Members of privileged AD groups, including nested members

#Requires -Modules ActiveDirectory
# Recursive members of the built-in privileged groups, found by well-known SID. Read-only.

$domain = Get-ADDomain
$forest = Get-ADForest
$rootDomain = Get-ADDomain -Identity $forest.RootDomain

$groups = @(
    @{ Sid = 'S-1-5-32-544'; Server = $domain.DNSRoot }                      # Administrators
    @{ Sid = "$($domain.DomainSID)-512"; Server = $domain.DNSRoot }          # Domain Admins
    @{ Sid = "$($rootDomain.DomainSID)-519"; Server = $rootDomain.DNSRoot }  # Enterprise Admins
    @{ Sid = "$($rootDomain.DomainSID)-518"; Server = $rootDomain.DNSRoot }  # Schema Admins
    @{ Sid = 'S-1-5-32-548'; Server = $domain.DNSRoot }                      # Account Operators
    @{ Sid = 'S-1-5-32-549'; Server = $domain.DNSRoot }                      # Server Operators
    @{ Sid = 'S-1-5-32-551'; Server = $domain.DNSRoot }                      # Backup Operators
)

foreach ($entry in $groups) {
    $group = Get-ADGroup -Identity $entry.Sid -Server $entry.Server
    Get-ADGroupMember -Identity $group -Server $entry.Server -Recursive |
        ForEach-Object {
            [pscustomobject]@{
                Group             = $group.Name
                Domain            = $entry.Server
                Member            = $_.Name
                SamAccountName    = $_.SamAccountName
                ObjectClass       = $_.ObjectClass
                DistinguishedName = $_.DistinguishedName
            }
        }
}

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

A domain-joined machine with the Active Directory module (RSAT) installed.

Reading the output

• Finds each group by its well-known SID, so it works whatever the groups are called in your language. Schema Admins and Enterprise Admins exist only in the forest root domain and are read from there.
• Uses Get-ADGroupMember -Recursive, which returns the accounts at the end of each nesting chain, not the nested groups themselves.
• Print Operators is left out: Microsoft's SID reference lists Domain Users as its default member, so a recursive listing would return every user. Check its direct members separately if you use it.
• Run it in each domain of a multi-domain forest; the domain-local groups (Administrators and the operators groups) are per domain.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.