top of page
Search

Find which users are not in an AD group

  • ToddimusPrime
  • Nov 21, 2022
  • 1 min read

I'll often be asked to find which users are in a specific AD group. That one's easy. What's not quite as easy is being asked to find which users are not in a specific AD group. Here's my solution to that problem. Add the group name in question on the first line, This will only return accounts that are enabled, so no need to sift through a bunch of disabled stuff.




$group = '<group name here>' #We're looking to find users who are not in this group
$results = @() #initialize the results array
$users = Get-ADUser -Properties memberof -Filter 'enabled -eq $true' #Get all enabled users, and pull the 'memberof' property for them
 
foreach ( $user in $users ) #loop through each user
{
    $groups = $user.memberof -join ';'
    $results += New-Object psObject -Property @{'User' = $user.userprincipalname;'Groups' = $groups}
}
 
$results | Where-Object { $_.groups -notmatch $group } | Select-Object user #grab the users who aren't in $group


Comments


©2021 by ToddimusPrime

bottom of page