How to use Get-ADGroupMember in PowerShell

Active Directory Groups allow you to easily assign permissions or software to your users. But how do you get all members of a group? To export or update all users of an ADGroup we can use the Get-ADGroupMember cmdlet in PowerShell.

In this article, we are going to take a look at how you can use the Get-ADGroupMember command in PowerShell.

Before we start, make sure that you have installed the PowerShell Active Directory Module.

Get all Group members with Get-ADGroupMember

The Get-ADGroupMember command will get all objects that are members of the group. This can be users, computers, and also other (nested) groups. To simply list all members of a group we can use the following cmdlet in PowerShell:

Get-ADGroupMember -Identity SG_M365_BP | ft

This will list all members of the group SG_M365_BP and format them into a table (ft).

Get-ADGroupMember
Get-ADGroupMember

A simple list of all group members is in most cases not what you are looking for. You probably want to get more user details, like the email address or display name of all the users.

To do this we can simply pipe the Get-ADuser cmdlet behind it, request all the details that we need from each user in de group:

Get-ADGroupMember -Identity SG_M365_BP | Get-ADUser -Properties DisplayName,EmailAddress | Select Name,DisplayName,EmailAddress,SAMAccountName
powershell get memberswith Get-ADGroupMember
Get all group members with PowerShell

You can select any attribute that you need in the Get-ADUser part, but make sure that you also add it to the select add the end of the cmdlet.

Nested Groups

Nested groups are a common practice in the Active Directory. They allow you to assign permissions or policies to users based on their group membership. Let’s take the following example where we have assigned PowerBi to the sales management and managing board:

ADGroup

To get the actual users that have access to PowerBi, we can’t simply do Get-ADGroupMember, because that will only return the two groups:

Nested groups

What we want is to get the members of the two nested groups. To do this, we can use the -recursive parameter. This way the Get-ADGroupMember cmdlet will also go through all nested groups in the Active Directory.

Get-ADGroupMember -Identity SG_PowerBi -Recursive | ft
powershell get adgroup

Get only users,computers or nested groups

When you have a group mixed with users and nested groups, you might want to get only the users from that group. Or only the other nested groups.

To do this we can filter the results on the objectClass of the group member. This can be:

  • user
  • computer
  • group
# Get only the users from a group
Get-ADGroupMember -Identity SG_PowerBi | Where-Object {$_.objectClass -eq "user"} | ft

# Or get only the nested groups
Get-ADGroupMember -Identity SG_PowerBi | Where-Object {$_.objectClass -eq "group"} | ft

Export Group Members to CSV with PowerShell

Most of the time when I use the Get-ADGroupMember cmdlet I want to export the results to Excel. To do this we can use the Export-CSV cmdlet in PowerShell. This will export all the results of your PowerShell cmdlet to an csv file.

Let’s say we want to export all members of the SG_M65_BP group with there emailaddress to Excel:

Get-ADGroupMember -Identity SG_M365_BP | Get-ADUser -Properties DisplayName,EmailAddress | Select Name,DisplayName,EmailAddress,SAMAccountName | Export-CSV -Path c:\temp\M365BP-users.csv -NoTypeInformation

This will export the results to a csv file and store it in C:\Temp. The -NoTypeInformation cmdlet removes that header information from the CSV file. If you want to know more about export to CSV, then make sure you read this article.

Wrapping Up

As you have seens, it’s pretty easy to get all members of a group with Get-ADGroupMember. Make sure that you use the -recursive parameter when you have nested groups.

If you have any questions, just drop a comment below.

Get more stuff like this

IT, Office365, Smart Home, PowerShell and Blogging Tips

I hate spam to, so you can unsubscribe at any time.

4 thoughts on “How to use Get-ADGroupMember in PowerShell”

  1. I am looking to find the groups a group is a member of? Example, If I lookup domain admins I want to know the member of..

  2. Hello, I would like to use Get-ADGroupMember -Identity to find the members that belong to both groups.
    Example: Get-ADGroupMember -Identity “groupA”, “groupb”

    Thank you

    • You will have to do this from the user perspective:


      Get-ADUser -Filter * -Properties memberOf | `
      Where-Object {
      $_.memberof.contains('CN=SG_PowerBi,OU=users,DC=lazyadmin,DC=nl') -and `
      $_.memberof.contains('CN=SG_M365_BP,OU=users,DC=lazyadmin,DC=nl' )
      }

Leave a Comment

0 Shares
Tweet
Pin
Share
Share