Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a query or powershell command to retrieve a list of AD groups used for permissions in SharePoint sites? We need to find out what groups are being used (actually which ones are not being used) so we can delete unused groups in AD.

share|improve this question
up vote 2 down vote accepted

You could collect the information by using STSADM -o enumusers command. It will output XML with a list of users (or AD Groups) associated with SharePoint sites. Unfortunatly you have to do this for each site so it might take some time to put together the script to run it.

We looked at a tool from Questto manage security permissions in our sites. One of the features it had was to create a nice list of all users. It might already have functionality you need.

share|improve this answer
It looks like the tool may do the job, but I'm also looking at parsing this info from the output of STSADM or from SP powershell – user3047 May 26 '09 at 20:49
I believe this will list all users in the user info list for the site.. not necessarily users who have been granted permission – Kevin Davis May 29 '09 at 19:35

I work on SharePoint and am the PM responsible for permissions management.

The best way to do this is probably to write custom code. For a given SPWeb you can ennumerate RoleAssignments (the assignments of permissions to principals) and get the directory groups out of those.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.