How to Create a New Active Directory Group using PowerShell

The Need for Automated Group Management

In Active Directory, Security Groups are the backbone of access control. They determine who can access network file shares, who can connect to the VPN, and who receives specific Group Policy objects. When a company reorganizes or spins up a new project team, system administrators are often tasked with creating dozens of new security groups.

While you can use the Active Directory Users and Computers (ADUC) graphical interface to right-click and create a group, doing this for 50 different project teams is tedious and error-prone. Using PowerShell, you can create groups instantly and accurately.

Using the New-ADGroup Cmdlet

To execute this command, you must be running PowerShell on a Domain Controller, or on an IT workstation with the Remote Server Administration Tools (RSAT) module installed. You also need an account with domain administrator or delegated group-creation privileges.

The core command is New-ADGroup. To create a standard Global Security group named “Project-Titan”, run the following command:

New-ADGroup -Name "Project-Titan" -GroupScope Global -GroupCategory Security -Path "OU=ProjectGroups,DC=corp,DC=contoso,DC=com"

Breaking Down the Parameters:

• -Name: The actual name of the group that will appear in AD.
• -GroupScope: Can be DomainLocal, Global, or Universal. Global is the standard for most access control scenarios within a single domain.
• -GroupCategory: Can be Security (used for assigning permissions) or Distribution (used only for email distribution lists in Exchange).
• -Path: The exact LDAP Distinguished Name (DN) of the Organizational Unit (OU) where you want the group to be created. If you omit this parameter, the group will be dumped into the default CN=Users container.

Adding a Description

A group named “Project-Titan” might mean nothing to a new IT tech hired two years from now. It is considered best practice to always append a description to new groups explaining their purpose and who requested them.

You can add the -Description parameter directly to the creation command:

New-ADGroup -Name "Project-Titan" -GroupScope Global -GroupCategory Security -Description "Access to the Titan CAD file share. Requested by Engineering Lead (Ticket #4421)." -Path "OU=ProjectGroups,DC=corp,DC=contoso,DC=com"

Creating Multiple Groups from a CSV File

If Human Resources hands you an Excel spreadsheet requesting 50 new department groups, save it as a CSV file (e.g., NewGroups.csv) with two columns: GroupName and GroupDesc.

You can then use a ForEach loop in PowerShell to read the CSV and create every group in seconds:

$Groups = Import-Csv -Path "C:\Temp\NewGroups.csv"

foreach ($Group in $Groups) {
    New-ADGroup -Name $Group.GroupName -GroupScope Global -GroupCategory Security -Description $Group.GroupDesc -Path "OU=Departments,DC=corp,DC=contoso,DC=com"
    Write-Host "Created group: $($Group.GroupName)"
}

This script automates the entire process, eliminating typos and ensuring absolute consistency across your domain structure.