Is there a query or powershell command to retrieve a list of AD groups used for permissions in SharePoint sites? We need to find out what groups are being used (actually which ones are not being used) so we can delete unused groups in AD.


You could collect the information by using STSADM -o enumusers command. It will output XML with a list of users (or AD Groups) associated with SharePoint sites. Unfortunatly you have to do this for each site so it might take some time to put together the script to run it.

We looked at a tool from Questto manage security permissions in our sites. One of the features it had was to create a nice list of all users. It might already have functionality you need.

  • It looks like the tool may do the job, but I'm also looking at parsing this info from the output of STSADM or from SP powershell – user3047 May 26 '09 at 20:49
  • I believe this will list all users in the user info list for the site.. not necessarily users who have been granted permission – Kevin Davis May 29 '09 at 19:35

I work on SharePoint and am the PM responsible for permissions management.

The best way to do this is probably to write custom code. For a given SPWeb you can ennumerate RoleAssignments (the assignments of permissions to principals) and get the directory groups out of those.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.