Finding group member is a task that every AD administrator has dealt with at some point of time. If it is a group with a handful of members, you can use the good old AD Users and Computers snap-in to find the information. But, what if it is a large group and you want the information to be exported to a csv file?
The AD Users and Computers snap-in does not have any option to export the AD group membership. But you can use PowerShell to complete the task and more using the Get-ADGroupMember cmdlet. We will look at the various options and scenarios that a real world demands and try to get the job done using PowerShell.
Table of Contents
Install the Active Directory PowerShell Module
Let’s start with the basic cmdlet and build our way up. We need the Active Directory module to be installed on the machine from which we want to run the Get-ADGroupMember cmdlet, unless you are running it from the domain controller itself.
Most organizations will have a management server where the AD tools (RSAT) are installed and that will make the job easier. If you are instead running it from a client machine like Windows 11, make sure that the Remote Server Administration Tools (RSAT) are installed already.
Find & export group members of a simple group
Run the command below if you want to have a look at the group membership of an AD group.
Get-ADGroupMember -identity <groupname>
Well, the output above has a lot more attributes than I need. I am not that keen on attributes like ObjectGuid. We can further filter the required output using the select parameter.
Get-ADGroupMember -identity <groupname> | select name, samaccountname
If you are happy with the output, you can export the information to a csv file by using export-csv cmdlet.
Get-ADGroupMember -identity <groupname> | select name, samaccountname | export-csv .\Members.csv -notypeinformation
Note that you can specify a location of your choice. Using the command above will export the information to a csv file from the location you are running the one-liner. If you want a different location of your choice, you can specify the path, for example c:\temp\members.csv.
The command will look like below.
Get-ADGroupMember -identity <groupname> | select name, samaccountname | export-csv c:\temp\Members.csv -notypeinformation
Find & export membership of groups with groups nested
The scenario above is pretty straightforward. What if we want to have the group membership of an AD group that has other groups within it (of course, with members).
For example, I have a group named ‘Cloudiffic Team’ with ‘IT Team’ group nested.
Running Get-ADGroupMember ‘Cloudiffic Team’ is going to only list the ‘IT Team’ group as a member, but it will not list the accounts within it.
Run the command below if you want to get the membership of the group within as well.
Get-ADGroupMember -identity <groupname> -Recursive | select name, samaccountname
You can see that the ‘IT Team’ group entry is replaced by the user account, who is a member of the group.
As always, you can export the information by piping the output to export-csv cmdlet.
Get-ADGroupMember -identity <groupname> -Recursive | select name, samaccountname | export-csv .\Members.csv -notypeinformation
Find & export group membership with additional attributes
Having the above information is pretty good in most cases. But, sometimes we might end up in a situation where we need the email address of the user (for example).
The Get-ADGroupMember cmdlet doesn’t bring that info back and the above commands need to be modified & piped to Get-ADUser to find the user attributes that you need.
Run the command below to find the group membership along with the user’s email addresses.
Get-ADGroupMember -Identity <groupname> | Get-ADUser -Properties mail | select name, mail
If you want to find the same info along with users from the groups within, use the Recursive parameter.
Get-ADGroupMember -Identity <groupname> -Recursive | Get-ADUser -Properties mail | select name, mail
Use the export-csv cmdlet to extract the info into a csv file.
Get-ADGroupMember -Identity <groupname> -Recursive | Get-ADUser -Properties mail | select name, mail | export-csv .\Members.csv -notypeinformation
Find & export members of groups with users & contacts
Now that we have tackled to get the users within a group along with membership from any nested groups, how can we also get information of contacts that may be part of a group?
Run the command below to get the membership of an AD group with users and contacts within it.
Get-ADGroup <groupname> -Properties member | select-object -ExpandProperty member
Please let me know if you have any questions in the comments section.