7

I'm trying get a list of all members from a AD Group showing active \ inactive users. The purpose is get all the members on the groups and list the ones with Admin privileges.

I did the following commands:

$GROUPNAME = "Domain Admins" 
Get-ADGroupMember -identity $GROUPNAME -Recursive | Select name, SamAccountName, objectclass | Sort-Object Name

Tried to combine with Get-ADUser -Filter {Enabled -eq $false} but I need the first cmdlet to output for me Users, so I can filter with Get-ADuser.

Tks in advance

Marlon
  • 408

4 Answers4

7

Did this way:

$groupname = "Domain Admins"
$users = Get-ADGroupMember -Identity $groupname | ? {$_.objectclass -eq "user"}
foreach ($activeusers in $users) { Get-ADUser -Identity $activeusers | ? {$_.enabled -eq $true} | select Name, SamAccountName, UserPrincipalName, Enabled }

If you want disabled just replace last cmdlet:

foreach ($activeusers in $users) { Get-ADUser -Identity $activeusers | ? {$_.enabled -eq $false} | select Name, SamAccountName, UserPrincipalName, Enabled }
Marlon
  • 408
1

using Marlon's answer above. if you want to output it as a list to text or CSV you can do this:

$groupname = "Domain Admins"
$users = Get-ADGroupMember -Identity $groupname | ? {$_.objectclass -eq "user"}
$result = @()
foreach ($activeusers in $users) { $result += (Get-ADUser -Identity $activeusers | ? {$_.enabled -eq $true} | select Name, SamAccountName, UserPrincipalName, Enabled) }
$result | Export-CSV  -NoTypeInformation .\active_domain_admins.csv

you can switch the last line to this, if you just want output to a text file:

$result | Out-File .\active_domain_admins.txt
Vicer
  • 111
1

Are you looking for something like this?

$GrpName = '[Group Name]'
$ExportPath = 'C:\\Temp\\' + $GrpName + '-GroupMembers.csv'
$Grp = Get-ADGroup $GrpName | Get-ADGroupMember -Recursive | Get-ADUser -Properties Name,Mail,Enabled  | Select-Object Name,Mail,Enabled | Where-Object {$_.Enabled -eq $True}
$Grp.Count
$Grp | Export-Csv -NoType $ExportPath
Toto
  • 19,304
Chris
  • 11
1

My "oneliner". Thanks for answers above.

$GROUPNAME = "Domain Admins" 
Get-ADGroupMember $GROUPNAME | Get-ADUser | Where-Object -Property enabled -eq $true | select name
Aleksandr Kharkovskiy
  • 11