How to use Get-ADGroupMember in PowerShell

Active Directory Groups allow you to easily assign permissions or software to your users. But how do you get all members of a group? To export or update all users of an ADGroup we can use the Get-ADGroupMember cmdlet in PowerShell.

You can of course also view the group members in the Active Directory, but as you might have noticed, this is quite inconvenient. The advantage of using PowerShell to get all the group members is that you can easily export it to Excel for example, or use the results in other scripts.

In this article, we are going to take a look at how you can use the Get-ADGroupMember cmdlet in PowerShell.

Requirements

The Get-ADGroupMember cmdlet is part of the PowerShell Active Directory Module. This module is installed by default on domain controllers. However, I recommend installing the module on your own computer, so that you don’t have to work on the domain controller.

Check out this article to install the PowerShell Active Directory Module on your computer or server.

Get all Group members with Get-ADGroupMember

The Get-ADGroupMember command will get all objects that are members of the group. This can be users, computers, and also other (nested) groups. To simply list all members of a group we can use the following command in PowerShell:

# Replace SG_M365_E3 with your group name
Get-ADGroupMember -Identity SG_M365_E3 | ft

This will list all members of the group SG_M365_E3 and format them into a table (ft).

Get-ADGroupMember
Get-ADGroupMember

A simple list of all group members is in most cases not what you are looking for. You probably want to get more user details, like the email address or the display name of all the users.

To do this we can simply pipe the Get-ADuser cmdlet behind it, request all the details that we need from each user in de group:

Get-ADGroupMember -Identity SG_M365_E3 | Get-ADUser -Properties DisplayName,EmailAddress | Select Name,DisplayName,EmailAddress,SAMAccountName
powershell get memberswith Get-ADGroupMember
Get all group members with PowerShell

You can select any attribute that you need in the Get-ADUser cmdlet, but make sure that you also add it to the select add the end of the cmdlet.

Nested Groups

Nested groups are a common practice in the Active Directory. They allow you to assign permissions or policies to users based on their group membership. Let’s take the following example where we have assigned PowerBi to the sales management and managing board:

To get the actual users that have access to PowerBi, we can’t simply do Get-ADGroupMember, because that will only return the two groups:

Get nested group members with PowerShell

What we want is to get the members of the two nested groups. To do this, we can use the -recursive parameter. This way the Get-ADGroupMember cmdlet will also go through all nested groups in the Active Directory.

Get-ADGroupMember -Identity SG_M365_PowerBi -Recursive | ft
PowerShell Get Nested Group Membership
Get Nested Group Membership

Get only Users, Computers or Nested groups

When you have a group mixed with users, computers, or nested groups, you might want to get only the users from that group. Or only the other nested groups.

To do this we can filter the results on the objectClass of the group member. This can be:

  • user
  • computer
  • group
# Get only the users from a group
Get-ADGroupMember -Identity SG_PowerBi | Where-Object {$_.objectClass -eq "user"} | ft

# Or get only the nested groups
Get-ADGroupMember -Identity SG_PowerBi | Where-Object {$_.objectClass -eq "group"} | ft

Export Group Members to CSV with PowerShell

Most of the time when I use the Get-ADGroupMember cmdlet I want to export the results to Excel. To do this we can use the Export-CSV cmdlet in PowerShell. This will export all the results of your PowerShell cmdlet to a CSV file.

Tip

You can also export directly to Excel with the PowerShell ImportExcel module

Let’s say we want to export all members of the SG_M65_E3 group with their email address to Excel:

Get-ADGroupMember -Identity SG_M365_E3 | Get-ADUser -Properties DisplayName,EmailAddress | Select Name,DisplayName,EmailAddress,SAMAccountName | Export-CSV -Path c:\temp\M365E3-users.csv -NoTypeInformation

This will export the results to a CSV file and store it in C:\Temp. The -NoTypeInformation cmdlet removes that header information from the CSV file. If you want to know more about exporting to CSV, then make sure you read this article.

Wrapping Up

As you have seen, it’s pretty easy to get all members of a group with Get-ADGroupMember. Make sure that you use the -recursive parameter when you have nested groups.

When you want to export the members of the group to Excel, then make sure you try out ImportExcel module. This module allows you to create formatted Excel files straight from PowerShell.

If you have any questions, just drop a comment below.

14 thoughts on “How to use Get-ADGroupMember in PowerShell”

  1. Hi Rudy, I get this on some of my groups “Get-ADGroupMember: An operations error occurred.” but i can’t get it to log it into a text file even with *>&1 >> C:\tmp\log.txt I would basically just want it to list the group it was trying and failed so I can manually check it out. Any help appreciated

  2. Great information, thank you! In our case we haven an OU with about 40 groups.
    I want to know what users are in each group. I’m sure this can be done without specifying each group seperately… Would you mind giving me some help on this?

    • Something like this should get your started in the right direction:

      $groups = Get-AdGroup -filter *
      $groups | Foreach-Object {
      
          $group = $_
      
          $users = Get-AdGroupMember -identity $_ 
          $users | Foreach-Object {
              [PSCustomObject]@{
                  Groupname = $group.Name
                  User = $_.Name
              }
          }
      }
      
      • Thank you Rudy, that helped me a bit.
        Atleast I get to run something that gives me an output.
        But perhaps you can help me a little bit more 🙂

        I have a specific OU called “Rollen”.
        In there are about 60 global groups.

        I want to export those 60 global groups from this OU “rollen” with it’s members outputting to a csv that shows also the Full Name and Description.

        This way I should be able to see

        $Global Group Name , $User Full Name, Description

        Thank you!

        • Something like this should work. You can wrap it in a function and then call the function and pipe export-csv behind it:

          $groups = Get-AdGroup -filter * -SearchBase "OU=Rollen,OU=Sites,DC=Lazyadmin,DC=NL"
          $groups | Foreach-Object {
          
              $group = $_
          
              $users = Get-AdGroupMember -identity $_ 
              $users | Foreach-Object {
                  $user = Get-AdUser -Identity $_ -Properties description| Select name, description 
                  [PSCustomObject]@{
                      Groupname = $group.Name
                      User = $user.Name
                      Description = $user.description
                  }
              }
          }
          
  3. While the Get-ADGroupMember does retrieve all users and nested groups, I need to have more information. I need to know what group the user was in that was nested in the original group.

    What would you do next to get this? The information only shows:
    distinguishedName
    name
    objectClass
    objectGUID
    SamAccountName
    SID

    I need to know what group they were in they were a member of a nested group.

  4. I am looking to find the groups a group is a member of? Example, If I lookup domain admins I want to know the member of..

  5. Hello, I would like to use Get-ADGroupMember -Identity to find the members that belong to both groups.
    Example: Get-ADGroupMember -Identity “groupA”, “groupb”

    Thank you

    • You will have to do this from the user perspective:


      Get-ADUser -Filter * -Properties memberOf | `
      Where-Object {
      $_.memberof.contains('CN=SG_PowerBi,OU=users,DC=lazyadmin,DC=nl') -and `
      $_.memberof.contains('CN=SG_M365_BP,OU=users,DC=lazyadmin,DC=nl' )
      }

Leave a Comment

0 Shares
Tweet
Pin
Share
Share