How do I get All Active Directory Members of Nested Groups - PHP

Posted on 2008-10-17
Last Modified: 2013-12-24
In Active Directory I would like to find ALL physical users that are in the Group, for example:
OU=Distribution Lists,OU=My_OU,DC=my-connection,DC=ch

Obtaining one level is rather straightforward - I get physical users and more Groups if they are present. I am using 'member' property for that.
Problem starts with going deeper, in scenario when Group contains Groups (which can then contain other Groups or finally physical users I am looking for). I wrote a recursive function for that, however I am getting only physical users that are just  one level down from Group I started a search from. While debugging I see that Groups are being processed by recursive function but are not passed to function's RETURN variable; only one level users are passed to this variable. What am I doing wrong ?

$members  Members(s) of a group

$ad  resource $link_identifier


function check_ad_data($members, $ad) 


  // get rid of array's 'count' key => value so not to include it for iteration



  foreach($members as $member) {


    // get entries of member from Active Directory

    $attributes = array("objectGUID", "mail", "name", "objectClass", "member");

    $filter = "(mail=*)";

    $result = ldap_search($ad, $member, $filter, $attributes); 

    $entries = ldap_get_entries($ad, $result);



    // if member is the Person

    if($entries[0]['objectclass'][1] == 'person') {

      // append a person's name to array

      $users[] = $entries[0]['name'][0];



    // if member is the Group

    if($entries[0]['objectclass'][1] == 'group') {

      // obtain all members of this group

      $membersOfGroup = $entries[0]['member'];    

      // call a recursive function

      check_ad_data($membersOfGroup, $ad);




  // return All the users

  return $users;


Open in new window

Question by:greeni
  • 2
LVL 70

Accepted Solution

Chris Dent earned 500 total points
ID: 22739135

Don't you have to set the return value to a variable?


$users = check_ad_data ...

And if that is the case, shouldn't you also be doing that here:

    if($entries[0]['objectclass'][1] == 'group') {
      $users = check_ad_data($membersOfGroup, $ad);

Because if $users only exists for the lifetime of the function (rather than globally) it will only update within the function. Maybe...

LVL 70

Expert Comment

by:Chris Dent
ID: 22739178

It's worth mentioning that the reason I'm not entirely sure about the above is that for anything like this I would use a global variable / array to store the results of the function. But then, I'm much more into the AD / administration side than the coding side :)


Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
finding who created AD 4 45
Multiple Domains 8 21
Why does my array not "dump?" 5 19
Post xml via PHP Soap Client 3 10
Creating and Managing Databases with phpMyAdmin in cPanel.
Shadow IT is coming out of the shadows as more businesses are choosing cloud-based applications. It is now a multi-cloud world for most organizations. Simultaneously, most businesses have yet to consolidate with one cloud provider or define an offic…
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now