I'm looking for a PowerShell script that will query and output all the local and AD users, service accounts, and groups on a given Windows servers. I need the script to recursively list the members of each group that has privileges on that server. I'm looking for a script that will give me a good starting point from which I can tailor it to my specific needs. Thanks.

  • 1
    This may be of interest to you (even though its not a duplicate): my answer to "How do you discover what permissions an AD group has, if you have no documentation?"
    – AviD
    Jan 8, 2014 at 9:34
  • -1 I voted down as there doesn't appear to have been an attempt by the asker to do this on their own. I don't believe ServerFault was intended to be a free scripting service.
    – Colyn1337
    May 23, 2014 at 23:16
  • @Colyn1337 I'm sorry about that, but I was very new to PowerShell and had a limited time to complete the task. I didn't know where to begin. I'm very grateful for Patrick's answer.
    – teancum144
    Jun 16, 2015 at 21:51

1 Answer 1


I was bored on a lunch break so I made you this.

$strLocalMachine = $env:computername

$arrLocalGroups = Get-CimInstance -ClassName Win32_Group -filter "Domain = '$strLocalMachine'"
$arrDomainGroups = Get-CimInstance -ClassName Win32_Group -filter "Domain = '[YOUR DOMAIN NAME HERE]'"

ECHO "Local Groups"

foreach($objLocalGroup in $arrLocalGroups)
$groupname = $objLocalGroup.Name

$group = [ADSI]"WinNT://./$groupname"
ECHO "-----$($objLocalGroup.caption)-----"
@($group.Invoke("Members")) | foreach {$_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)}

ECHO "Domain Groups"

foreach($objDomainGroup in $arrDomainGroups)
$groupname = $objDomainGroup.name

$groupmembers = Get-QADGroupMember $groupname
ECHO "-----$groupname-----"
foreach($entry in $groupmembers)
    IF($entry.type -eq 'group')
        Echo "$($entry.name)`n    GROUP MEMBERS"
        $subgroupmembers = Get-QADGroupMember $($entry.name)
        foreach($member in $subgroupmembers){ECHO "    $($member.name)"}
    else{echo "$($entry.name)"}
    $entry = $null
  1. This has a dependency for the free Quest AD commandlets to enumerate the domain group memberships. You could amend it to do the same with the Microsoft AD cmdlets if you have installed RSAT or you run this on a DC.

  2. I haven't tested this on multiple machines, so can't promise how well it will work beyond my test Win 7 box but this should be ok as long as you are running as domain admin.

  3. I feel like the domain groups output is too high for my domain member PC. The command Get-CimInstance -ClassName Win32_Group -filter "Domain = '[YOUR DOMAIN NAME HERE]'"returned far more than I expected so YMMV, but if they are the correct groups then it should step through and list give you the member ships.

  4. I can't work out how to identify if the members of the local groups are a user or Group I'm afraid. The line : @($group.Invoke("Members")) | foreach {$_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)} should allow us to invokemember other than name, but I can't get it to work. If someone can clarify that for you you should be able to use that to list members of the local groups.

hope this helps.

  • Of course poshcode.org/544 this has already been done by someone far more capable than I. I would run his code first and ignore everything I've done!
    – Patrick
    Jan 9, 2014 at 13:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.