SERVER-027 · Script
Manage Directory Group Membership
Adds and removes members of directory groups from a CSV file or a short list, then reports each group's membership.
What it does
Two ways to describe the changes:
- CSV file: -CsvPath with columns Group, Member and Action (Add or Remove), one change per row
Parameters -Group with -AddMember and/or -RemoveMember Members can be users, computers or other groups, by sign-in name or distinguished name. Computer names need a trailing $ (for example LAB-PC01$). Changes that are already in place (adding someone who is already a member) are skipped. Changes to Domain Admins, Enterprise Admins, Schema Admins and Administrators are refused unless -AllowPrivileged is used. Preview mode (default) logs every change it would make. Apply makes them. Afterwards, the direct membership of every group touched is written to a CSV. To undo, swap Add and Remove in the CSV and run it again.
Requirements
Windows PowerShell 5.1 and the ActiveDirectory module (RSAT). Rights to change membership of the groups.
How to run it
- Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
- Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
- Script type: PowerShell 5.1, 64-bit
- User interaction: none; the script never prompts
- Timeout: 30 minutes for large directories or many servers
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| Mode | Preview (default) or Apply. | Preview, Apply | Preview |
| CsvPath | CSV with Group, Member and Action columns. | ||
| Group | Group to change, when not using a CSV. | ||
| AddMember | Members to add to -Group. | (none) | |
| RemoveMember | Members to remove from -Group. | (none) | |
| AllowPrivileged | Allow changes to the built-in administrator groups. | False | |
| Server | Optional domain controller to use for every change. |
Exit codes
- 0 = All changes done (or would be, in Preview)
- 1 = Some changes failed or were refused
- 2 = Script error (see log)
Testing steps
- Run it first with the mode set to Preview on one test OU, test account or test server. Nothing is changed in that mode.
- Read the log and confirm the planned changes are what you expect.
- Run your chosen settings on the same test target and confirm the result.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Preview mode changes nothing. To undo, swap Add and Remove in your CSV (or swap AddMember and RemoveMember) and run it again. The membership report shows each group as it was after the run.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |