AD Object Counter: A Free PowerShell GUI Tool for Counting Active Directory Users and Computers
If you manage Active Directory, you’ve almost certainly been asked some version of this question: “How many active users are in the Sales OU?” Or maybe: “How many enabled computers are across all of our regional OUs combined?” Or the classic: “Can you pull the user count for these six security groups before Friday’s licensing renewal?”
The answer usually involves firing up PowerShell, constructing a Get-ADUser one-liner, running it three times because you forgot -SearchScope Subtree the first time, and then copying numbers into a spreadsheet. Every single time.
AD Object Counter is a free PowerShell GUI tool that makes this a point-and-click operation. No scripting required. Results update live as you make selections.
What It Does
The tool gives you two distinct modes, switchable via tabs at the top of the window.
Mode 1: OU-Based Counting
The left panel loads your entire OU tree from the domain automatically on startup. You check the OUs you care about. That’s it.
A few things that make this actually useful rather than just pretty:
Parent selection cascades and locks. If you check a parent OU like Sales, all child OUs underneath it — East Sales, West Sales, North Sales, and every sub-OU beneath those — get checked and locked. You can’t accidentally uncheck a child while the parent is selected. This means when you query Sales, you’re truly getting everything under it via a subtree search, with zero risk of double-counting.
No double-counting. The tool queries only the topmost selected nodes using SearchScope Subtree. If you select Sales and also happen to have East Sales checked as a consequence of that, the query runs once at the Sales level — not separately for each child. Your totals are always accurate.
Live results. There’s no Count button to press. The moment you finish checking (or unchecking) OUs, a debounce timer fires 800ms later and the counts update automatically. The thin activity bar below the Results heading animates while queries are in flight and goes still when they complete.
Mode 2: Group-Based Counting
The second tab lets you search for and multi-select AD security groups, then count their enabled members.
Type a name fragment into the search box and hit Enter. Results appear showing the group name, category, and scope. Double-click any result to add it to your selection list. Build up a collection of groups, then watch the counts update.
The group mode handles nested groups correctly. It recursively walks the full membership tree, and it deduplicates across selected groups using SID tracking. So if a user is a member of both EastSalesUsers and AllSalesUsers, they’re counted once in the grand total — not twice.
Counting Users, Computers, or Both
A set of radio buttons on the results panel controls what gets counted:
- Users — enabled user accounts only (
Enabled -eq $true) - Computers — enabled computer accounts only
- Both — counts both, showing separate columns plus a combined total
Switching between these triggers an immediate recount. The results table adjusts its columns accordingly — no wasted space when you only need one type.
Domain-Wide Stats Header
The header bar shows three live stats fetched at startup:
- OUs in Domain — total count of all OUs found
- Enabled Users — domain-wide enabled user count
- Enabled Computers — domain-wide enabled computer count
These give you immediate context. If you’re counting 43 users across selected OUs and you know the domain has 43 enabled users total, you know your selection covers everyone.
The Results View
Each row in the results table shows:
| Name | Distinguished Name (FQDN) | Users | Computers | Total |
|---|---|---|---|---|
| East Sales Users | OU=East Sales Users,OU=East Sales,OU=Sales,DC=fabrikam,DC=com |
9 | 0 | 9 |
| West Sales Users | OU=West Sales Users,OU=West Sales,OU=Sales,DC=fabrikam,DC=com |
9 | 0 | 9 |
The full Distinguished Name is shown inline in the table so you always know exactly which OU you’re looking at — no ambiguity when you have OUs with similar names in different parts of the tree. A separator and bold total row appear at the bottom once the count completes.
The totals strip at the very bottom of the panel shows the grand TOTAL USERS and TOTAL COMPUTERS counts in large, readable numbers.
Exporting
Once you have results, the Export CSV button becomes active. It saves a timestamped CSV file with a row per OU or group, including the full Distinguished Name, user count, and computer count. The file is UTF-8 encoded and works cleanly with Excel.
Why It’s Built the Way It Is
A few deliberate design decisions worth calling out:
No button to click for counts. The tool auto-recounts whenever your selection changes, using an 800ms debounce so rapid checkbox changes don’t hammer your domain controller. Once you stop changing things, results appear on their own.
Read-only against AD. The tool only calls Get-ADOrganizationalUnit, Get-ADUser, Get-ADComputer, Get-ADGroup, and Get-ADGroupMember. It never writes anything. Safe to run in production.
No install required. It’s a single .ps1 file. The only dependency is the ActiveDirectory PowerShell module (part of RSAT). If that’s missing, the tool tells you on launch and exits gracefully.
Runs as the current user. No service accounts, no elevated credentials needed. You see what your current AD permissions allow you to see.
Requirements
- Windows PowerShell 5.1 or later
- The
ActiveDirectoryRSAT module (Remote Server Administration Tools) - Run on a domain-joined machine with read access to AD
- No admin rights required for read-only queries
To install RSAT on Windows 10/11 if you don’t have it:
Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0"
Or via Settings → Optional Features → Add a feature → RSAT: Active Directory Domain Services and Lightweight Directory Services Tools.
Running It
Download the .ps1 file, unblock it if necessary, and run it:
# Unblock if downloaded from the internet
Unblock-File -Path .\Get-OUUserCount.ps1
# Run it
.\Get-OUUserCount.ps1
If PowerShell’s execution policy is blocking it:
powershell.exe -ExecutionPolicy Bypass -File .\Get-OUUserCount.ps1
Practical Use Cases
Software licensing audits. Select the OUs that contain your licensed user population. Get an accurate headcount in seconds. Export to CSV for the vendor.
OU hygiene checks. Enable the Computers view and step through your OUs looking for unexpected computer counts in places where there shouldn’t be any.
Group membership verification. Before a security review, quickly verify that the groups tied to a particular application or resource have the membership counts you expect.
Onboarding/offboarding validation. After a batch onboarding or offboarding operation, recount the affected OUs to confirm the numbers moved correctly.
MSP billing. If you manage multiple domains or need per-OU breakdowns for billing, select the relevant OUs, export the CSV, and you’re done.
Download
The tool is a single PowerShell file. Download it, run it, and report back.
Download Get-OUUserCount.txt
Note: Change the file extension from.txtto.ps1once it is downloaded.
No installer. No telemetry. No nonsense.