CODEWITHSUNDEEP
powershellcount
narue1992
narue1992

Reputation: 351

Powershell: count members of a AD group

RECIEVED AN EXAMPLE I COULD USE AND CORRECTED CODE

My current question is how to count amount of members in a group versus printing out all members of a group (which includes their ID name or PC name). The commented out code prints each member. I just want to count them.

I've tried $members.count, $member.count and $string.count in my foreach loop but nothing prints out. Please help

Import-Module ActiveDirectory

$pathEmpty = "C:\Temp\groupsEmpty.txt"

Clear-Content $pathEmpty

$Header = `
"Group ID Name" + "|" + `
"Display Name" + "|" + `
"Description" + "|" + `
"Members"


#Write out the header
$Header | Out-File $pathEmpty -Append


$emptys = get-adgroup -properties name, displayname, description, members -filter  name -like "WA*" -or name -like "workstation*"} `
 | Select name, displayname, description, members

foreach ($empty in $emptys)
{
#clears previous 
$members = ""
foreach ($member in $empty.members)
  {
    $string = $member.substring(3,$member.indexof(",")-3)
    #$members = $members + ":" + $string
    $string.count 
  }
$listing =`
$empty.Name + "|" + `
$empty.DisplayName + "|" + `
$empty.Description + "|" + `
$members

$listing | Out-File $pathEmpty -Append
}

I made an edit based on Alex McKenzie's comment. The initial example you gave me made issues. I tried adding some edits to it but I get a error: Cannot validate argument on parameter 'Identity'. The argument is null or empty. Supply an argument that is not null or empty and then try the command again.

foreach ($empty in $emptys)
{
#clears previous 
$members = ""
foreach ($member in $empty.members)
  {
    #$string = $member.substring(3,$member.indexof(",")-3)
    #$members = $members + ":" + $string

    if($member -eq $null){
        $users = 0
        }
    else{
        $users = (Get-ADGroupMember -Identity $($_.DistinguishedName)).Count
        #$users.count
    }
  }

Below is my finished code. I just made separate .txt files for each things I needed and will just separately import them into excel. QUESTION FIXED

Import-Module ActiveDirectory

##########################################################################
#This Section involves filtering WA groups and retriving their information
#In the info section (aka Notes section) is very important to look
#over if groups require approvals or not

##########################################################################

$pathAll = "C:\Temp\groupsEALL.txt"

Clear-Content $pathALL

$Header = `
"Group ID Name" + "|" + `
"Description" + "|" + `
"Notes Field" + " |" + "Members"


#Write out the header
$Header | Out-File $pathALL -Append

 $emptys = get-adgroup -properties name, description, members, info -filter {name -like "WA*" -or name -like "workstation*"} `
 | Select name, description, members, info

foreach ($empty in $emptys)
{

#clears previous 
$members = ""
foreach ($member in $empty.members)
  {
    #$users = (Get-ADGroupMember -Identity $member.DistinguishedName).Count
    $string = $member.substring(3,$member.indexof(",")-3)
    $members = $members + ":" + $string
   }

$listing =`
$empty.Name + "|" + `
$empty.Description + "|" + `
$empty.Info + "|" + `
$members

$listing | Out-File $pathALL -Append
}

################################################################
#This next section will determine the member count in the groups

################################################################

$pathCount = "C:\Temp\Groupcount.txt"
Clear-Content $pathcount

$groups = Get-ADGroup -filter {(name -like "WA*") -or (name -like "workstation*")}
foreach($group in $groups){
 #initializing
 $countUser = ""
   $countUser = ((get-Adgroup $group -properties members).members).count


"The group $($group.Name) has $countUser user(s)." | Out-File $pathCount -Append
}

I add a counter in original script if I want it to get count as well

foreach ($empty in $emptys)
{

#clears previous 
$members = ""
#initialize member counting
$count = 0
foreach ($member in $empty.members)
  {
    #counts how many members
    $count += 1
    $countSum = "The group $($group.Name) has $count user(s)."
    $string = $member.substring(3,$member.indexof(",")-3)
    $members = $members + ":" + $string
   }
    $listing =`
$empty.Name + "|" + `
$empty.Description + "|" + `
#$empty.Info + "|" + `
$empty.info + "|" + `
$members + "|" + $countSum

$listing | Out-File $pathALL -Append
}

Upvotes: 4

Views: 176945

Answers (10)

Tilo
Tilo

Reputation: 1220

here my PS script for "Domain Users". @Zsolt Varga https://stackoverflow.com/a/42520249/1747983 didn't work for me on Domain users

@AlexMcKenzie Get-ADGroupMember has a limit Get-ADGroupMember : The size limit for this request was exceeded

PS C:\> $ADInfo = Get-ADGroup -Identity 'Domain Users' -Properties Members
PS C:\> $AdInfo.Members.Count
0
PS C:\> $Group="Domain Users"
PS C:\> $GroupDN = (Get-ADGroup -Identity $Group).DistinguishedName
PS C:\> $members = DSget group $GroupDN -members
PS C:\> $members.count
177

Root cause is the "Domain Users" group are likely for most Users the "Primary Group" and not via members attribute, see https://www.reddit.com/r/PowerShell/comments/78wq43/comment/doxgi6d/

Upvotes: 0

Alex McKenzie
Alex McKenzie

Reputation: 912

The Get-ADGroupMember cmdlet would solve this in a much more efficient way than you're tying.

As an example:

$users = @(Get-ADGroupMember -Identity 'Group Name')
$users.count
132

EDIT:

In order to clarify things, and to make your script simpler. Here's a generic script that will work for your environment that outputs the user count for each group matching your filters.

$groups = Get-ADGroup -filter {(name -like "WA*") -or (name -like "workstation*")}
foreach($group in $groups){
  $countUser = @(Get-ADGroupMember $group.DistinguishedName).count
  Write-Host "The group $($group.Name) has $countUser user(s)."
}

Upvotes: 20

Alan Wild
Alan Wild

Reputation: 1

Try:

$group = Get-ADGroup -Identity your-group-name -Properties *

$group.members | count

This worked for me for a group with over 17000 members.

Upvotes: 0

Jean-Claude DuBois
Jean-Claude DuBois

Reputation: 376

Every response has missed one detail. What if the group only has 1 user.

$count = @(get-adgroupmember $group).count

Put the command in the @() wrapper so that the result is an array no matter what, so even if it is 1 item, you get a count.

Upvotes: 8

Chris B
Chris B

Reputation: 21

$users = Get-ADGroupMember -Identity 'Client Services' -Recursive ; $users.count

The above one-liner gives a clean count of recursive members found. Simple, easy, and one line.

Upvotes: 2

Willy N
Willy N

Reputation: 1

How about this?

Get-ADGroupMember 'Group name' | measure-object | select count

Upvotes: 0

Trev Evans
Trev Evans

Reputation: 1

Something I'd like to share..

$adinfo.members actually give twice the number of actual members. $adinfo.member (without the "s") returns the correct amount. Even when dumping $adinfo.members & $adinfo.member to screen outputs the lower amount of members.

No idea how to explain this!

Upvotes: 0

Zsolt Varga
Zsolt Varga

Reputation: 91

easy way to do it: To get the actual user count:

$ADInfo = Get-ADGroup -Identity '<groupname>' -Properties Members
$AdInfo.Members.Count

and you get the count easily, it is pretty fast as well for 20k+ users too

Upvotes: 9

user6357469
user6357469

Reputation: 1

In Powershell, you'll need to import the active directory module, then use the get-adgroupmember, and then measure-object. For example, to get the number of users belonging to the group "domain users", do the following:

Import-Module activedirecotry
Get-ADGroupMember "domain users" | Measure-Object

When entering the group name after "Get-ADGroupMember", if the name is a single string with no spaces, then no quotes are necessary. If the group name has spaces in it, use the quotes around it.

The output will look something like: 

Count    : 12345
Average  :
Sum      :
Maximum  :
Minimum  :
Property :

Note - importing the active directory module may be redundant if you're already using PowerShell for other AD admin tasks.

Upvotes: 0

Mathias R. Jessen
Mathias R. Jessen

Reputation: 174485

If you cannot utilize the ActiveDirectory Module or the Get-ADGroupMember cmdlet, you can do it with the LDAP "in chain"-matching rule:

$GroupDN = "CN=MyGroup,OU=Groups,DC=mydomain,DC=tld"
$LDAPFilter = "(&(objectClass=user)(objectCategory=Person)(memberOf:1.2.840.113556.1.4.1941:=$GroupDN))"

# Ideally using an instance of adsisearcher here:
Get-ADObject -LDAPFilter $LDAPFilter

See MSDN for additional LDAP matching rules implemented in Active Directory

Upvotes: 1

Related Questions