Active Directory is a Microsoft’s distributed database that contains information about every user, computer and resource in an organization. Users can be grouped into groups to make managing them more manageable. Getting the members of these groups using PowerShell has been made easy with Get-ADGroupMember.
The “powershell script to get all ad groups and members” is a PowerShell script that can be used to manage Active Directory Groups using Get.
You may query AD groups using Get-ADGroup, add, update, and delete groups and group members using the ActiveDirectory PowerShell module. You’ll learn a bit about the Active Directory group PowerShell cmdlets in this blog article, along with a lot of samples.
With Specops’ 100% free Password Auditor Pro, you can find, report, and prevent unsafe Active Directory account passwords in your environment. Download it right now!
Cmdlets for Active Directory Groups
You’ll discover a few cmdlets to manage groups after installing the ActiveDirectory PowerShell module.
| Name of cmdlet | Description |
| Add-ADGroupMember | To add members to an AD group, use this command. |
| Add-ADPrincipalGroupMembership | To add an AD principal to AD groups, use this command. |
| Get-ADGroup | Returns one or more groups from AD. |
| Get-ADGroupMember | The members of an AD group are returned using this method. |
| Get-ADPrincipalGroupMembership | Gets the groups that an AD principal belongs to. |
| New-ADGroup | To establish a new AD group, use this command. |
| Remove-ADGroup | To remove an AD group, use this command. |
| Remove-ADGroupMember | To delete members from an AD group, use this command. |
| Remove-ADPrincipalGroupMembership | To remove an AD principal from an AD group, use this command. |
| Set-ADGroup | An AD group’s properties are set using this method. |
You can administer every facet of the Active Directory group using PowerShell using these cmdlets and a little PowerShell kung-fu.
Get-ADGroupMember returns the members of a group.
All members of a group are returned by the Get-AdGroupMember cmdlet.
PS51> Get-ADGroupMember -Identity <identity string or object>
You may also use the Get-Aduser cmdlet to reference the memberOf attribute on a specific user. Check visit Learning Active Directory Directory and LDAP Filters in PowerShell for a reminder on how to create filters.
Below are two instances.
PS51> Get-ADUser -Filter ‘memberOf -eq “”‘ PS51> Get-ADUser -LDAPFilter ‘(memberOf=)’
This method returns an array of ADPrincipal objects.
To a CSV file, export the members of a group.
Each user’s initial name, last name, and email address are exported. Because these are ADPrincipal objects with fewer attributes than ADUser objects, pipe the results from Get-ADGroupMember to Get-ADUser.
PS51> $GroupMembers = Get-ADGroupMember -Identity ‘Professional Services Department’ PS51> $GroupMembers | Get-ADUser -Properties GivenName,Surname,Mail | Select-Object GivenName,Surname,Mail | Export-CSV -Path GroupMembers.CSV -NoTypeInformation
To guarantee that the CSV file is compatible with other programs, the NoTypeInformation argument of Export-CSV is used.
With Get-ADGroup, you may find groups that have no members.
To discover groups using filters, use Get-AdGroup. Below are two instances.
PS51> Get-ADGroup -Filter “Members -notlike ‘*’” PS51> Get-ADGroup -LDAPFilter “(!(member=*))”
New-ADGroup creates a new security group.
The New-AdGroup command is used to establish a new security group.
PS51> New-ADGroup -Name ‘<group name>’ -GroupScope <scope of group> -Path ‘<path of the OU tht will host the new group>’
The new group will be formed in the Users container if no Path option is provided. DomainLocal, Global, or Universal must be the group scope.
New-ADGroup creates a new distribution group.
To build a distribution group, use New-AdGroup once again. Choose a Distribution GroupCategory this time.
PS51> New-ADGroup -Name ‘<group name>’ -GroupScope <scope of group> -GroupCategory Distribution -Path ‘<path of the OU tht will host the new group>’
Add members to a group using Add-ADGroupMember
The Add-AdGroupMember cmdlet or the Add-ADPrincipalGroupMembership cmdlet may be used to add users to an Active Directory group using PowerShell.
The group is the Identity in this command.
PS51> Add-ADGroupMember -Identity <identity string or object> -Members <identity string(s) or ADPrincipal(s)>
The Identity in this command is the AD principal.
PS51> Add-ADPrincipalGroupMembership -Identity <identity string or object> -MemberOf <identity string(s) or ADGroup(s)>
Set-AdGroup writes to a group’s Notes property.
The Info property provided from Get-AdGroup represents the ADUC column named Notes.
To commit the change to AD, identify the group to update, set the Info attribute, and then use Set-AdGroup.
PS51> $group = Get-ADGroup -Identity <identity string or object> PS51> $group.Info = ‘Important notes on this group’ PS51> Set-ADGroup $group
Remove members from a group using Remove-ADGroupMember.
The Confirm argument, like other PowerShell cmdlets, may be used to prompt you before making a change. The Remove-AdGroupMember and Remove-ADPrincipalGroupMembership cmdlets behave similarly.
Without requiring confirmation, you may delete group members from the list below.
PS51> Remove-ADGroupMember -Identity <identity string or object> -Members <identity string(s) or ADPrincipal(s)> PS51> Remove-ADPrincipalGroupMembership -Identity <identity string or object> -MemberOf <identity string(s) or ADGroup(s)>
You may also use the Confirm argument to delete group members with confirmation.
PS51> Remove-ADGroupMember -Identity <identity string or object> -Members <identity string(s) or ADPrincipal(s)> -Confirm PS51> Remove-ADPrincipalGroupMembership -Identity <identity string or object> -MemberOf <identity string(s) or ADGroup(s)> -Confirm
Remove-ADGroup deletes a group.
Delete a group both with and without confirmation.
PS51> Remove-ADGroup -Identity <identity string or object> PS51> Remove-ADGroup -Identity <identity string or object> -Confirm
Rename-ADObject renames a group.
Rename-ADObject allows you to rename a group with a single command.
PS51> Rename-ADObject -Identity <identity string or object> -NewName ‘<new name>’
Get-ADGroup returns the number of groups.
Do you need to know how many total groups Get-AdGroup returned? Use the Count method.
PS51> (Get-ADGroup -Filter ‘*’).Count
Get-ADGroup allows you to find groups that have a manager.
Using Get-AdGroup and a well-crafted LDAP filter, filter all groups that have a manager assigned to them.
PS51> Get-ADGroup -LDAPFilter ‘(managedby=*)’
This does not have a PowerShell counterpart.
Get-ADGroup allows you to find groups maintained by a given user.
Improve your filtering abilities by utilizing a PowerShell or LDAP filter to identify all groups maintained by a certain user.
PS51> Get-ADGroup -Filter ‘managedby -eq “<distinguished name of user>”‘ PS51> Get-ADGroup -LDAPFilter ‘(managedby=<distinguished name of user>)’
Set-ADGroup creates the group manager.
The Managed By tab in ADUC for groups enables you to name someone to be in charge of the group’s membership. This does not imply that the manager has the ability to change the group’s membership. To make this feasible, the security permissions on the Member property for the group in issue must be updated.
In Active Directory Users and Computers (ADUC), selecting the Manager may edit membership list option for a group modifies the permissions to enable this.
In Active Directory Users and Computers, go to the Managed By tab.
Set the ManagedBy attribute using Set-ADGroup:
PS51> Set-ADGroup -ManagedBy ‘<distinguished name, GUID, SID or SAM Account name of manager>’
A few additional actions are required to update the Access Control list. The following code snippet gives Kristin Diaz the power to manage the group’s membership. The GUID for the group’s Member property is bf9679c0-0de6-11d0-a285-00aa003049e2.
The check box will be ticked if Kristin is also selected as the group’s manager. If not, Kristin will be able to control the group’s membership but will not appear as the manager in ADUC.
Find leaked & unsafe passwords in your Active Directory by checking against the NCSC Password list.
Get-ADGroup -Identity ‘Professional Services Department’ $group = Get-ADGroup Get-ADUser -Identity ‘Kristin.Diaz’ $manager New-Object System.Security.Principal $NTPrincipal NTAccount $manager.samAccountName $objectGUID = ‘bf9679c0-0de6-11d0-a285-00aa003049e2′ New-Object GUID Get-ACL “AD:$($group.distinguishedName)” $acl = Get-ACL “AD:$($group.distinguishedName) $ace = System.DirectoryServices.ActiveDirectoryAccessRule New-Object $acl,$NTPrincipal,’WriteProperty’,’Allow’,$objectGUID $acl,$NTPrincipal,’WritePropert AddAccessRule($ace) -AclObject Set-ACL “AD:$($group.distinguishedName)” $acl -Path
Find all security organizations.
With these two examples, you can list all security groups in Active Directory using PowerShell by restricting your search query to just security groups. You may be wondering what that LDAP filter is. LDAP filters are explained in detail.
PS51> Get-ADGroup -Filter ‘groupcategory -eq “Security”‘ PS51> Get-ADGroup -LDAPFilter ‘(groupType:1.2.840.113556.1.4.803:=2147483648)’
Groups for Distribution
Using these two examples, use PowerShell to identify Active Directory Groups (distribution) that do not include security groups.
PS51> Get-ADGroup -Filter ‘groupcategory -eq “Distribution”‘ PS51> Get-ADGroup -LDAPFilter ‘(!(groupType:1.2.840.113556.1.4.803:=2147483648))’
Get-ADPrincipalGroupMembership returns a user’s group membership.
PS51> Get-ADPrincipalGroupMembership -Identity <identity string or object>
This command requires access to a global catalog.
Find groups in an OU that aren’t sub-OUs.
With these two examples, use the SearchBase option to narrow your search to a particular OU.
PS51> Get-ADGroup -Filter ‘*’ -SearchBase ‘<distinguished name of OU>’ -SearchScope OneLevel PS51> Get-ADGroup -LDAPFilter ‘(CN=*)’ -SearchBase ‘<distinguished name of OU>’ -SearchScope OneLevel
Find all the groups in an OU, including sub-OUs.
Is it necessary to locate all groups in child OUs? Use a SubTree SearchScope.
PS51> Get-ADGroup -Filter ‘*’ -SearchBase ‘<distinguished name of OU>’ -SearchScope SubTree PS51> Get-ADGroup -LDAPFilter ‘(CN=*)’ -SearchBase ‘<distinguished name of OU>’ -SearchScope SubTree
Summary
This finishes our PowerShell-based demonstration of managing AD groups. Take a handful of them, put them to the test in your company, and start automating!
The “powershell get ad group members export to csv” is a command-line tool that allows users to manage AD groups. The tool exports the members of an AD group in CSV format, which can then be imported into Excel or other spreadsheet applications.
Related Tags
- active directory group management best practices
- get-adgroup
- list active directory groups
- active directory security group permissions
- get-adgroup description
