The PowerShell Get-ADGroup cmdlet is used to search Active Directory for single or multiple groups.
The Get-ADGroup filter parameter allows you to get a list of specific groups such as all global, universal, or domain local groups. In addition, you can search Active Directory for groups by name or simply list all groups.
In this guide, I’ll walk through several Get-ADGroup examples and show you how to quickly get a list of groups in your domain. If you want to get group members then see my article PowerShell Get AD group members for instructions.
Get-ADGroup Examples
1. Get a single group by name
Get-ADGroup -identity Accounting_Folders
This command gets the group with the SAM account name Accounting_Folders
2. Get a group by a distinguished name
Get-ADGroup -identity "CN=Accounting_Folders,OU=ADPRO Groups,DC=ad,DC=activedirectorypro,DC=com"
This example gets a single group by its distinguished name. I prefer to get groups by the SAM account name. Make sure to put the path in quotes or you will get an error. You can also identity groups by their SID and GUIDE.
3. Get all AD groups
Get-ADGroup -filter *
This command will get all domain groups.
4. Get all AD Groups & Limit Properties
Get-ADGroup -filter * | select Name, groupscope, objectclass
This command will get all groups and display the group name, groupscope, and objectclass.
5. Get groups with a specific name
Get-ADGroup -filter "Name -like 'Acc*'"
This command will get all groups that start with Acc in the name. I also use the select option to just display the group name.
6. Get all groups from a specific OU
Get-ADGroup -filter * -SearchBase "OU=ADPRO Groups,DC=ad,DC=activedirectorypro,DC=com" | select name, distinguishedName
This command gets all groups from a specific OU and displays the group name and distinguishedName.
7. Get all Security Groups
Get-ADGroup -filter "GroupCategory -eq 'Security'" | select name, GroupCategory
This command gets all security groups and displays the group name and GroupCategory.
8. Get all AD group properties
Get-ADGroup -identity Administrators -Properties *
This command will display all of the group properties. By default, the get-adgroup command will only display eight group properties.
- DistinguishedName
- GroupCategory
- GroupScope
- Name
- ObjectClass
- ObjectGUID
- SamAccountName
- SID
To display all of the group properties add the -properties * option.
9. Get AD Groups using wildcard search
Get-ADGroup -Filter 'Name -like "*acc*" -or Name -like "*mar*"' | select name
In this example, I filter for groups by name using a wildcard search. I also use the or option to find groups that include “acc” or “mar”.
10. Find Empty Groups
With PowerShell, you can use the Get-ADGroup cmdlet to list empty groups. The below command will get all empty groups in the domain. It is important to note that many default groups have no members.
Get-ADGroup -Filter * -Properties Members | where {-not $_.members} | select Name, distinguishedName
Get-ADGroup PowerShell Alternative
If you prefer a GUI over PowerShell, the AD Pro Toolkit includes a group reporting tool that lets you view all AD groups, their members, and nested memberships in a few clicks. Filter by group type, scope, or OU and export the results to CSV, Excel, or PDF.
Refer to the Microsoft Get-ADGroup Documentation to view the complete syntax.
