Find Empty Groups in Active Directory

In this guide, I’ll show you how to find empty groups in Active Directory using PowerShell and the AD Pro Toolkit.

Administrators need to create Active Directory groups for various reasons but are those groups still in use? I’ve handled countless requests to create new groups and then those groups are never used or are no longer needed. The problem is the person who requested the group never notified you that it is no longer needed. So over time, you end up with a mess and a bunch of unused and empty groups.

How to Find Empty Groups Using PowerShell

With PowerShell, you can use the Get-ADGroup cmdlet to list empty groups. The below command will get all empty groups in the domain. It is important to note that many default groups have no members.

Get-ADGroup -Filter * -Properties Members | where {-not $_.members} | select Name, distinguishedName 

I included the group name and distinguishedName in the output. You can change this by adding or removing the attributes in the select statement.

Here is a screenshot from my domain.

To verify a group is empty use this command.

Get-ADGroupMember -Identity 'group_110' | Select-Object name, distinguishedName

In this example, I checked the group ‘group_110’ and it did not return any group members.

To export all empty groups to csv use this command. Change the group name and path.

Get-ADGroupMember -Identity 'group_110' | Select-Object name, distinguishedName | export-csv -path c:\temp\emptygroups.csv

As you can see finding empty groups with PowerShell is very easy.

Find Empty Groups using the AD Pro Toolkit

To find empty groups using the AD Pro Toolkit follow these steps.

Step 1. Click on Group Reports

Step 2. Select Groups with no Members Report

Under general select the “groups with no members” report and click run.

Very easy right? With just a couple of clicks, the toolkit can generate all kinds of Active Directory Reports.

To export the report click on the export button. You can also sort or search the results.

DomainLocal Empty Groups

For example, if I wanted to see only DomainLocal groups that have no members I would filter on the groupScope column.

Search for Empty Groups by Name

To search for an empty group by name click the search icon.

If you want to test this tool out in your domain for free, click the download button below.

Summary

In this guide, I showed you how to find empty groups with PowerShell and the AD Pro Toolkit.

If you don’t run regular maintenance on Active Directory you will have stale users, computers, and groups. Administrators love to create groups for various reasons but often forget to remove them if they are not being used. Finding unused groups can be challenging because it’s not easy to know where they might be in use. Finding empty groups can be a quick way to clean up those unused groups.