• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2660
  • Last Modified:

How do I get All Active Directory Members of Nested Groups - PHP

In Active Directory I would like to find ALL physical users that are in the Group, for example:
OU=Distribution Lists,OU=My_OU,DC=my-connection,DC=ch

Obtaining one level is rather straightforward - I get physical users and more Groups if they are present. I am using 'member' property for that.
Problem starts with going deeper, in scenario when Group contains Groups (which can then contain other Groups or finally physical users I am looking for). I wrote a recursive function for that, however I am getting only physical users that are just  one level down from Group I started a search from. While debugging I see that Groups are being processed by recursive function but are not passed to function's RETURN variable; only one level users are passed to this variable. What am I doing wrong ?
$members  Members(s) of a group
$ad  resource $link_identifier
function check_ad_data($members, $ad) 
  // get rid of array's 'count' key => value so not to include it for iteration
  foreach($members as $member) {
    // get entries of member from Active Directory
    $attributes = array("objectGUID", "mail", "name", "objectClass", "member");
    $filter = "(mail=*)";
    $result = ldap_search($ad, $member, $filter, $attributes); 
    $entries = ldap_get_entries($ad, $result);
    // if member is the Person
    if($entries[0]['objectclass'][1] == 'person') {
      // append a person's name to array
      $users[] = $entries[0]['name'][0];
    // if member is the Group
    if($entries[0]['objectclass'][1] == 'group') {
      // obtain all members of this group
      $membersOfGroup = $entries[0]['member'];    
      // call a recursive function
      check_ad_data($membersOfGroup, $ad);
  // return All the users
  return $users;

Open in new window

  • 2
1 Solution
Chris DentPowerShell DeveloperCommented:

Don't you have to set the return value to a variable?


$users = check_ad_data ...

And if that is the case, shouldn't you also be doing that here:

    if($entries[0]['objectclass'][1] == 'group') {
      $users = check_ad_data($membersOfGroup, $ad);

Because if $users only exists for the lifetime of the function (rather than globally) it will only update within the function. Maybe...

Chris DentPowerShell DeveloperCommented:

It's worth mentioning that the reason I'm not entirely sure about the above is that for anything like this I would use a global variable / array to store the results of the function. But then, I'm much more into the AD / administration side than the coding side :)

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Build your data science skills into a career

Are you ready to take your data science career to the next step, or break into data science? With Springboard’s Data Science Career Track, you’ll master data science topics, have personalized career guidance, weekly calls with a data science expert, and a job guarantee.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now