PowerShell: Export Active Directory Group Members

How to export Active Directory group members using PowerShellOne common request I see is getting a list of users that belong to an Active Directory security group. This is requested for various reasons such as, supervisor wants to know who has access to a folder, auditor wants a list of users, 3rd party program or cloud service needs to import a list of users from a csv file.

The problem is…

The built in Active Directory users and Computer tool has no option to export members from a group.

To accomplish this we can use PowerShell.

In this tutorial, I will walk through the steps for exporting group members to a csv file.

Let’s get started.

Step 1: Load the Active Directory Module

To connect and query an AD group with PowerShell the Active Directory module needs to be loaded.

The Active Directory module can be installed with the following methods:

  • Having RSAT tools installed
  • Windows Server 208 R2 and above with the AD DS or AD LDS server roles

You can run the following command to see if you have installed

Get-Module -Listavailable

As you can see I don’t have the module installed.

If you already have the module loaded then jump to step 2, if not following these instructions.

To get the Active Directory module installed on my Windows 10 PC, I will need to download and install the RSAT tools.

With the RSAT tools installed, I run the Get-Module -ListAvailable command again

Now I have the module installed, let’s move on to step 2.

RELATED: Tutorial on how to install PowerShell modules

Step 2: Find AD Group

If you already know the name of the group, then skip to step 3.

If you’re not sure what the group name is, you can issue the following command to list all Active Directory groups.

get-adgroup -filter * | sort name | select Name

Above, is a screenshot of some of the groups listed in my domain. I had an HR group but wasn’t sure of its complete name, I can see it’s HR full. I’ll use that group in step 3 to list out the members.

Step 3: Use Get-AdGroupMember to list members

The following command will list all members of my HR Full group

Get-AdGroupMember -identity HR Full

You can see the above command provides more details on the group members than I need.

We can filter out the results and just get the member name with this command

Get-AdGroupMember -identity "HR Full" | select name

Perfect, now I just need to export this to csv.

Related: How to export all Users from Active Directory

Step 4: Export group members to csv file

The last step is to export the results to a scv file

This is done by adding Export-csv to our above commands. The full command looks like this

Get-ADGroupMember -identity “HR Full” | select name | Export-csv -path C:\Output\Groupmembers.csv -NoTypeInformation

Now I have a csv file of all the members from the HR Full Active Directory group.

Pretty easy right?

Recommended Tool: SolarWinds Server & Application Monitor (SAM)

This utility was designed to Monitor Active Directory and other critical applications. It will quickly spot domain controller issues, prevent replication failures, track failed logon attempts and much more.

What I like best about SAM is it’s easy to use dashboard and alerting features. It also has the ability to monitor virtual machines and storage.

Download Your Free Trial of SolarWinds Server & Application Monitor. 

32 Comments

  1. Richard on May 11, 2018 at 3:51 pm

    I’m looking for a similar script to export to csv groups and members within groups:
    group1:member1….
    group1:member1…

    • Robert Allen on June 26, 2018 at 1:06 pm

      Hi Richard,

      Just add -Recursive at the end to include members of child groups

      Example

      Get-AdGroupMember -identity HR Full -Recursive

  2. Chris on May 15, 2018 at 6:57 pm

    Very helpful, thanks!

    • Robert Allen on May 15, 2018 at 11:12 pm

      No problem.

  3. Jay on May 25, 2018 at 7:52 pm

    Exactly what I needed. Thanks for the information in easily and quickly digestible format!

    • Robert Allen on May 26, 2018 at 12:14 pm

      No problem Jay.

  4. Yulia on May 28, 2018 at 12:42 pm

    Hello, Thank you for the post. But I get an error on Step 2: “get-adgroup : Unable to find a default server with Active Directory Web Services running.”

    • Robert Allen on May 28, 2018 at 10:04 pm

      Yulia,

      The Powershell Active Directory module uses AD Web services to manage and administer Active Directory. You will need to make sure your server is running AD web services. What version of server are you running?

  5. Manny on May 30, 2018 at 7:37 pm

    What is the powershell command to export AD “Contacts” members of an AD group?

    • Robert Allen on June 26, 2018 at 12:59 pm

      Hi, Manny

      This command will list both contacts and users of an AD group.

      Get-ADGroup group-name -Properties member | select-object -ExpandProperty member

      • z on August 28, 2018 at 9:26 pm

        Thanks big help

  6. Edward Ramz on May 31, 2018 at 5:40 pm

    Thank you! amazing, thank you for your time and sharing the info thanks!!!

    • Robert Allen on June 3, 2018 at 12:30 pm

      No problem Edward.

  7. Tamu Taylor on June 18, 2018 at 4:20 pm

    Thank you!

    • Robert Allen on June 20, 2018 at 12:00 pm

      Tamu,

      You’re welcome

  8. me on June 25, 2018 at 2:58 am

    good article, clear and EZ to use,
    thank you.

    • Robert Allen on June 28, 2018 at 12:15 am

      You’re Welcome!

  9. Richard on June 27, 2018 at 2:21 pm

    WOW this is well put together. Thanks.

    • Robert Allen on June 28, 2018 at 12:15 am

      Richard,

      No problem.

  10. Roger on July 18, 2018 at 2:39 pm

    Awesome Thanks!

    • Robert Allen on July 19, 2018 at 11:35 am

      No problem, I hope you find it useful.

  11. Senthil R (IBM India) on July 22, 2018 at 7:16 pm

    really informative and useful commands for AD admins

  12. Te'a Lutau on July 24, 2018 at 8:53 pm

    Awesome Article!

    • Robert Allen on August 12, 2018 at 12:11 am

      Thanks Latau

  13. Guan on August 15, 2018 at 12:30 am

    This worked great!

    Amy chance we can add last logon date? Other scripts I tried from the web did not work.

  14. Bobby on August 28, 2018 at 2:15 pm

    This is awesome! Do you know how to also get users email address?

    • Robert Allen on August 31, 2018 at 1:02 pm

      Here is an example that will list users name and email of a group

      Get-ADGroupMember -Identity HR-N-Drive-RW -Recursive | Get-ADUser -Properties Mail | Sel
      ect-Object Name, Mail

  15. Nathan on August 30, 2018 at 11:00 pm

    Can you export samaccountname and name together? I tried it in various ways, but can only seem to do one or the other.

    • Robert Allen on August 31, 2018 at 1:03 pm

      Here you go

      Get-ADGroupMember -Identity HR-N-Drive-RW -Recursive | Get-ADUser | Select-Object Name,
      SamAccountName

  16. Kumar on October 19, 2018 at 7:52 am

    thanks for good share , easy to understand and quick

  17. Papi on October 19, 2018 at 2:37 pm

    Truly appreciate this, best explanation and clear instructions

Leave a Comment