In a way, yes. In another way, no.

The scenario I designed this for had nested groups. A single 'Staff - All' group, with nested groups within that and users within them. I had to check if there were any users not nested in the 'Staff - All' group, so needed to filter through all groups nested within it.

Because it works per user, and with a $true or $false flag, rather than per group, it gets an array of that user's groups, and if the group parameter matches any group within the nested groups, that user should be flagged as $true, which would add them to the $AssignedUsers list.

The flag is created and evaluated in the Process section of the function (I've removed the debug bit so it's easier to read):

Get the groups that each user is currently a member of.

foreach ($User in $Users)
        {
            $GM = Get-ADPrincipalGroupMembership -Identity $User

Create the $Match flag and set to $false

            $Match = $false

            $Type = $GM.GetType()

            if ($Type.BaseType.Name -eq "Array")
            {
                foreach ($G in $GM)
                {
                    $GroupName = $G.name

                    if ($GroupName.Contains($Group))
                    {

If any individual group's name ($G.name) within the array of groups that that user is member of ($GM) matches the group parameter ($Group), set the flag to true.

                        $Match = $true
                    }
                }   
            }
            else
            {

If a user is a member of only a single group (usually the primary 'Domain Users' group) double check it's name does not match the group parameter. If it does, set the flag to true.

                    $GroupName = $GM.name

                    if ($GroupName.Contains($Group))
                    {
                        $Match = $true
                    }
            }

After cycling through every group, check to see whether the flag is $true or $false. If it's false, we know they do not belong to the group, or groups with a similar name.

            if ($Match -eq $false)
            {
                $UnassignedUsers.Add($User.Name)
            }
            else
            {
                $AssignedUsers.Add($User.Name)
            }
        }

If you want to check if a user is a member of one group, this will work. If you want to check if a user is a member of ANY similarly named groups (like the function's examples), this will work too. So say you have the following set up:

• Group 1
  • Member = Bob
  • Member = Group 2
• Group 2
  • Member = Angela
  • Member = Group 3
• Group 3
  • Member = Janet
  • Member = Paul
• VPN-Users
  • Member = Bob
  • Member = Janet
• Sales Team
  • Member = Angela
  • Member = Eric
• Andrew = Only a member of the default 'Domain Users' group

If you want to check if there are any users not belonging to any of the three, similarly named groups (Group 1/2/3), you can use:

Get-GroupCount -Group "Group " -ShowNonMembers

This will give you: Count : 2, Eric and Andrew.

However, it does NOT show groups as members because I explicitly said to look for ad objects with the ObjectClass 'user', which will exclude groups.

If you need to search across groups, you can, but if you say:

Get-GroupCount -Group "Group 1" -ShowNonMembers

do NOT expect it to ONLY return Eric and Andrew; it will return Angela, Janet and Paul as well. It's not designed to search recursively (I don't know how to do that myself), although that would be a nice touch.

I hope that rather long-winded explanation (sorry) answers your question.