How to list the users and groups of an AD Security Group when not a domain admin

I am on Windows 8 connected to domain.

I wish to view the users and groups of an AD Security group. I am not the owner of the group. The command:

net group /domain TheGroupName

shows the direct users of that group but does not show the groups within the group.

As an alternative to the Windows 8, I also have remote access to a Windows Server 2008 R2 and am an admin for that machine but not an admin for the domain. The program "dsget" does not appear to be installed.

This question is expanding on this one (511715)


Go to 'Computer', click on 'Network' from the left menu, in the top bar select 'Search Active Directory'

You should be able to search for groups and view membership here, even if not an admin.

Access 'Search Active Directory'


Run this from a command prompt to get the complete membership of an AD group (users AND groups). Tested on Windows 10.

Rundll32 dsquery.dll OpenQueryWindow

There's a handy Advanced Tab in there that supports partial string searches (starting with, ending with).


Sysinternals offers AD Explorer, a utility for listing the complete LDAP structure of an AD forest. It’s slighty overkill for your intended use, though.

I don’t know which permissions exactly are necessary for querying this data, but I guess any logged-in user can do it. I never had any problems querying just about everything, but maybe the domain at work isn’t secured properly.

Usability note: You need not enter your credentials if you’re logged on as a domain user.

You do, however, need the IP address or host name of a Domain Controller. It’s likely this is the same as your DNS server, so just fire up nslookup and try the address displayed there.