--- title: "Generate Reports with Get-AdGroupMember in PowerShell" description: "Use Get-AdGroupMember and other cmdlets to find users and export AD group members. Generate insightful reports and enhance your IT skills." canonical: "https://adamtheautomator.com/get-adgroupmember/" --- # Generate Reports with Get-AdGroupMember in PowerShell > Use Get-AdGroupMember and other cmdlets to find users and export AD group members. Generate insightful reports and enhance your IT skills. Source: https://adamtheautomator.com/get-adgroupmember/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Generate Reports with Get-AdGroupMember in PowerShell](https://adamtheautomator.com/wp-content/uploads/2019/12/group-1824145_1280.png) # Generate Reports with Get-AdGroupMember in PowerShell [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)27 December 20198 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Active Directory](/tag/active-directory/)[PowerShell](/tag/powershell/) Table of Contents * [Prerequisites](#prerequisites) * [Learning the Basics](#learning-the-basics) * [Getting AD Groups](#getting-ad-groups) * [Getting AD Group Members with Get-AdGroupMember](#getting-ad-group-members) * [Enumerating Group Members inside of Group Members](#enumerating-group-members-inside-of-group-members) * [Getting Multiple Groups/Members at Once](#getting-multiple-groups-members-at-once) * [Using Alternate Credentials](#using-alternate-credentials) * [Getting Group Members with Get-ADGroup?](#getting-group-members-with-get-adgroup) * [Finding Specific AD Attributes](#finding-specific-ad-attributes) * [Filtering Results](#filtering-results) * [The Filter Parameter](#the-filter-parameter) * [Limiting Group Results by Organizational Unit (OU)](#limiting-group-results-by-organizational-unit-ou-) * [Exporting AD Groups and Members](#exporting-ad-groups-and-members) * [Exporting to a CSV](#exporting-to-a-csv) * [Exporting to Excel](#exporting-to-excel) * [Conclusion](#conclusion) A popular use of PowerShell is working with Active Directory Directory Services (AD). There are so many time-saving things PowerShell can do with AD objects. Using the PowerShell `Get-ADGroupMember` cmdlet and other cmdlets can save you a ton of time. Not a reader? Watch this related video tutorial! **_Not seeing the video? Make sure your ad blocker is disabled._** Active Directory groups are a great way to segment out user accounts. Groups allow admins to define resource access across many systems. Related:[Managing Active Directory Groups using Get-AdGroup and PowerShell](https://adamtheautomator.com/get-adgroup/) In this article, let’s use PowerShell to get AD group members and export AD group members. You can then use this information to generate tons of interesting reports. ![Active Directory group](https://i.stack.imgur.com/UXKbg.jpg) Active Directory group > Manage and Report Active Directory, Exchange and Microsoft 365 with ManageEngine ADManager Plus. [Download Free Trial!](https://www.manageengine.com/products/ad-manager/tp/windows-active-directory-management-tool.html?utm_source=ata&utm_medium=website-listing&utm_campaign=admp-adgroupmember) ## Prerequisites If you’d like to follow along in this article, please be sure you have the following requirements ready to go: * Working on a Windows 10, domain-joined computer * Logged in with a user that can read AD group and user accounts * Have the [PowerShell Active Directory module](https://adamtheautomator.com/powershell-import-active-directory/) installed ## Learning the Basics To query AD groups and group members, you have two PowerShell cmdlets at your disposal – [`Get-AdGroup`](https://adamtheautomator.com/get-adgroupmember/) and `Get-AdGroupMember`. `Get-ADGroup` queries a domain controller and returns AD group objects. [`Get-AdGroupMember`](https://adamtheautomator.com/get-adgroupmember/) looks inside of each group and returns all user accounts, groups, contacts and other objects that exist in that group. ### Getting AD Groups To find AD groups with PowerShell, you can use the `Get-ADGroup` cmdlet. With no parameters, `Get-ADGroup` will query AD and return _all_ groups in a domain using the `Filter` parameter. The `Filter` parameter is required. It exists to limit the groups returned based on various criteria. For example, to find all groups without regard for any criteria, use  `Get-ADGroup` and specify a wildcard (asterisk) for the `Filter` parameter. You can see an example below. Scrolling through all of these groups may take awhile if you have hundreds or even thousands in your domain. ```powershell Get-ADGroup -Filter * ``` If you need to find a single group, you can use the `Identity` parameter. The `Identity` parameter is a common parameter amongst all Active Directory PowerShell cmdlets. It allows you to limit your query down to a single AD object. For example, if you needed to check if a group called _HR_ existed, you could find out by running the command below. ```powershell Get-ADGroup -Identity 'HR' ``` ### Getting AD Group Members with Get-AdGroupMember Using PowerShell to list members of AD group requires the `Get-ADGroupMember` cmdlet. This cmdlet gets user, group and computer objects in a particular group. Perhaps you need to find all members of the _Administrators_ group. In its simplest form, you’d simply use the `Identity` parameter again specifying the name of the group as below. ```powershell Get-ADGroupMember -Identity 'Administrators' ``` > _Note that `Get-AdGroupMember` only returns group membership for users, groups and computers. It will not return other AD objects like contacts._ #### Enumerating Group Members inside of Group Members As you may know, AD groups can not only contain user accounts but other groups also called nesting. When a group is nested inside of another group, the members of _that_ group inherit the same permissions assigned to the parent group. By default, the PowerShell `Get-AdGroupMember` cmdlet does not return nested group members. To remediate that, you can use the `Recursive` parameter. For example, you could find members of groups nested inside of the _HR_ group using the `Recursive` parameter as shown below. ```powershell Get-ADGroupMember -Identity 'HR' -Recursive ``` Related:[How to Audit Active Directory Group Memberships with PowerShell](https://adamtheautomator.com/active-directory-group-memberships/) ### Getting Multiple Groups/Members at Once If you need to query AD for many different groups or group members at once, you can also do that using a PowerShell [foreach](https://adamtheautomator.com/powershell-foreach/ "foreach") loop. A foreach loop runs a command or code _for each_ item in a collection. In this case, that collection will be a list of group names. Perhaps you need to find all group members in the _HR_, _Accounting,_ and _IT_ groups. To do that, you’d first create a collection or array of these group names. The example below defines this collection as `$groupNames`. Then, _for each_ name in that collection, run `Get-ADGroupMember` providing the name of _each_ group to the `Identity` parameter. ```powershell $groupNames = 'HR','Accounting','IT' foreach ($group in $groupNames) { Get-ADGroupMember -Identity $group } ``` > _You could alternatively use the [`ForEach-Object` cmdlet](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/foreach-object?view=powershell-7.2&viewFallbackFrom=powershell-7.1) to loop over groups._ ## Using Alternate Credentials Like many other PowerShell cmdlets, the AD group cmdlets have a `Credential` parameter. By default, whenever you run an AD group cmdlet, it uses your logged-in credentials to query Active Directory. This behavior dictates you need to be on a domain-joined computer logged in as an Active Directory user that has permission. But what if you’re on a workgroup computer or need to authenticate to AD as a different user? In that case, you can use the `Credential` parameter. This parameter allows you to specify a username and password to use for authentication. For example, perhaps your user account doesn’t have the right to perform an AD task. You have a service account with additional rights. You can be logged in as a standard user yet still authenticate with the service account as shown below. The `Get-Credential` cmdlet prompts for a username/password to create a credential. This credential is then passed to the `Get-AdGroup` cmdlet for authentication. ```powershell Get-ADGroup -Identity 'HR' -Credential (Get-Credential) ``` > _The `Credential` parameter is ubiquitous in PowerShell for providing authentication credentials. For more information, read [Using the PowerShell Get-Credential cmdlet and all things credentials](https://adamtheautomator.com/powershell-get-credential/)._ ## Getting Group Members with Get-ADGroup? It may sound counterintuitive but you can also get group members with the `Get-ADGroup` cmdlet also. It turns out that `Get-ADGroup` returns a property for each group called `members`. This is a collection of AD objects that are members of a group. For example, to find group members in that _HR_ group again without using `Get-ADGroupMember`, you could do something like this: ```powershell Get-ADGroup -Identity 'HR' -Properties members ``` Why use this method over the other? The main difference is that the `members` properties contains _all_ types of AD objects – not just users, computers, and other groups. Perhaps you have contacts inside of various groups. When you run `Get-ADGroupMember`, those contacts would not show up. But if you tell `Get-ADGroup` to return all members in that group along with expanding that collection as shown below, you’ll see the contacts. ```powershell Get-ADGroup -Identity 'HR' -Properties members | Select-Object -ExpandProperty members ``` ## Finding Specific AD Attributes In the basics section above, you simply were returning all groups and group members. The information returned for each group and group member is only a subset of the AD attributes associated with each type of object. Maybe you want to see a user account’s email address, last logon date, or other associated AD attribute? To do this, you’ll need to get creative. Perhaps you were able to find all of the group members in the _HR_ group but need to also see each user account’s email address? ```powershell $groupMembers = (Get-ADGroup -Identity 'HR' -Properties members).members $groupMembers | Select-Object -Property Name, @{Name='Member';exp={Get-AdUser -Identity $_.Name -Properties emailAddress,lastlogonDate}} ``` ## Filtering Results Up to this point, you’ve found _all_ groups and group members, but in a day-to-day work environment, you rarely need to do this. Chances are, you’ll need to only find a limited number of each item. The AD group cmdlets have a few ways you can handle this. ### The `Filter` Parameter As mentioned earlier, both cmdlets have the `Filter` parameter. This parameter allows you to limit what is returned in many different ways outside the scope of this article. Using the `Filter` parameter, you can limit results by any AD attribute such as name, group type, email address, last logon for users and so on. For example, perhaps you want to find only security groups. In that case, you’d specify a `GroupCategory` attribute and set a condition to ensure only `Security` groups are returned. ```powershell Get-ADGroup -Filter 'GroupCategory -eq "Security"' ``` Maybe you want to find all security groups but they must _not_ be domain local groups. You’d then add another condition (this time using the `-ne` operator) to prevent any domain local groups from being returned. ```powershell Get-ADGroup -Filter 'GroupCategory -eq "Security" -and GroupScope -ne "DomainLocal"' ``` > _If you’d like to learn how to create query filters, be sure to check out [Learning Active Directory and LDAP Filters in PowerShell](https://adamtheautomator.com/ldap-filter/)._ ### Limiting Group Results by Organizational Unit (OU) Perhaps you have various groups nested in OUs. You don’t necessarily want to find _all_ groups but only groups in a specific OU. In that case, you can use the `SearchBase` parameter. The `SearchBase` parameter allows you to specify an OU’s distinguished name (DN) to start searching for groups in. For example, perhaps you have an OU called _Locations_ at the root of your domain. In the _Locations_ OU, you have each location OU created like _Austin_, _NYC,_ and _Los Angeles_. You are only looking for groups in the NYC OU and need to restrict seeing the others. An example AD OU structure is shown below. Notice that other groups exist outside of the _Locations_ OUs. ```powershell company.local - Locations - Austin - NYC - Group 1 - Group 2 - Los Angeles - Computers - Group 3 - Group 4 - Service Accounts ``` Perhaps you need to find all AD groups that are only in the _NYC_ OU. To limit the query, you’d use the `SearchBase` parameter providing the DN as shown below. All groups inside of the _Locations_ OU are returned. ```powershell Get-ADGroup -Filter '*' -SearchBase 'OU=Locations,OU=NYC,DC=company,DC=pri' ``` But now you need to find _all_ groups in _all_ OUs under the _Locations_ OU. `Get-ADGroup` only returns groups in the _Locations_ OU itself – not in the child OUs. To return groups inside of child OUs, you’d need to use the `SearchScope` parameter. This parameter is similar to the `Recursive` parameter in that it will inspect child objects too. For example, to find all groups in _any_ OU under the _Locations_ OU, specify `Subtree` or `2` . This value for `SearchScope` tells `Get-ADGroup` to recursively look at all children, grand children and on down OUs. ```powershell Get-ADGroup -Filter '*' -SearchBase 'OU=Locations,DC=company,DC=pri' -SearchScope 2 ``` For a complete breakdown of `SearchScope` parameter options, refer to the `Get-ADGroup` documentation. ## Exporting AD Groups and Members So you finally know how to query and return the groups and group members you need. All this information is sent to the PowerShell console.  But now you need to get this information into a CSV file or Excel worksheet. The only thing you need to do now is send all of that information to a file. ### Exporting to a CSV One popular format to export AD information to is a CSV. PowerShell has a handy cmdlet that allows you to easily create CSV files from PowerShell output called `Export-Csv`. You can create a CSV file from any command covered in this article by piping it to `Export-Csv`. Using the example below, will redirect all output that `Get-AdGroup` would have return to the console, to a CSV file instead. ```powershell Get-ADGroup -Filter '*' -SearchBase 'OU=Locations,DC=company,DC=pri' -SearchScope 2 | Export-Csv -Path 'departmental_groups.csv' -NoTypeInformation ``` > _For more information on this handy cmdlet, check out [Export-Csv: The PowerShell Way to Treat CSV Files as First-Class Citizens](https://adamtheautomator.com/export-csv/)._ You can also easily export results to CSV via the `Get-AdGroupMember` cmdlet. ### Exporting to Excel PowerShell doesn’t have a native way to export information to Excel. But, you can always download the free community module called ImportExcel. This module brings CSV-like export abilities directly to Excel worksheets. To install the [PowerShell module](https://adamtheautomator.com/powershell-modules/ "PowerShell module"), run `Install-Module ImportExcel -Scope CurrentUser`. Using the example above, instead of a CSV file, you needed to export the groups to an Excel worksheet, you’d use the `Export-Excel` cmdlet as shown below. > _Find leaked & unsafe passwords in your Active Directory by checking against [the NCSC Password list](https://specopssoft.com/product/specops-password-auditor/?utm_source=ATA&utm_medium=referral&utm_campaign=ATA%20promo%202021&utm_content=SPA%20in-article%20link)._ ```powershell Get-ADGroup -Filter '*' -SearchBase 'OU=Locations,DC=company,DC=pri' -SearchScope 2 | Export-Excel -Path 'departmental_groups.csv' ``` The ImportExcel module has a ton of functionality to work with Excel. If you need a fancier worksheet, it probably has a function for you. > _For more information on using the ImportExcel module, read [this article](https://adamtheautomator.com/powershell-excel/). It provides a great introduction to some common use cases it can handle._ > Manage and Report Active Directory, Exchange and Microsoft 365 with ManageEngine ADManager Plus. [Download Free Trial!](https://www.manageengine.com/products/ad-manager/tp/windows-active-directory-management-tool.html?utm_source=ata&utm_medium=website-listing&utm_campaign=admp-adgroupmember) ## Conclusion Using just two PowerShell cmdlets, you can do just about anything with AD groups. This article was just an intro to the functionality available to you. Use the knowledge gathered here, follow some of the links to deeper subject dives in the article and see what you can build! Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fget-adgroupmember%2F&text=Generate%20Reports%20with%20Get-AdGroupMember%20in%20PowerShell)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fget-adgroupmember%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fget-adgroupmember%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2024/11/image-23.png) ### [Managing Active Directory Groups with PowerShell: The Ultimate Guide](/powershell-ad-groups-guide/) Learn how to manage Active Directory groups with PowerShell! This hands-on guide shows you how to query, create and modify AD groups using practical real-world ![](https://adamtheautomator.com/wp-content/uploads/2019/08/database-152091_1280.png) ### [Active Directory Database: PowerShell Monitoring Made Easy](/active-directory-database/) Find the ntds.dit location and monitor your Active Directory database using PowerShell. ![](https://adamtheautomator.com/wp-content/uploads/2019/07/panic-1393619_1280.png) ### [How to Find Locked Out Users in Active Directory with PowerShell](/find-locked-out-users-in-active-directory-powershell/) See what we can do to find locked out users in Active Directory with PowerShell! ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)