Create Active Directory Security Groups with PowerShell

In this guide, I’m going to show you how to create single and bulk Active Directory security groups with PowerShell. I will provide examples and a script for creating bulk groups from a CSV file.

As an alternative to PowerShell, I’ll also show you how to create groups using the GUI AD Group Management Tool.

New-ADGroup cmdlet

The New-ADGroup cmdelet is the command used to create Active Directory groups.

I won’t cover all of the details of this cmdlet instead, I’ll jump right into some examples. You can reference the Microsoft document New-ADGroup for the complete syntax.

Name and GroupScope are the two required parameters, everything is optional.

Example 1: Create a single AD group

New-ADGroup -Name Marketing_local -GroupCategory Security

This command creates a group named “Marketing_local the group category is security.

Example 2: Create a single group with a description

New-ADGroup -Name Account_Printers -GroupScope DomainLocal -Description "Group for permissions to accounting printers" 

This example created a group named “Account_Printers” and sets the description.

Example 3: Create a single group and set Managed By

New-ADGroup -Name GIS_Images -GroupScope DomainLocal -ManagedBy robert.allen

In this example, I create a group named GIS_Images and set the managed by to the SAM account name (sAMAccountName) of robert.allen.

Example 4: Create a single group and add it to an organizational unit (OU)

New-ADGroup -Name Marketing_local -GroupCategory Security -Path "OU=ADPRO Groups,DC=ad,DC=activedirectorypro,DC=com"

This example creates the group “Marketing_local” and puts it in the OU named ADPRO Groups.

Now let’s look at creating AD groups in bulk.

Example 5. Create Bulk AD Groups with PowerShell

The easiest way to bulk create AD groups is by using a CSV file. The CSV file will have all of the group details, we then use PowerShell to import the CSV and create the groups.

Step 1: CSV file configuration

Create a CSV file and add these columns

  • name
  • path
  • scope
  • category
  • description

Then fill in each column with the group details. Here is a screenshot of my CSV. You can add additional parameters to the CSV you will just need to update the script below to include them.

Save the as a CSV (comma delimited) (.csv) file type. You can name the file name whatever you want.

Step 2: The Bulk Import Script

Here is the PowerShell script for bulk creating groups from the CSV.

You can copy and paste this into PowerShell. The only thing you need to change is the location of the CSV.

Import-Module ActiveDirectory

#Import CSV
$groups = Import-Csv ‘c:\it\scripts\groups.csv‘


# Loop through the CSV
    foreach ($group in $groups) {

    $groupProps = @{

      Name          = $group.name
      Path          = $group.path
      GroupScope    = $group.scope
      GroupCategory = $group.category
      Description   = $group.description

      }#end groupProps

    New-ADGroup @groupProps
    
} #end foreach loop

Make sure you change this line to the path of the CSV file you created in step 1.

$groups = Import-Csv ‘c:\it\scripts\groups.csv‘

Here is a screenshot of the script in PowerShell ISE.

Bulk Created AD Groups with the AD Pro Toolkit

An alternative to PowerShell is to use the AD Group Management Tool that is included in the AD Pro Toolkit.

With this tool, you can easily perform the following actions:

  • Import Groups
  • Add Users to Groups
  • Remove Users from Groups
  • Remove Groups from Groups
  • Add Groups to Groups
  • Create Group Reports

To import groups click on import groups.

To bulk add users to groups like “Update Group Membership”.

Inventory Active Directory Security Groups

Do you need to create a report of all security groups or groups recently created? The AD Pro Toolkit includes over 200 Active Directory Reports on users, computers, groups, and much more.

Here is an example report of all groups modified in the last 30 days. These reports can be exported to CSV, excel, or PDF.

Download a free trial of the AD Pro Toolkit and test it on your own network.

Feel free to comment below if you have any questions.

34 thoughts on “Create Active Directory Security Groups with PowerShell”

      • thanks. I’m able to do this successfully via the one-liner. How could the existing script be modified to reference a list of existing groups from a csv to do this in bulk?

        Reply
  1. Found the solution to null value in GroupCategory. It has to do with the delimiter.
    add -delimiter “;” or whatever default delimiter your area has at the end of the import-csv line.

    Reply
      • New-ADGroup : Cannot validate argument on parameter ‘GroupCategory’. The argument is null. Provide a valid value for the argument, and then try running the
        command again.
        At line:20 char:17
        + New-ADGroup @groupProps
        + ~~~~~~~~~~~
        + CategoryInfo : InvalidData: (:) [New-ADGroup], ParameterBindingValidationException
        + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.ActiveDirectory.Management.Commands.NewADGroup

        Reply
  2. Hey Robert,
    when I run the script I get this too:
    New-ADGroup : Cannot validate argument on parameter ‘GroupCategory’. The argument is null. Provide a valid value for the argument, and then try running the command again.
    At line:20 char:17

    here’s what im running:

    Import-Module ActiveDirectory

    #Import CSV
    $groups = Import-Csv ‘\\server\path\to\folder\myfile.csv’

    # Loop through the CSV
    foreach ($group in $groups) {

    $groupProps = @{

    Name = $group.name
    Path = $group.path
    GroupScope = $group.scope
    GroupCategory = $group.category
    Description = $group.description

    }#end groupProps

    New-ADGroup @groupProps

    } #end foreach loop

    Columns I created:
    name path scope category description

    contents in scope and category is: DomainLocal and Security.

    Checked get-command listimported as suggested above and New-ADGroup is present.
    Hope you can help, I have 248 groups to create 😀

    Reply
  3. I have bulk groups to be created with attributes like Description and ManagedBy, if there is blank value for MangedBy or Description it throws below error

    New-ADGroup : Identity info provided in the extended attribute: ‘ManagedBy’ could not be resolved. Reason: ‘Cannot find an object with identity: ”
    under: ‘DC=example,DC=xyz,DC=com’.’.
    At line:21 char:5

    Reply
  4. didn’t work for me. I used the exact headings on the columns and the exact script. Can somebody post a solution that works please

    Reply
  5. Not sure why my description is not being updated on above script.
    Am trying to add two members to the grps being created in above script.
    tried
    foreach ($groups in $groupProps $group.name)
    Add-ADGroupMember -Member user01

    Reply
  6. Is there a way to add a managed by field to example #5? Bonus points if there’s also a way to check the “manager can update membership list “ box in the same script.

    Reply
    • Yup. Just add ManagedBy to the groupProps section in the script and a matching header in the csv. I don’t see an option for “manager can update”.

      Reply
  7. New-ADGroup : Cannot validate argument on parameter ‘GroupCategory’. The argument is null. Provide a valid value for the argument, and then try running the
    command again.

    I keep getting this, adapted the CSV to include the “”. The Category Column has Security as value but this keeps showing up.

    Reply
  8. I get this error for #Exemple 5: Please could you help?

    New-ADGroup : Cannot validate argument on parameter ‘GroupCategory’. The argument is null. Provide a valid value for the argument, and
    then try running the command again.
    At line:20 char:17
    + New-ADGroup @groupProps
    + ~~~~~~~~~~~
    + CategoryInfo : InvalidData: (:) [New-ADGroup], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.ActiveDirectory.Management.Commands.NewADGroup

    Reply
  9. Much appreciated for sharing this script. Erik was right, the .csv requires some fiddling. But overall, this works like a charm. Saved me tons of time!

    Reply
  10. Hi,

    Example #4 has code errors.
    The CN= needs to be dropped.
    The “T” at the end of the code needs to be removed.

    Reply
  11. New-ADGroup : Cannot validate argument on parameter ‘GroupCategory’. The argument is null. Supply a non-null argument and try the command
    again.

    Reply
      • Yes, the New-ADGroup cmdlet does show up.
        However the script still responds in the same manner. Using the example 4 as a reference I am able to create a new group even whith the addition of the GroupScope parameter in one go, but when all the parameters are filled using this script it does not work.
        I would like this to work, need to migrate quite a few groups over and this would be helpful

        Reply
        • After fiddling with the input CSV file I found the solution; the CSV file is misread and should be like this:
          name,path,scope,category,description
          Groupname,”OU=groups,DC=Domain,DC=Local”,Global,Security,”Discription for the group”
          When saved as a UTF-8 CSV file the script works fine.

          Reply

Leave a Reply to Philip Elder Cancel reply