Hey, Scripting Guy! How Can I Use Windows PowerShell 2.0 to Find Active Directory Domain Services Groups Not Being Used?

re: Hey, Scripting Guy! How Can I Use Windows PowerShell 2.0 to Find Active Directory Domain Services Groups Not Being Used?

MaxR — Thu, 16 Aug 2012 13:48:00 GMT

This is good if no one is in the groups not a real world example though, The real question would be how to tell if the group memebership has been not used. Expiring the groups is not really a good way to accomplish this. More administrative effort if you have thousands of distro /user/ computer groups.

re: Hey, Scripting Guy! How Can I Use Windows PowerShell 2.0 to Find Active Directory Domain Services Groups Not Being Used?

Tony Massa — Fri, 13 Jan 2012 14:05:34 GMT

Before you just delete the "empty groups", make sure you're checking for primaryGroupID (e.g. 'Domain Users')

re: Hey, Scripting Guy! How Can I Use Windows PowerShell 2.0 to Find Active Directory Domain Services Groups Not Being Used?

dbutch1976 — Mon, 11 Apr 2011 13:39:14 GMT

This Powershell command will give me a listing of all the security groups in my AD:

Get-ADGroup -filter {GroupCategory -eq "Security"}

How do I modify the command to give me a list of all groups created or changed before a certain date? I've opened the properties of the group in ADSIEDIT.msc and I can see these two fields:

whenChanged

whenCreated

re: Hey, Scripting Guy! How Can I Use Windows PowerShell 2.0 to Find Active Directory Domain Services Groups Not Being Used?

Gerry — Fri, 28 Jan 2011 09:14:35 GMT

Hi Guys,

I am really a Fanatic of powershell, and also thank you for the additional knowledge that you posted here and its very useful..but one thing that i did not find in any site on how to remove global security group in an AD user using powershell v2. someone can help me please :)..i really need it in my daily task as an IT systems.

thank you in advance

Gerry

re: Hey, Scripting Guy! How Can I Use Windows PowerShell 2.0 to Find Active Directory Domain Services Groups Not Being Used?

AD needs a couple of new attributes for groups... — Thu, 05 Aug 2010 23:59:28 GMT

...one attribute that contains a date/time stamp which shows the "last time a group was queried", and one attribute which shows "what queried that group", this would help significantly in removing old groups from large AD deployments that aren't well documented...please please please get the Directory Services team to consider :)

re: Hey, Scripting Guy! How Can I Use Windows PowerShell 2.0 to Find Active Directory Domain Services Groups Not Being Used?

Marc — Tue, 03 Aug 2010 13:03:09 GMT

That code seems cool for sure but what about this one liner ;-) ?

adfind -f "&(objectclass=group)(!member=*)" -dsq|admod -unsafe -rm

Joe rules !!

re: Hey, Scripting Guy! How Can I Use Windows PowerShell 2.0 to Find Active Directory Domain Services Groups Not Being Used?

Oliver Lipkau — Mon, 26 Jul 2010 10:29:53 GMT

That's a cool code.

But doesn't work on domains that do not run win 2008 r2.

here is my function:

http://poshcode.org/2023

re: Hey, Scripting Guy! How Can I Use Windows PowerShell 2.0 to Find Active Directory Domain Services Groups Not Being Used?

Benny Jackson — Fri, 23 Jul 2010 12:07:14 GMT

I'm trying to clean up AD, the distributions list right not, do you have a script that will tell when a distribution list was last used and by who?