Script: Compare-ADGroups.ps1

I recently wanted to do some analysis of existing groups in a well established AD that has a lot of groups (more groups than users in fact). I was hoping to find groups that looked like good candidates for conversion to role-based (aka criteria-based) groups.

I came across a great script by Ashley McGlone that compares groups in AD to each other, looking for percentage membership matches:

I’ve made a number of modification to this script so it now also:

  • Compares groups in one OU to groups in another – this allows me to compare to an OU of “IAM managed” groups looking for suitable nesting candidates,
  • Compares groups to a CSV of “proposed groups” to give an idea about whether it would help to create new role-based groups,
  • Starts writing the report file as soon as results are available – the original script waited right until the end, which can be a very long wait if you have a lot of comparisons.

My modified version is here:

Leave a Reply

Your email address will not be published. Required fields are marked *