SERVER-016 · Script

Audit Privileged Group Membership

Lists everyone with administrative rights in the domain, including through nested groups, and flags risky members.

Version 1.0.0Language PowerShellUpdated November 2026Report only, changes nothing

What it does

Expands these built-in groups, following nested groups all the way down: Domain Admins, Enterprise Admins, Schema Admins, Administrators, Account Operators, Server Operators, Backup Operators, Print Operators, Group Policy Creator Owners, Key Admins, Enterprise Key Admins, plus DnsAdmins if it exists For each person or computer found, the report shows the group, the nesting path, and flags:

Disabled: the account is turned off but still holds the rights
Stale: no sign-in for -StaleDays (default 90)

Password never expires

Not approved: not on your -ApprovedMembers list (only when you supply one)

Enterprise and Schema groups exist only in the forest root domain and are skipped elsewhere. Read-only; changes nothing.

Requirements

Windows PowerShell 5.1 and the ActiveDirectory module (RSAT). Any domain account can usually read group membership.

How to run it

Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
Script type: PowerShell 5.1, 64-bit
User interaction: none; the script never prompts
Timeout: 30 minutes for large directories or many servers

Settings

Name	What it does	Options	Default
ApprovedMembers	Sign-in names that are expected to hold admin rights. Anyone else is flagged as Not approved.		(none)
StaleDays	Days without a sign-in before an account is flagged. Default: 90.		90
AlertOn	Unapproved (default) exits 1 when someone is not on -ApprovedMembers. Any exits 1 for any flag. Never always exits 0.	Unapproved, Any, Never	Unapproved
Server	Optional domain controller to read from.

Exit codes

0 = Nothing that matches AlertOn
1 = Flagged members found (see AlertOn)
2 = Script error (see log)

Testing steps

Run it on one test OU, test account or test server and check the output and log.
Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
Roll out to a small group next, then everyone.

Rollback steps

Report only. Nothing is changed, so nothing needs to be rolled back.

Version and change log

Version	Date	Changes
1.0.0	November 2026	First release.