theme-sticky-logo-alt

PowerShell Script to get all the Active Directory groups in your SharePoint Farm

5 Comments

At a client recently, I was tasked to create an inventory of all the Active Directory Groups that give access to a SharePoint site! I built it mostly from scratch, so here it is as well as some explanations to help you use it:

The Script:

function WriteLogs ($message) {
    $message | Out-File $logfile -append
}
$logfile = "C:\ADGroupInventory\grouplist.txt"
Write-Host "Starting Group Script inventory"
$was = Get-SPWebApplication
foreach ($wa in $was)
 {        
  $webappUrl = $wa.url
  Write-Host "Starting to look in $webappUrl"
  $spWebApp = Get-SPWebApplication $wa.url        
  foreach($site in $spWebApp.Sites)
  {
    $siteurl = $site.url
    Write-Host "Going into SiteCollection $siteurl"
    $group = $site.RootWeb.SiteUsers
    foreach ($grp in $group)
    {
     # Ensure the item is a domain group
     if($grp.IsDomainGroup -eq "True")
     {
      $groupname = $grp.name
      WriteLogs "$groupname"
     }
    }
  }    
 }

 

How to use it.

First of all, change the $logfile variable to a folder that exists to make sure the logs work. Second, in the Central Administration, give yourself "Full Control" in the Web Application User Policy. This will make sure that you won't have any access denied when you go through each and every site collection in your farm. Afterwards, open SharePoint Management Shell as an Administrator, and run the script. Depending of the size of you farm, it shouldn't take too long, and you should see progress of every site being scanned on the screen. At the end, you will have a text file looking like this:

Get all the Active Directory groups in your SharePoint Farm

You will notice in the screenshot that some group names are repeated, as well as some of them are in capital and some of them are lowercase. So, I used NotePad++ to get all the unique group names! First of all, go in Edit > Convert Case to > Upercase!

To get unique lines, you will need the TextFX plugin. This used to be included in older versions of Notepad++, but if you have a newer version, you can add it from the menu by going to Plugins -> Plugin Manager -> Show Plugin Manager -> Available tab -> TextFX -> Install. In some cases it may also be called TextFX Characters, but this is the same thing.

After the plugin is installed, go in TestFX Tools and check the "sort ascending" and "sort outputs only UNIQUE" lines. Afterwards, click the "Sort lines case insensitive at column". (make sure that you do Ctrl+a in the file to select all the lines before clicking).

 

Now, your Notepad++ will only show the unique group names in your SharePoint Farm!

 

 

Drop a comment if this helped!

Leave a comment and don't forget to like the Absolute SharePoint Blog Page  on Facebook and to follow me on Twitter here  for the latest news and technical articles on SharePoint.  Also, don't forget to check out SharePoint Community.Net for more great SharePoint Content.

Previous Post
Easily Compare Office 365 Plans
Next Post
Windows PowerShell updated your execution policy successfully, but the setting is overridden by a policy defined at a more specific scope

5 Comments

  • March 24, 2015 at 11:44 am

    Hey Vlad!

    Here’s a trick I found to get only one of each person that doesn’t involve notepad++
    in your main loop, add each group to an array
    So lets define the array $groups = @()
    then $groups += $grp.name

    now, after your script is done, you can get all the groups, with duplicates removed by doing this:
    $groups | select -unique

    This will give you a complete list, without duplicates!

    Reply
  • April 24, 2015 at 5:05 am
    SharePoint Training

    Great post about PowerShell Script to get all the Active Directory groups in your SharePoint Farm and i found one more link related to this topic : http://sharepointpromag.com/sharepoint-2013/exploring-sharepoint-users-groups-and-security-using-powershell

    Reply
  • February 2, 2016 at 6:48 pm

    Thank you Vlad. Such a great script that worked the first time.. You saved me tons of time.

    Reply
  • November 24, 2018 at 12:12 am
    Aravinda Rao

    Can we get the list with Login name and not display name.In my SharePoint ,there are AD groups added but with a different display name.

    Reply
    • November 24, 2018 at 4:51 pm

      I don’t have access to a SP farm right now, but it should be pretty easy to do by modifying the script!

      Reply

Leave a Reply

15 49.0138 8.38624 1 0 4000 1 https://vladtalkstech.com 300 1