Export nested groups a contact is a memberOf - powershell

Question

I'm using Exchange 2010 and Powershell.
I'm looking to export all 'nested' distribution groups that a exchange contact is a part of.
For example, if a contact is a memberOf two DG, A and B. And group A is also a memberOf Group C. I'd like a list the show all three groups.
Group C
----|-----------|
Group A Group B
|
Contact
Here is my very noob attempt at this. I guess it needs to be done recursively?
$contact = get-contact email#domain.com.au
$members = Get-ADObject -Identity $contact.Guid -Properties 'MemberOf'
foreach ($group in $members.MemberOf) {
foreach ($_ in $group.memberof ){
get-distributiongroup $_
}
}
Must be able to do this for a 'contact', not a user.
Thanks in advance!

Answer 1

You don't really need Exchange to get distribution groups.
Here's my example to retrieve names of groups assuming your contact is AD user with mail property filled:
function Get-GroupsRec
{
[CmdletBinding()]
param(
[Parameter(ValueFromPipeline=$true)]
$Identity
)
BEGIN {}
PROCESS{
if($Identity -eq $null){return}
Write-Output $Identity | select -ExpandProperty samaccountname
$Identity | Get-ADPrincipalGroupMembership | ?{$_.GroupCategory -eq "Distribution"} | Get-GroupsRec}
END{}
}
Get-ADUser -Filter {mail -eq 'email#domain.com.au'} | Get-ADPrincipalGroupMembership | ?{$_.GroupCategory -eq "Distribution"} | Get-GroupsRec
But as long as you can retrieve AD user, this solution is valid.
UPDATE:
Version basing on Get-ADObject only. (Same structure, only different selectors. Left ObjectClass in filter for readability):
function Get-GroupsRec
{
[CmdletBinding()]
param(
[Parameter(ValueFromPipeline=$true)]
$Identity
)
BEGIN {}
PROCESS{
if($Identity -eq $null){return}
Write-Output $Identity | select -ExpandProperty Name
$Identity | select -ExpandProperty MemberOf | Get-ADObject -Properties GroupType,MemberOf |?{$_.GroupType -gt 0 -and $_.ObjectClass -eq 'group'} | Get-GroupsRec }
END{}
}
Get-ADObject -Filter {mail -eq 'email#domain.com.au'} -Properties MemberOf | select -ExpandProperty MemberOf | Get-ADObject -Properties GroupType,MemberOf |?{$_.GroupType -gt 0 -and $_.ObjectClass -eq 'group'} | Get-GroupsRec
If you want restrict group type to a specific type, you may modify GroupType in code to any value with -band operator. The enumerator values are available at: https://msdn.microsoft.com/en-us/library/aa772263(v=vs.85).aspx

Answer 2

You are on the right track. You indeed need recursion for this. I quickly put something together which should recusively resvolves membership. Hope this helps!
Function Get-Groups {
Param(
[string]$Identity
)
$members = Get-ADObject -Identity $Identity -Properties "MemberOf"
$members.MemberOf | % {
if($(Get-ADObject $_ -Properties "GroupType").grouptype -gt 0) {
Write-Host $_
}
Get-Nestedmember $_ "->"
}
}
Function Get-Nestedmember {
Param(
[String]$Identity,
[string]$Depth
)
$members = (Get-ADobject -Identity $Identity -Properties "MemberOf").memberof
$count = $members | measure
if($count -ne 0) {
$members | % {
if($(Get-ADObject $_ -Properties "GroupType").grouptype -gt 0) {
Write-host "$Depth $_"
}
Get-Nestedmember $_ "-$Depth"
}
}
}
Get-Groups -Identity '<Your Identity goes here>'
It gets a MemberOf relationships and does that again for the resulting set. If MemberOf returns 0 that means there are no more MemberOf relationships so we stop.