PowerShell: Export Active Directory Group Members

by Robert Allen

In this guide, you will learn how to export AD group members to csv. I will show you how to get a list of groups and members with PowerShell and the AD Pro Toolkit. You can easily list group members with PowerShell but getting details for each user can be challenging. I’ll show you how to get a detailed group members report with the AD Pro Toolkit.

Step 1: Load the Active Directory Module

To connect and query an AD group with PowerShell the Active Directory module needs to be loaded.

The Active Directory module can be installed with the following methods:

  • RSAT tools installed
  • Windows Server 2008 R2 and above with the AD DS or AD LDS server roles

You can run the following command to see if you have installed.

Get-Module -ListAvailable
powershell module

As you can see, I don’t have the module installed.

If you already have the module loaded then jump to step 2, if not then follow these instructions.

To get the Active Directory module installed on my Windows 10 PC, I will need to download and install the RSAT tools.

With the RSAT tools installed, I run the Get-Module -ListAvailable command again

check powershell ad module

Now I have the module installed, let’s move on to step 2.

Step 2: Use Get-ADGroup to find the group name

If you already know the name of the group, then skip to step 3.

If you’re not sure what the group name is, you can issue the following PowerShell command to list all Active Directory groups.

Get-ADGroup -filter * | sort name | select name
get-adgroup powershell command list groups

Above, is a screenshot of some of the groups listed in my domain. I had an HR group but wasn’t sure of its complete name, I can see it’s HR full. I’ll use that group in step 3 to list out the members.

Step 3: Use Get-AdGroupMember to list group members

The following PowerShell command will list all members of my HR Full group.

Get-ADGroupMember -identity "HR Full"
get-adgroupmember powershell command

You can see the above command provides more details on the group members than I need.

We can filter out the results and just get the member name with this command.

Get-ADGroupMember -identity "HR Full" | select name
list only group members with powershell

Perfect, now I just need to export this to CSV.

Step 4: Export group members to CSV file with PowerShell

The last step is to export the results to a CSV file.

This is done by adding Export-csv to our above commands. The full command looks like this.

Get-ADGroupMember -identity "HR Full" | select name | Export-csv -path c:\it\filename.csv -Notypeinformation

Pretty easy right?

Easily Export AD Group Members with AD Pro Toolkit

Exporting group members to CSV with PowerShell can become a time consuming and complex process. With the AD Pro Toolkit this task is very easy, you can create detailed group member reports with the click of the button.

The AD Pro Toolkit includes an Active Directory reporting tool with over 200 built-in reports. This is a huge time saver and eliminates the need to constantly making changes to complex PowerShell scripts.

Use the attribute selector to add or remove details to the group members export.

Group members reports include:

  • domain
  • group type
  • group scope
  • User Account status (enabled or disabled)
  • User lastLogonTimestamp
  • User email
  • User department, job title, city, state, company, office, phone, manager
  • You can customize the report to include the details you need
  • Send email reports and include the group members csv export

How to Export AD Group Members with AD Pro Toolkit

Step 1. Download the AD Pro Toolkit

Download AD Pro Toolkit

Step 2. Open Group Members Report

Click on “Group Members Reports” and select “Group Members”.

ad group members report

Step 3. Select groups or path

By default, the tool will run for all groups in your domain. To select specific groups or an OU click the “Browse” button. In this example, I have selected two groups that I want to export its members.

select ad group or ou

Step 4. Add or Remove Attributes

You can display additional details for each member of the group. For example, if I need to show the mail, whenCreated and whenChanged for each group member I can add those to the report. Click the “Columns” button if you want to add or remove attributes for the group members.

Step 4. Click “Run” to preview the export

This will display the groups and the group members for what you have selected. It creates a preview of what you want to export.

Step 5. Export Group Members

Click the “Export” button to export the group members to CSV. You can also choose to export the list to excel or PDF.

export group members to csv

Group members CSV example

Export AD Group Members in a single row

I’ve had several requests to add a report that shows the group and the group members in a single row. This report is now included in the toolkit. Below is an example, you can see the group name in one column and then in the next column it lists all of the group members in a single row.

To run this report click on “Group Member Reports” and then Group Members (Single line).

Nested Groups and Members

To get a list of nested groups and members click the “Nested Groups report. This will list all groups that are members of another group. If the parent group has members, you can expand it to see the list.

nested group and members report

Export only Security Group Members

If you only want to export the members of a specific group type such as security, follow these steps.

  1. Run the group members report for all groups in your domain
  2. Next, click on the groupType column and select Security.
get security groups

Now the tool will only display security groups and the group members. Click the export button to export the report.

list of security groups

The toolkit includes over 200 reports that can be customized, scheduled and export. Below are some additional group and group member reports included.

  • Nested groups
  • Nested groups tree view
  • Groups with no members
  • Large groups
  • Group member count
  • User group membership
  • All security groups
  • All distribution groups
  • Recently modified groups
  • Recently created groups
Download Free Trial

Schedule Automatic Group Member Reports

With the AD Pro Toolkit, you can schedule email reports of group members. This will email you a list of groups and members on a daily, weekly or monthly basis.

  1. Click on “Scheduler”.
  2. Click “Add”.
  3. Select “Reports” and give the task a name.
  4. Choose a schedule frequency and time.
  5. Select “Groups -> General” and then select “group members”.
  6. Select an OU or specific groups.
  7. For the Ouput options select “Email CSV” or “Save CSV”.

I hope this detailed guide helped you to export group members to csv. Exporting group members with PowerShell is pretty easy but can get complicated when trying to include additional user details. Next, you might also want to see our guide on how to export active directory users to csv.

Recommended Tools

  • AD Cleanup Tool - Find stale and inactive user and computer accounts in Active Directory. Export, disable, move or delete the stale accounts to increase security.
  • AD User Creation Tool - Bulk import or update Active Directory user accounts. Add users to groups, import into OUs, set multiple attributes and more.
  • NTFS Permissions Tool - Scan and audit NTFS folder permissions. See which users and groups have access to what.
  • AD Reporting Tool - Over 200 reports on users, computers, groups, OUs and more. Customize reports or create your own reports with the report builder.

131 thoughts on “PowerShell: Export Active Directory Group Members”

  1. So, it’s possible to output all users in a single group to a .csv file, but that means you have to know all the groupnames and change the input parameters for the powershell each time. Is it possible to output all users against all groups in a single domain to a .csv

    Groupname1 , , , etc
    Groupname2 , , , etc
    Groupname3

    I’m looking to check the users in each group and export them to excel as single lines for auditing and further analysis.

    Reply

    • This will export the groupName and members on one line.

      # Define the group name
      $groupName = “group1”

      # Retrieve the members of the specified group and join their SamAccountNames into a single string
      $members = (Get-ADGroupMember -Identity $groupName | Select-Object -ExpandProperty SamAccountName) -join “,”

      # Create a custom object with the group name and the members in one cell
      $groupDetails = [PSCustomObject]@{ GroupName = $groupName; GroupMembers = $members }

      # Export the custom object to a CSV file
      $groupDetails | Export-Csv -Path “C:\temp\groups.csv” -NoTypeInformation

      With our software it does this by default. Click “Group Reports” -> General -> All groups. Make sure the members column is added.

      Group members one line

      Reply

  2. This article is so clear and easy to follow. Thank you.
    It works for some groups and for others I see an error “Get-ADGroupMember : Cannot find an object with identity: ‘Pwa xxx’ under: ‘DC=abc,DC=abc,DC=abc’ “.
    I see this has been answered in a previous comment but how do I know the name of the server or domain controller for a particular group?

    Reply

  3. We have multiple domain controllers, how can we get the output for a group in a
    different DC

    Get-ADGroupMember : Cannot find an object with identity: ‘DC2XXYY-ABCD’ under:
    ‘DC=dc2,DC=int,DC=us’.

    the same command works for groups in dc1

    Reply

    • To get group members from a specific domain controller use the -server parameter.

      Get-ADGroupMember -server dc2 -identity “HR Full”

      Reply

  6. Hi Robert Allen,
    can you help please!
    I need a info with all local administrators on servers and computers ,but excluded Domain Admins Group

    Reply

  10. Hi,
    You did a great job!

    I would like to add few details at Step2 if you don’t see the groups, if the AD has azure information protection.
    First you will need to check the name of the group in AD then use the following command in PowerShell:
    Get-ADGroupMember -identity “Group_Name” | select name

    All the best,
    Alex Gheorghisoara

    Reply

  11. This is very clean and retrieves the information I need for a compliance report. However, I have been asked to transpose data such that the export is formatted such that each group becomes a column header, and the columns contains all members of the “header” group. Any help is greatly appreciated.

    Thank you!

    Reply

  15. Hi
    How do I get groups within a nested group please? So I have a parent group, then within that, I have nested groups. I wanted those nested groups (not users)

    Thanks

    Reply

  18. Hi Robert, thank you for sharing all these helpful commands and PS-Scripts.

    I am trying to create a script that will export all users with their manager name to a csv file. (i got this part done already), I used: get-aduser -Filter * -Properties Manager | Select-Object Name,sAMAccountName,Manager | export-csv C:\temp\UsersManagersExample.csv -notypeinformation.

    But also that shows all the membership groups for each user. I am not sure what is the best way to achieve this. Can you help? I am quite sure that there is a way to get this done using powershell.

    So I am trying to get a list of all managers and their reporties plus the membership assigned to each user.

    Thank you in advance!
    Best Regards,

    Fady

    Reply

  19. Thanks ,Its very useful for audit purpose, I have created around 24 .CSV file. How do I can add all in one excel in different tabs in sing excel.

    Thanks again
    Vaibhav Joshi

    Reply

  20. Hi Robert, how would I get a listing of all members in an AD group that has members from 2 different domains (universal group). Is this possible? Thanks.

    Reply

  22. Hi could you point me in the right direction? Any help would be appreciated. At step 3 I’m running into the following error….

    Get-AdGroupMember : An unspecified error has occurred
    At line:1 char:1
    + Get-AdGroupMember -identity GROUP-TESTA
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : NotSpecified: GROUP-TESTA:ADGroup) [Get-ADGroupMember], ADException
    + FullyQualifiedErrorId : ActiveDirectoryServer:0,Microsoft.ActiveDirectory.Management.Commands.GetADGroupMember

    Reply

  24. Hi Robert, bit late to the party here. I am doing something similar but I wanted to be able to export only names that do not match part of a string to the CSV e.g names that do not match “admin*”. I can manipulate the CSV afterwards but would be great if I could do it as part of PS.

    Reply

Leave a Comment