https://community.splunk.com/t5/Getting-Data-In/Can-I-use-the-Splunk-Supporting-Add-on-for-Active-Directory-SA/m-p/511418#M86869 <P>Yes, AD has <SPAN>a "magic string" (1.2.840.113556.1.4.1941) </SPAN>that I go into more detail on this answer&nbsp;<A href="https://community.splunk.com/t5/All-Apps-and-Add-ons/How-can-I-flatten-nested-Active-Directory-group-members-for/m-p/422464/highlight/true#M51519" target="_blank" rel="noopener">https://community.splunk.com/t5/All-Apps-and-Add-ons/How-can-I-flatten-nested-Active-Directory-group-members-for/m-p/422464/highlight/true#M51519</A><BR /><BR />But here is a working search for a single user that would give the output you mentioned:</P><LI-CODE lang="markup">| ldapsearch search="(&amp;(objectClass=user)(!(objectClass=computer))(cn=username))" attrs="cn,memberOf" | eval type="Direct" | rename memberOf AS Group | mvexpand Group | append [| ldapsearch search="(&amp;(objectClass=group)(member:1.2.840.113556.1.4.1941:cn=username,dc=amr,dc=corp,dc=mydomain,dc=com))" attrs="cn" | rename dn AS Group | table Group | eval type = "Nested" ] | filldown cn | stats values(type) AS type BY Group cn | rename cn AS User | eval type = if(match(type,"Direct"),"Direct",type) | table User Group type</LI-CODE><P>&nbsp;</P> Tue, 28 Jul 2020 21:29:22 GMT worshamn 2020-07-28T21:29:22Z https://community.splunk.com/t5/Getting-Data-In/Can-I-use-the-Splunk-Supporting-Add-on-for-Active-Directory-SA/m-p/385924#M69282 <P>I have seen how the Splunk Supporting Add-on for Active Directory (SA-ldapsearch) can give me a list of all groups, and enumerate their membership, to include both nested and direct membership. I have also seen how I can retrieve all users, and the groups which they are a member of. </P> <P>Does anyone have a search where I can search Active Directory with SA-ldapsearch, specify a user, and enumerate all group membership, to include any inherited groups? </P> <P>Desired Results: <BR /> User | Group | Membership Type<BR /> John.Doe | Domain Users | Direct<BR /> John.Doe | Accounting | Direct<BR /> John.Doe | Finance Dept. | Nested</P> <P>I believe I had some success achieving this with the data from Active Directory monitoring - however, I'd prefer to use SA-ldapsearch for this. </P> Wed, 19 Sep 2018 13:09:53 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-use-the-Splunk-Supporting-Add-on-for-Active-Directory-SA/m-p/385924#M69282 danielansell 2018-09-19T13:09:53Z https://community.splunk.com/t5/Getting-Data-In/Can-I-use-the-Splunk-Supporting-Add-on-for-Active-Directory-SA/m-p/511418#M86869 <P>Yes, AD has <SPAN>a "magic string" (1.2.840.113556.1.4.1941) </SPAN>that I go into more detail on this answer&nbsp;<A href="https://community.splunk.com/t5/All-Apps-and-Add-ons/How-can-I-flatten-nested-Active-Directory-group-members-for/m-p/422464/highlight/true#M51519" target="_blank" rel="noopener">https://community.splunk.com/t5/All-Apps-and-Add-ons/How-can-I-flatten-nested-Active-Directory-group-members-for/m-p/422464/highlight/true#M51519</A><BR /><BR />But here is a working search for a single user that would give the output you mentioned:</P><LI-CODE lang="markup">| ldapsearch search="(&amp;(objectClass=user)(!(objectClass=computer))(cn=username))" attrs="cn,memberOf" | eval type="Direct" | rename memberOf AS Group | mvexpand Group | append [| ldapsearch search="(&amp;(objectClass=group)(member:1.2.840.113556.1.4.1941:cn=username,dc=amr,dc=corp,dc=mydomain,dc=com))" attrs="cn" | rename dn AS Group | table Group | eval type = "Nested" ] | filldown cn | stats values(type) AS type BY Group cn | rename cn AS User | eval type = if(match(type,"Direct"),"Direct",type) | table User Group type</LI-CODE><P>&nbsp;</P> Tue, 28 Jul 2020 21:29:22 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-use-the-Splunk-Supporting-Add-on-for-Active-Directory-SA/m-p/511418#M86869 worshamn 2020-07-28T21:29:22Z