List off all AD groups that have between 1 and 3 users

$total = @() foreach ($group in Get-ADGroup -Filter * -ResultSetSize 100000 | Sort-Object Name) { $members = get-adgroup $group.name | Get-ADGroupMember | Sort-Object Name $count = @(Get-ADGroupMember -Identity $Group).Count if ($count -ge 1 -and $count -le 3) { foreach ($member in $members) { $info = [PSCustomObject]@{ Group = $group.Name "Total Members" = $count Member = $member.SamAccountName } $total += $info } } } $total | export-csv -NoTypeInformation -Encoding UTF8 -Delimiter ';' -Path c:\temp\groups.csv

LainRobertson
Silver Contributor
Apr 22, 2022
Harm_Veenstra

It'd be useful to know from the poster if this is explicit or transitive, and related to members that are users or of any object type.

I couldn't motivate myself to ask but they're all things that would definitely impact the script.

Here's a quick one-liner that demonstrates pulling the transitive membership, which requires an additional round trip per group (since it's only available on base searches) and the explicit requesting of the msds-memberTransitive constructed attribute (i.e. using "-Properties *" doesn't cut it.)

(Get-ADGroup -SearchBase ((Get-ADGroup -Identity "Domain Admins").distinguishedName) -SearchScope Base -Filter * -Properties msds-memberTransitive).'msds-memberTransitive'.Count

Anyhow, that's all from me as the question's too open to know how best to answer at the moment.

Cheers,
Lain
- Harm_Veenstra
  MVP
  Apr 22, 2022
  LainRobertson It was the most simple one to get a list of groups which match the 1-3 member requirement. But the get-adgroupmember also has a -recursive parameter which lists all nested membership too.
- sparkislife
  Copper Contributor
  Apr 25, 2022
  Looking at explicit and am looking for user count per group.
  - LainRobertson
    Silver Contributor
    Apr 25, 2022
    
    sparkislife wrote:
    Looking at explicit and am looking for user count per group.
    sparkislife
    
    Okay, in this case, something like this will suffice. You can add and remove any attributes you'd like.
    
    Get-ADObject -Filter { (objectClass -eq "group") -and (member -like "*") } -Properties member | Select-Object -Property objectGUID, name, @{n="count"; e={ $_.member.Count; }} | Where-Object { $_.Count -in 1 .. 3 }
    
    Cheers,
    Lain

Forum Discussion

List off all AD groups that have between 1 and 3 users

Share

Resources