---
title: "Managing AD Groups with Get-ADGroup and More"
description: "Master the Get-ADGroup cmdlet and other tools for efficient AD group management using PowerShell."
canonical: "https://adamtheautomator.com/get-adgroup/"
---

# Managing AD Groups with Get-ADGroup and More

> Master the Get-ADGroup cmdlet and other tools for efficient AD group management using PowerShell.

Source: https://adamtheautomator.com/get-adgroup/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![Managing AD Groups with Get-ADGroup and More](https://adamtheautomator.com/wp-content/uploads/2019/08/active-directory-group.png)

# Managing AD Groups with Get-ADGroup and More

[![](https://secure.gravatar.com/avatar/995fcc2faf7fc9d3f15061d8e6c5b84f4b751d96502ef7afb4f9f648a58b36a4?s=192&d=mm&r=g)Stuart Squibb](https://adamtheautomator.com/author/stuart/)22 August 20195 min. read

Categories: [IT Ops](/category/it-ops/)

Tags:[Active Directory](/tag/active-directory/)[PowerShell](/tag/powershell/)

Table of Contents

*   [Active Directory Group Cmdlets](#active-directory-group-cmdlets)
*   [Find the members of a group with Get-ADGroupMember](#find-the-members-of-a-group)
*   [Export the members of a group to a CSV file](#export-the-members-of-a-group-to-a-csv-file)
*   [Find groups with no members with Get-ADGroup](#find-groups-with-no-members)
*   [Create a new security group with New-ADGroup](#create-a-new-security-group)
*   [Create a new distribution group with New-ADGroup](#create-a-new-distribution-group)
*   [Add members to a group with Add-ADGroupMember](#add-members-to-a-group)
*   [Write to the Notes property of a group with Set-AdGroup](#write-to-the-notes-property-of-a-group)
*   [Remove group members with Remove-ADGroupMember](#remove-group-members)
*   [Delete a group with Remove-ADGroup](#delete-a-group)
*   [Rename a group with Rename-ADObject](#rename-a-group)
*   [Get the number of groups with Get-ADGroup](#get-the-number-of-groups)
*   [Find groups with a manager with Get-ADGroup](#find-groups-with-a-manager)
*   [Find groups managed by a specific user with Get-ADGroup](#find-groups-managed-by-a-specific-user)
*   [Set the group Manager with Set-ADGroup](#set-the-group-manager)
*   [Find all security groups](#find-all-security-groups)
*   [Find Distribution groups](#find-distribution-groups)
*   [Find group membership for a user with Get-ADPrincipalGroupMembership](#find-group-membership-for-a-user)
*   [Find groups in an OU, not including any sub-OUs](#find-groups-in-an-ou-not-including-any-sub-ous)
*   [Find groups in an OU, including any sub-OUs](#find-groups-in-an-ou-including-any-sub-ous)
*   [Summary](#summary)

Using the ActiveDirectory PowerShell module, you can query AD groups with Get-AdGroup, add, update, and remove groups and group members. In this blog post, you’re going to learn a little about the Active Directory group PowerShell cmdlets with a ton of examples for reference.

Not a reader? Watch this related video tutorial!

**_Not seeing the video? Make sure your ad blocker is disabled._**

## Active Directory Group Cmdlets

Once you [install the ActiveDirectory PowerShell module](https://adamtheautomator.com/powershell-import-active-directory/), you’ll find a few cmdlets available to manage groups.

<table><tbody><tr><td class="has-text-align-left" data-align="left"><strong>Cmdlet Name</strong></td><td><strong>Description</strong></td></tr><tr><td class="has-text-align-left" data-align="left">Add-ADGroupMember</td><td>Used to add members to an AD group.</td></tr><tr><td class="has-text-align-left" data-align="left">Add-ADPrincipalGroupMembership</td><td>Used to add an AD principal to AD groups.</td></tr><tr><td class="has-text-align-left" data-align="left">Get-ADGroup</td><td>Used to return a group or groups from AD.</td></tr><tr><td class="has-text-align-left" data-align="left">Get-ADGroupMember</td><td>Used to return the members of an AD group.</td></tr><tr><td class="has-text-align-left" data-align="left">Get-ADPrincipalGroupMembership</td><td>Used to get the groups an AD principal is a member of.</td></tr><tr><td class="has-text-align-left" data-align="left">New-ADGroup</td><td>Used to create a new AD group.</td></tr><tr><td class="has-text-align-left" data-align="left">Remove-ADGroup</td><td>Used to delete an AD group.</td></tr><tr><td class="has-text-align-left" data-align="left">Remove-ADGroupMember</td><td>Used to remove members from an AD group.</td></tr><tr><td class="has-text-align-left" data-align="left">Remove-ADPrincipalGroupMembership</td><td>Used to remove an AD principal from AD groups.</td></tr><tr><td class="has-text-align-left" data-align="left">Set-ADGroup</td><td>Used to set the properties of an AD group.</td></tr></tbody></table>

Using these cmdlets and a little PowerShell kung-fu, you can manage every aspect of the Active Directory group with PowerShell.

### Find the members of a group with Get-ADGroupMember

The [`Get-AdGroupMember`](https://adamtheautomator.com/get-adgroupmember/) cmdlet returns all members in a group.

```powershell
PS51> Get-ADGroupMember -Identity <identity string or object>
```

Alternatively, you could reference the `memberOf` property on a particular user using the [`Get-Aduser`](https://adamtheautomator.com/get-aduser/) cmdlet. For a refresher on how to build filters, check out [Learning Active Directory Directory and LDAP Filters in PowerShell](https://adamtheautomator.com/ldap-filter/).

Two examples are below.

```powershell
PS51> Get-ADUser -Filter 'memberOf -eq ""'
PS51> Get-ADUser -LDAPFilter '(memberOf=)'
```

This returns a collection of _ADPrincipal_ objects.

### Export the members of a group to a CSV file

This exports each users’ first name, surname and email address. Pipe the results from`Get-ADGroupMember` to `Get-ADUser` because these are _ADPrincipal_ objects that do not have all of the properties that _ADUser_ objects have.

```powershell
PS51> $GroupMembers = Get-ADGroupMember -Identity 'Professional Services Department'
PS51> $GroupMembers | Get-ADUser -Properties GivenName,Surname,Mail | Select-Object GivenName,Surname,Mail | Export-CSV -Path GroupMembers.CSV -NoTypeInformation
```

> _Notice the use of the `NoTypeInformation` parameter of `Export-CSV` to ensure that the CSV file is compatible with other applications._

### Find groups with no members with Get-ADGroup

Use [`Get-AdGroup`](https://adamtheautomator.com/get-adgroup/) to find groups using filters. Two examples below.

```powershell
PS51> Get-ADGroup -Filter "Members -notlike '*'"
PS51> Get-ADGroup -LDAPFilter "(!(member=*))"
```

### Create a new security group with New-ADGroup

You create a new security group using the `New-AdGroup` command.

```powershell
PS51> New-ADGroup -Name '<group name>' -GroupScope <scope of group> -Path '<path of the OU tht will host the new group>'
```

If no `Path` parameter is supplied, the new group will be created in the _Users_ container. The group scope must be either `DomainLocal`, `Global` or `Universal`.

### Create a new distribution group with New-ADGroup

Use `New-AdGroup` again to create a distribution group. This time, choose a `GroupCategory` of `Distribution`.

```powershell
PS51> New-ADGroup -Name '<group name>' -GroupScope <scope of group>  -GroupCategory Distribution -Path '<path of the OU tht will host the new group>'
```

### Add members to a group with Add-ADGroupMember

Adding users to an Active Directory group with PowerShell can be done using the `Add-AdGroupMember` cmdlet or the `Add-ADPrincipalGroupMembership` cmdlet.

This command specifies the group as the _Identity_.

```powershell
PS51> Add-ADGroupMember -Identity <identity string or object> -Members <identity string(s) or ADPrincipal(s)>
```

This command specifies the AD principal as the _Identity_.

```powershell
PS51> Add-ADPrincipalGroupMembership -Identity <identity string or object> -MemberOf <identity string(s) or ADGroup(s)>
```

### Write to the `Notes` property of a group with Set-AdGroup

The field labeled _Notes_ in ADUC is represented by the `Info` property returned from `Get-AdGroup`.

First, find the group to change, set the `Info` property and then use `Set-AdGroup` to commit the change to AD.

```powershell
PS51> $group = Get-ADGroup -Identity <identity string or object>
PS51> $group.Info = 'Important notes on this group'
PS51> Set-ADGroup $group
```

### Remove group members with Remove-ADGroupMember

Like all PowerShell cmdlets, you can use the `Confirm` parameter to be prompted before a change is made. This behavior applies to the `Remove-AdGroupMember` and `Remove-ADPrincipalGroupMembership` cmdlets too.

Below you can remove group members with no confirmation.

```powershell
PS51> Remove-ADGroupMember -Identity <identity string or object> -Members <identity string(s) or ADPrincipal(s)>
PS51> Remove-ADPrincipalGroupMembership -Identity <identity string or object> -MemberOf <identity string(s) or ADGroup(s)>
```

Or you can choose to remove group members with confirmation using the `Confirm` parameter.

```powershell
PS51> Remove-ADGroupMember -Identity <identity string or object> -Members <identity string(s) or ADPrincipal(s)> -Confirm
PS51> Remove-ADPrincipalGroupMembership -Identity <identity string or object> -MemberOf <identity string(s) or ADGroup(s)> -Confirm
```

### Delete a group with Remove-ADGroup

Delete a group with no confirmation and with confirmation.

```powershell
PS51> Remove-ADGroup -Identity <identity string or object>
PS51> Remove-ADGroup -Identity <identity string or object> -Confirm
```

### Rename a group with Rename-ADObject

You can rename a group via a one-liner using `Rename-ADObject`.

```powershell
PS51> Rename-ADObject -Identity <identity string or object> -NewName '<new name>'
```

### Get the number of groups with Get-ADGroup

Do you need to find the total numbers of groups returned via `Get-AdGroup`? Use the `Count` property.

```powershell
PS51> (Get-ADGroup -Filter '*').Count
```

### Find groups with a manager with Get-ADGroup

Filter all groups that have a manager assigned to them with `Get-AdGroup` and a well-crafted [LDAP filter](https://adamtheautomator.com/ldap-filter/).

```powershell
PS51> Get-ADGroup -LDAPFilter '(managedby=*)'
```

There is no equivalent PowerShell filter for this.

### Find groups managed by a specific user with Get-ADGroup

Up your filter skills and find all groups managed by a specific user using either a PowerShell filter or LDAP filter.

```powershell
PS51> Get-ADGroup -Filter 'managedby -eq "<distinguished name of user>"'
PS51> Get-ADGroup -LDAPFilter '(managedby=<distinguished name of user>)'
```

### Set the group Manager with Set-ADGroup

The _Managed By_ tab in ADUC for groups allows you to designate someone who is responsible for the membership of the group. This doesn’t automatically mean that the manager can alter the group membership of the group. For that to be possible, the security permissions need to be changed on the _Member_ property for the group in question.

The act of ticking the _Manager can update membership list_ box for a group in _Active Directory Users and Computers_ (ADUC) changes the permissions to allow this.

![Active Directory Users and Computers - Managed by tab](/wp-content/uploads/2019/08/ManagedBy.png)

_Managed By_ tab in _Active Directory Users and Computers_

Use `Set-ADGroup` to set the _ManagedBy_ attribute:

```powershell
PS51> Set-ADGroup -ManagedBy '<distinguished name, GUID, SID or SAM Account name of manager>'
```

Updating the Access Control list takes a few more steps. The following code snippet grants the user Kristin Diaz the ability to manage the membership of the group. _bf9679c0-0de6-11d0-a285-00aa003049e2_ is the GUID for the `Member` property of the group.

If Kristin is also set as the manager of the group then the tick box will be ticked. If not, Kristin will still be able to manage the membership of the group but will not be shown in ADUC as the manager.

> _Find leaked & unsafe passwords in your Active Directory by checking against [the NCSC Password list](https://specopssoft.com/product/specops-password-auditor/?utm_source=ATA&utm_medium=referral&utm_campaign=ATA%20promo%202021&utm_content=SPA%20in-article%20link)._

```powershell
$group = Get-ADGroup -Identity 'Professional Services Department'
$manager = Get-ADUser -Identity 'Kristin.Diaz'
$NTPrincipal = New-Object System.Security.Principal.NTAccount $manager.samAccountName
$objectGUID = New-Object GUID 'bf9679c0-0de6-11d0-a285-00aa003049e2'
$acl = Get-ACL "AD:$($group.distinguishedName)"
$ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $NTPrincipal,'WriteProperty','Allow',$objectGUID
$acl.AddAccessRule($ace)
Set-ACL -AclObject $acl -Path "AD:$($group.distinguishedName)"
```

### Find all security groups

List all security groups in Active Directory with PowerShell by limiting your search query to only security groups with these two examples. What’s that LDAP filter, you ask? [Learn all about LDAP filters](https://adamtheautomator.com/ldap-filter/).

```powershell
PS51> Get-ADGroup -Filter 'groupcategory -eq "Security"'
PS51> Get-ADGroup -LDAPFilter '(groupType:1.2.840.113556.1.4.803:=2147483648)'
```

### Find Distribution groups

Use PowerShell to list Active Directory Groups (distribution) which excludes security groups using these two examples.

```powershell
PS51> Get-ADGroup -Filter 'groupcategory -eq "Distribution"'
PS51> Get-ADGroup -LDAPFilter '(!(groupType:1.2.840.113556.1.4.803:=2147483648))'
```

### Find group membership for a user with Get-ADPrincipalGroupMembership

```powershell
PS51> Get-ADPrincipalGroupMembership -Identity <identity string or object>
```

> Note that this command requires access to a global catalog.

### Find groups in an OU, not including any sub-OUs

Get granular using the `SearchBase` parameter to limit your search to a single OU using these two examples.

```powershell
PS51> Get-ADGroup -Filter '*' -SearchBase '<distinguished name of OU>' -SearchScope OneLevel
PS51> Get-ADGroup -LDAPFilter '(CN=*)' -SearchBase '<distinguished name of OU>' -SearchScope OneLevel
```

### Find groups in an OU, including any sub-OUs

Do you need to find all groups in child OUs? Use a `SearchScope` of `SubTree`.

```powershell
PS51> Get-ADGroup -Filter '*' -SearchBase '<distinguished name of OU>' -SearchScope SubTree
PS51> Get-ADGroup -LDAPFilter '(CN=*)' -SearchBase '<distinguished name of OU>' -SearchScope SubTree
```

## Summary

That concludes our example-driven demo of managing AD groups with PowerShell. Grab a few of these, try them out in your organization and start automating!

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fget-adgroup%2F&text=Managing%20AD%20Groups%20with%20Get-ADGroup%20and%20More)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fget-adgroup%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fget-adgroup%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/2024/11/image-23.png)

### [Managing Active Directory Groups with PowerShell: The Ultimate Guide](/powershell-ad-groups-guide/)

Learn how to manage Active Directory groups with PowerShell! This hands-on guide shows you how to query, create and modify AD groups using practical real-world

![](https://adamtheautomator.com/wp-content/uploads/2019/08/database-152091_1280.png)

### [Active Directory Database: PowerShell Monitoring Made Easy](/active-directory-database/)

Find the ntds.dit location and monitor your Active Directory database using PowerShell.

![](https://adamtheautomator.com/wp-content/uploads/2019/07/panic-1393619_1280.png)

### [How to Find Locked Out Users in Active Directory with PowerShell](/find-locked-out-users-in-active-directory-powershell/)

See what we can do to find locked out users in Active Directory with PowerShell!

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)