowerShell reference; RSAT module and domain capabilities determine availability
-Identity (required)Windows with the ActiveDirectory PowerShell module (RSAT), connectivity to an appropriate directory server, and an authenticated directory context. Replace example identities and hosts with authorized targets.
Read-only example. Directory identities, group membership, policies, and topology can expose sensitive organizational information. Store and share results only with authorized recipients.
Get-ADPrincipalGroupMembership -Identity 'example.user'Returns directory groups for the selected principal. This cmdlet requires a global catalog; results do not establish effective access to a resource.
Sign in to keep your own command reference lists.
Explain or customize this command with AI