PowerShell: Find and Delete Empty Groups in Active Directory

PowerShell: Find and Delete Empty Groups in Active Directory

Cleanup Empty AD Groups with PowerShell

Administrators turn to groups to grant a set of users permissions and access rights to resources. However, once the work is done and the resources are no longer needed, the users are removed from the group, leaving the group empty, but with permissions and access rights. As a thumb rule, admins should either delete or disable any unwanted objects to keep their AD environment clutter-free and safe. This applies for groups as well. The following PowerShell script will help spot empty groups and automatically delete them.
  1. Import-Module ActiveDirectory
  2. 
#-------------------------------
# FIND EMPTY GROUPS
#-------------------------------

# Get empty AD Groups within a specific OU
$Groups = Get-ADGroup -Filter { Members -notlike "*" } -SearchBase "OU=GROUPS,DC=testlab,DC=com" | Select-Object Name, GroupCategory, DistinguishedName

#-------------------------------
# REPORTING
#-------------------------------

# Export results to CSV
$Groups | Export-Csv C:\Temp\InactiveGroups.csv -NoTypeInformation

#-------------------------------
# INACTIVE GROUP MANAGEMENT
#-------------------------------

# Delete Inactive Groups
ForEach ($Item in $Groups){
  Remove-ADGroup -Identity $Item.DistinguishedName -Confirm:$false
  Write-Output "$($Item.Name) - Deleted"

  4. }