PowerShell Script to get all the Active Directory groups in your SharePoint Farm

PowerShell Script to get all the Active Directory groups in your SharePoint Farm

At a client recently, I was tasked to create an inventory of all the Active Directory Groups that give access to a SharePoint site! I built it mostly from scratch, so here it is as well as some explanations to help you use it:

The Script:

function WriteLogs ($message) {
    $message | Out-File $logfile -append

$logfile = "C:\ADGroupInventory\grouplist.txt"
Write-Host "Starting Group Script inventory"
$was = Get-SPWebApplication

foreach ($wa in $was)
  $webappUrl = $wa.url
  Write-Host "Starting to look in $webappUrl"
  $spWebApp = Get-SPWebApplication $wa.url        
  foreach($site in $spWebApp.Sites)
    $siteurl = $site.url
    Write-Host "Going into SiteCollection $siteurl"
    $group = $site.RootWeb.SiteUsers
    foreach ($grp in $group)
     # Ensure the item is a domain group
     if($grp.IsDomainGroup -eq "True")
      $groupname = $grp.name
      WriteLogs "$groupname"


How to use it.

First of all, change the $logfile variable to a folder that exists to make sure the logs work. Second, in the Central Administration, give yourself "Full Control" in the Web Application User Policy. This will make sure that you won't have any access denied when you go through each and every site collection in your farm. Afterwards, open SharePoint Management Shell as an Administrator, and run the script. Depending of the size of you farm, it shouldn't take too long, and you should see progress of every site being scanned on the screen. At the end, you will have a text file looking like this:

Get all the Active Directory groups in your SharePoint Farm

You will notice in the screenshot that some group names are repeated, as well as some of them are in capital and some of them are lowercase. So, I used NotePad++ to get all the unique group names! First of all, go in Edit > Convert Case to > Upercase!

To get unique lines, you will need the TextFX plugin. This used to be included in older versions of Notepad++, but if you have a newer version, you can add it from the menu by going to Plugins -> Plugin Manager -> Show Plugin Manager -> Available tab -> TextFX -> Install. In some cases it may also be called TextFX Characters, but this is the same thing.

After the plugin is installed, go in TestFX Tools and check the "sort ascending" and "sort outputs only UNIQUE" lines. Afterwards, click the "Sort lines case insensitive at column". (make sure that you do Ctrl+a in the file to select all the lines before clicking).


Now, your Notepad++ will only show the unique group names in your SharePoint Farm!



Drop a comment if this helped!

Leave a comment and don't forget to like the Absolute SharePoint Blog Page  on Facebook and to follow me on Twitter here  for the latest news and technical articles on SharePoint.  Also, don't forget to check out SharePoint Community.Net for more great SharePoint Content.

4/5 (1)

Please rate this


Hey Vlad!

Here’s a trick I found to get only one of each person that doesn’t involve notepad++
in your main loop, add each group to an array
So lets define the array $groups = @()
then $groups += $grp.name

now, after your script is done, you can get all the groups, with duplicates removed by doing this:
$groups | select -unique

This will give you a complete list, without duplicates!

SharePoint Training

Great post about PowerShell Script to get all the Active Directory groups in your SharePoint Farm and i found one more link related to this topic : http://sharepointpromag.com/sharepoint-2013/exploring-sharepoint-users-groups-and-security-using-powershell

Thank you Vlad. Such a great script that worked the first time.. You saved me tons of time.

Can we get the list with Login name and not display name.In my SharePoint ,there are AD groups added but with a different display name.

I don’t have access to a SP farm right now, but it should be pretty easy to do by modifying the script!

Leave a Reply