Find empty security groups
Documentation: Microsoft Learn
Get-ADGroup returns security groups, then ForEach-Object tests each by calling Get-ADGroupMember against it.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-ADGroup -Filter 'GroupCategory -eq "Security"' | ForEach-Object { if(-not (Get-ADGroupMember $_ -ErrorAction SilentlyContinue)){ $_ } } | Select-Object Name,SamAccountName- Stage 1Get-ADGroup
-Filter - Stage 2ForEach-Object
Positional values or no named parameters - Stage 3Select-Object
Positional values or no named parameters
How it works
Get-ADGroup returns security groups, then ForEach-Object tests each by calling Get-ADGroupMember against it. Groups where that call produces nothing are emitted, and the projection keeps the display name next to the SAM account name.
Adapting it
Scope the query with -SearchBase to one OU and add the WhenCreated attribute to the output, which lets you exclude genuinely new groups that simply have not been populated yet.
Requirements
ActiveDirectory module.
If the result is unexpected
A group appears empty although access through nested groups is expected.
Direct group membership and recursively resolved user membership answer different questions.
- Inspect the direct Members property and then review nested membership where that is relevant.
Validate the result
The report states whether empty means no direct members or no resolved users.
Keep the check reliable
Keep direct and recursive membership reports separate and retain group-owner review.
