Opselith
POWERSHELL / ACTIVEDIRECTORY
FreeIntermediateRead-onlylow

Export AD group members

Export nested user membership from one Active Directory group to CSV with PowerShell, with optional account, email, UPN and logon fields.

Open in PowerShell Builder →Browse all scripts

Generated locally in your browser · Review before running · Opselith does not connect to your tenant

What this PowerShell script does

Exports nested users from an AD group.

Requirements

  • AD group name - Enter required value
  • CSV output path - Example: C:\Temp\report.csv

Environment

  • Module: ActiveDirectory
  • Permissions: Directory read access
  • Output: CSV report
  • Context: Windows host with RSAT
  • Risk: Low
Review before you run The script is generated locally. Test outside production first.
NEXT STEP

Ready to generate

Configure Export AD group members in the Builder, review the generated PowerShell and run it yourself in your own PowerShell session.

Configure this script →Open Builder
More about this script

Why use this template?

Use this free PowerShell script when you need to export nested users from an ad group. It is generated locally and can be reviewed before you run it yourself in your own PowerShell session.

The template uses ActiveDirectory and requires Directory read access. Output: CSV report. Level: Intermediate. Action: Read-only. Risk: Low.

Review before running

The script is generated in your browser. Read it before you run it, and test it outside production first. “Read-only” describes the script itself; anything you add around it can still change data.

Generate the script

  1. Open the template in the PowerShell Builder.
  2. Enter the requested values and review the module, permissions, output and risk.
  3. Generate the script, read it carefully, and test it outside production before use.

The script is generated locally in your browser. Nothing needs to be uploaded to Opselith.

Generate Export AD group members →

How to use this result

Use this report when you need a CSV of user members from one Active Directory group. It expands nested membership and lets you keep the normal columns or choose only the identity and account fields you need.

When this helps

  • Export group membership to CSV for an access review, audit, migration check or owner review.
  • Include useful user fields such as account name, UPN, email address, enabled state and last logon date.
  • Create a repeatable membership snapshot that you can review locally or compare with an earlier export.

How to read the result

  • This template expands nested group membership and exports user objects. Nested groups themselves are not exported as user rows.
  • LastLogonDate is based on the replicated lastLogonTimestamp value exposed by Active Directory, so it is useful for review but is not a real-time sign-in timestamp.

Things to check

  • Only user objects are included. If the group contains computers, contacts or other object types, those objects are outside this user-focused CSV.
  • Large or deeply nested groups can take longer because the script resolves membership and then reads the selected user properties.

What to do next: Open the CSV in Group Membership Review to check identifiers and duplicates. If you specifically need only immediate members without expanding nested groups, use the direct-members export instead.

Related tasks

Official references

Before you runModule, permissions, inputs, compatibility and script checks
OPS / SCRIPT DETAILS

Script details

Exports user members of an Active Directory group to CSV. Keep the normal report or choose only the columns you need. Review these details before generating or running the script.

active-directoryexportusersgroupspermissions
Generated here. Run by you.Opselith does not connect to your tenant or run PowerShell. After generating, review the script and run it in your own PowerShell session.

What it works with

Module: ActiveDirectory

ActiveDirectory lets PowerShell work with on-premises Active Directory and is normally installed through Windows RSAT.

Context: Windows host with RSAT

Compatibility: Run in Windows PowerShell 5.1 on a Windows system with the ActiveDirectory module available.

Permissions and changes

Permissions: Directory read access

Risk: Low

Read-only: designed to collect information without intentionally changing the target environment.

Changes: Read-only. The script reads data and does not intentionally change the target environment.

Inputs

  • AD group name - Enter the group name, for example Finance-Users. (Required)
  • CSV output path - Choose a new absolute Windows CSV path, for example C:\Temp\group-members.csv. (Required)
  • Name - The Active Directory Name value. (Optional)
  • Account name (sAMAccountName) - Example: j.smith. (Optional)
  • First name - Optional (Optional)
  • Last name - Optional (Optional)
  • Display name - Optional (Optional)
  • User principal name (UPN) - Example: john.smith@contoso.com. (Optional)
  • Email address - Optional (Optional)
  • Account enabled - Optional (Optional)
  • Last logon date - Optional (Optional)
  • Distinguished name - Optional (Optional)
  • Status - Optional (Optional)
  • Error details - Optional (Optional)

What to expect

Output: CSV containing only the group-member columns you select.

Expect a CSV file at the path you choose. Open it in Excel or another CSV viewer and review the rows.

Example: C:\Temp\report.csv

This template is in the Free library and is generated locally in your browser. Opselith does not run it; you review and run the script in your own PowerShell session.

Example use

Exports user members of an Active Directory group to CSV. Keep the normal report or choose only the columns you need.

Enter the required values in the Builder, review the generated script and confirm the output before running it.

Before you run: Make sure your account has Directory read access. Check that the ActiveDirectory PowerShell module is available and that you are using the supported PowerShell version. Review the generated script and output path, then test outside production first.
Script checksWhat has been verifiedQA reviewed
Static checksPassed
PSScriptAnalyzerPending
Real-world run testNot yet recorded
Last checkedNot yet recorded

Real-world run results are shown only after Opselith reviews and accepts a tester report.

Tester: report a result →
TEST STATUSWhat Opselith has checked

Last reviewed: 3 Sept 2026

PSScriptAnalyzer: Awaiting a release PSScriptAnalyzer gate that includes this script. No analyzer pass is claimed yet.

Pending or Not yet recorded means there is no accepted result on file yet. A passed analyzer check does not mean the script has been run in a real tenant.

AFTER YOU RUN IT

Review the membership export locally

Once PowerShell creates the CSV, open it in Group Membership Review to check member identifiers, duplicates and, when you add an earlier export, membership changes. The CSV stays in your browser.

Review membership export →
NEXT IN THE LIBRARY

Scripts for similar admin tasks and Microsoft services.

Browse Active Directory PowerShell scripts →
POWERSHELLAdd users to an AD groupactive-directory · groups · membershipPOWERSHELLExport Entra group membersentra · export · usersPOWERSHELLExport Active Directory usersactive-directory · export · users