List members of multiple AD groups with multiple user account attributes details

Question

Hello Everyone,

I have 1000 AD groups for which I need the user account details with multiple attribute details like displayName, givenname, sn, mail, sAMAccountName, etc. in a .csv file with row-wise information mentioning every AD group using PowerShell.

Eg.

Group1 displayName givenname sn mail sAMAccountName

Group1 displayName1 givenname1 sn3 mail4 sAMAccountName5

Group1 displayName2 givenname2 sn3 mail4 sAMAccountName5

Group1 displayName3 givenname2 sn3 mail4 sAMAccountName5

Answer 1

Hi @Saptarshi Mitra ,

maybe this helps to get started with the script: How to use Get-ADGroupMember in PowerShell

Just get started with a script that gets the required properties for one AD group first.

In a second step you can get all AD groups (using Get-ADGroup) and loop with the first part of the code through all groups.

---

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Answer 2

Hello, you can try the script below. Add or remove attributes based on your needs.

#===========================================================================
# Script: Get-GroupAndMembersCount.ps1
# Purpose: Gets group memberships including member count, Days since last
# changed, Group Scope, etc. 
# Legal: Script provided "AS IS" without warranties or guarantees of any
# kind.  USE AT YOUR OWN RISK.  Public domain, no rights reserved.
#===========================================================================


$GroupList = Get-ADGroup -Filter * -Properties Name, DistinguishedName, `
        GroupCategory, GroupScope, whenCreated, whenChanged, member, `
        memberOf, SamAccountName, Description |            
    Select-Object Name, DistinguishedName, GroupCategory, GroupScope, `
        whenCreated, whenChanged, member, memberOf, SamAccountName, `
        Description, `
        @{name='MemberCount';expression={$_.member.count}}, `
        @{name='MemberOfCount';expression={$_.memberOf.count}}, `
        @{name='DaysSinceChange';expression=`
            {[math]::Round((New-TimeSpan $_.whenChanged).TotalDays,0)}} |            
    Sort-Object Name            
            
$GroupList |            
    Select-Object Name, SamAccountName, Description, DistinguishedName, `
        GroupCategory, GroupScope, whenCreated, whenChanged, DaysSinceChange, `
        MemberCount, MemberOfCount |            
    Export-CSV "F:\Exports\GroupsList.csv" -NoTypeInformation

Answer 3

Hello Everyone,

Wishing you all a delighted new year!!

Thank you so much for your responses.

Let me rephrase the question:

I have a text file where 1000 AD groups have been listed. I want to call that file and get user details of every AD group like the below format in the .csv file.

Eg.

Group1 displayName givenname sn mail sAMAccountName

Group1 displayName1 givenname1 sn1 mail1 sAMAccountName1

Group2 displayName2 givenname2 sn2 mail2 sAMAccountName2

Group3 displayName3 givenname3 sn3 mail3 sAMAccountName3

Group3 displayName4 givenname4 sn4 mail4 sAMAccountName4

When I try with one single AD group, I get the user details without the AD group name in the file. Now in this way, I need to run 1000 scripts separately.

Your guide will be really helpful here.

Thanks!

Answer 4

Try this:

Get-ADGroup -Filter * |
    ForEach-Object{
        $GroupName = $_.Name
        Get-ADGroupMember -Identity $_.distinguishedName |
                ForEach-Object{
                    Get-ADObject $_.distinguishedName -properties displayname,givenname,sn,mail,objectcategory|
                        ForEach-Object{
                            [PSCustomObject]@{
                                GroupName   = $GroupName
                                displayName = $_.displayName
                                givenName   = $_.givenName
                                sn          = $_.sn
                                mail        = $_.mail
                                objectType  = ($_.objectCategory -replace '^CN=(.+?)(?<!\\),.*','$1')   # get CN value
                                DN = $_.distinguishedname
                            }
                        }
                }
        }

I added the objectCategory and distinguishedName properties to the list. You may need them to sort out why certain objects you didn't expect show up in the output. E.g., computers, groups, contacts, etc.

Also, if anything that's a member of a group doesn't have a sn, givenName, or mail property (think 'security group' and 'computer' objects) you may have to depend on the distinguishedName/objectType to know what they are.