How to Report on Domain Admins and Other Privileged Groups in Active Directory (PowerShell Script)

Get-ADGroupMember -Identity "Domain Admins" -Recursive

#requires -Modules ActiveDirectory
<#
.SYNOPSIS
    Reports members of Active Directory's privileged admin groups.

.DESCRIPTION
    Recursively lists the members of Domain Admins, Enterprise Admins, and
    Schema Admins (the built-in AD groups with domain- or forest-wide
    control), flattening nested group membership so a user buried in a
    nested group still shows up. Flags stale privileged accounts — enabled
    members that haven't logged on within the given threshold — since
    privileged accounts are exactly the ones you don't want sitting around
    unused. Uses the current logged-on user's credentials — run it from a
    domain-joined machine with RSAT installed.

.PARAMETER StaleDays
    Flag privileged accounts that haven't logged on in at least this many
    days. Defaults to 90.

.PARAMETER OutputCsv
    Path to a CSV file to export the results to. If omitted, results are only
    written to the console.

.EXAMPLE
    .\Get-ADDomainAdminsReport.ps1

    Lists all members of Domain Admins, Enterprise Admins, and Schema Admins,
    flagging any that haven't logged on in 90+ days.

.EXAMPLE
    .\Get-ADDomainAdminsReport.ps1 -StaleDays 30 -OutputCsv .\privileged-accounts.csv

    Same report with a 30-day staleness threshold, exported to CSV.
#>

[CmdletBinding()]
param(
    [int]$StaleDays = 90,

    [string]$OutputCsv
)

Import-Module ActiveDirectory -ErrorAction Stop

$privilegedGroups = 'Domain Admins', 'Enterprise Admins', 'Schema Admins'
$cutoff = (Get-Date).AddDays(-$StaleDays)
$results = New-Object System.Collections.Generic.List[object]

foreach ($groupName in $privilegedGroups) {
    try {
        $members = Get-ADGroupMember -Identity $groupName -Recursive -ErrorAction Stop
    } catch {
        Write-Warning "Could not read group '$groupName': $($_.Exception.Message)"
        continue
    }

    foreach ($member in $members) {
        if ($member.objectClass -ne 'user') {
            continue
        }

        $user = Get-ADUser -Identity $member.SID -Properties Enabled, LastLogonDate

        $results.Add([PSCustomObject]@{
            Group          = $groupName
            Name           = $user.Name
            SamAccountName = $user.SamAccountName
            Enabled        = $user.Enabled
            LastLogonDate  = $user.LastLogonDate
            Stale          = ($user.Enabled -and (-not $user.LastLogonDate -or $user.LastLogonDate -lt $cutoff))
        })
    }
}

if ($results.Count -eq 0) {
    Write-Host "No members found in the privileged groups checked." -ForegroundColor Yellow
    return
}

$sorted = $results | Sort-Object Group, Name -Unique

Write-Host "Found $(@($sorted).Count) privileged account membership(s)." -ForegroundColor Cyan
$sorted | Format-Table Group, Name, SamAccountName, Enabled, LastLogonDate, Stale -AutoSize

$staleCount = @($sorted | Where-Object Stale).Count
if ($staleCount -gt 0) {
    Write-Host "$staleCount privileged account(s) haven't logged on in $StaleDays+ days — review whether they still need this access." -ForegroundColor Red
}

if ($OutputCsv) {
    $sorted | Export-Csv -Path $OutputCsv -NoTypeInformation
    Write-Host "Exported results to $OutputCsv" -ForegroundColor Green
}