PowerShell AD Groups: Add and Remove Members

Role-based access control lives and dies by group membership — and managing it manually through Active Directory Users and Computers is error-prone and unscalable. PowerShell active directory groups management with Add-ADGroupMember, Remove-ADGroupMember, and Get-ADGroupMember gives you auditable, repeatable control over who belongs to what, at scale. From bulk membership updates to empty group cleanup, this post covers every common AD group task.

Get All Members of a Group

Get-ADGroupMember returns the direct members of a group. By default it does not expand nested groups — add -Recursive to enumerate all members including those inherited through nested group memberships.

# Direct members of a group
Get-ADGroupMember -Identity "IT-Admins" |
    Select-Object Name, SamAccountName, objectClass

Name         SamAccountName  objectClass
----         --------------  -----------
John Smith   jsmith          user
Jane Doe     jdoe            user
HelpDesk-SG  HelpDesk-SG     group

# All members including nested groups (recursive)
Get-ADGroupMember -Identity "IT-Admins" -Recursive |
    Where-Object objectClass -eq "user" |
    Select-Object Name, SamAccountName

Add a User to a Group

Add-ADGroupMember adds one or more members to a group. You can pass users, computers, or other groups. The -Members parameter accepts SAM account names, distinguished names, or pipeline input.

# Add a single user
Add-ADGroupMember -Identity "VPN-Users" -Members "jsmith"

# Add multiple users at once
Add-ADGroupMember -Identity "VPN-Users" -Members "jsmith", "jdoe", "mwilliams"

# Pipe a user object
Get-ADUser -Identity "jsmith" | Add-ADGroupMember -Identity "VPN-Users"

Remove a User from a Group

Remove-ADGroupMember removes members. Use -Confirm:$false in scripts to skip the interactive prompt.

# Remove a single user
Remove-ADGroupMember -Identity "VPN-Users" -Members "jsmith" -Confirm:$false

# Verify the member is gone
Get-ADGroupMember -Identity "VPN-Users" | Where-Object SamAccountName -eq "jsmith"

List All Groups a User Belongs To

Get a user’s group membership by reading the MemberOf attribute. Use -Properties MemberOf since it’s not returned by default, then parse the distinguished names for readable group names.

# Direct group memberships for a user
(Get-ADUser -Identity "jsmith" -Properties MemberOf).MemberOf |
    ForEach-Object { (Get-ADGroup -Identity $_).Name } |
    Sort-Object

Domain Users
IT-Admins
VPN-Users
Software-Approvers

Bulk Add Members from CSV

For role-based provisioning or access review remediation, add members to groups from a CSV. Structure the CSV with Group and User columns for maximum flexibility.

# CSV columns: User,Group
# jsmith,VPN-Users
# jdoe,Finance-Reports
# mwilliams,VPN-Users

$assignments = Import-Csv -Path "C:\Logs\group-assignments.csv"

foreach ($row in $assignments) {
    try {
        Add-ADGroupMember -Identity $row.Group -Members $row.User -ErrorAction Stop
        Write-Output "Added $($row.User) to $($row.Group)"
    } catch {
        Write-Warning "Failed: $($row.User) to $($row.Group) — $_"
    }
}

Find Empty Groups

Empty security groups accumulate over time and clutter your AD structure. Identify them for review and cleanup. A group with no direct members may still have a purpose (GPO target, email distribution), so review before deleting.

# Find all security groups with no members
Get-ADGroup -Filter { GroupCategory -eq "Security" } |
    Where-Object { -not (Get-ADGroupMember -Identity $_ -ErrorAction SilentlyContinue) } |
    Select-Object Name, DistinguishedName |
    Export-Csv -Path "C:\Logs\empty-groups.csv" -NoTypeInformation

Write-Output "Empty groups exported."

Common Errors and Fixes

• Nested groups not expanded by default: Get-ADGroupMember returns only direct members unless you use -Recursive. Without it, users who are members through a nested group will not appear in the output, which can give a misleading picture of effective membership. Always use -Recursive when you need the full effective membership list for access audits.
• Circular group membership causes infinite loop: Circular group membership (Group A is a member of Group B, which is a member of Group A) causes Get-ADGroupMember -Recursive to run indefinitely until it hits an error. Active Directory prevents direct circular membership but can develop indirect cycles in complex nested group structures. If a recursive query hangs, use the AD Users and Computers GUI to trace the membership chain and break the cycle.

Related Cmdlets / See Also

• PowerShell Active Directory: Get-ADUser Examples
• PowerShell Active Directory User Management: Create and Modify

Wrapping Up

AD group membership management in PowerShell is both faster and more auditable than the GUI — every change is logged, parameterized, and repeatable. As a next step, build a quarterly access review script that exports current group membership to CSV for each department’s security groups, making access reviews a one-click export rather than a manual afternoon’s work.