Is there a query or powershell command to retrieve a list of AD groups used for permissions in SharePoint sites? We need to find out what groups are being used (actually which ones are not being used) so we can delete unused groups in AD.

3 Answers 3


You could collect the information by using STSADM -o enumusers command. It will output XML with a list of users (or AD Groups) associated with SharePoint sites. Unfortunatly you have to do this for each site so it might take some time to put together the script to run it.

We looked at a tool from Questto manage security permissions in our sites. One of the features it had was to create a nice list of all users. It might already have functionality you need.

  • It looks like the tool may do the job, but I'm also looking at parsing this info from the output of STSADM or from SP powershell
    – user3047
    Commented May 26, 2009 at 20:49
  • I believe this will list all users in the user info list for the site.. not necessarily users who have been granted permission Commented May 29, 2009 at 19:35

I work on SharePoint and am the PM responsible for permissions management.

The best way to do this is probably to write custom code. For a given SPWeb you can ennumerate RoleAssignments (the assignments of permissions to principals) and get the directory groups out of those.


It's in portuguese but you can translate it (be careful to not use the translation over the scripts :)

Check here: https://suporte.ivancarlos.com.br/hc/pt-br/articles/13124938660109-Gerando-relat%C3%B3rio-de-membros-de-sites-SharePoint-no-Microsoft-365

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .