PowerShell Active Directory Commands
This guide covers common Active Directory management tasks using the RSAT ActiveDirectory module.
Parent Topic: PowerShell Comprehensive Guide
Prerequisites
Ensure the RSAT tools are installed:
Get-WindowsCapability -Name RSAT.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 -Online | Add-WindowsCapability -OnlineUser Management
Find a User
# Basic search
Get-ADUser -Identity "jdoe"
# Filter search
Get-ADUser -Filter "SamAccountName -eq 'jdoe'" -Properties * | Select-Object Name, EmailAddress, LastLogonDateCreate a User
$password = Read-Host -AsSecureString "Enter Password"
New-ADUser -Name "Jane Doe" `
-SamAccountName "jdoe" `
-UserPrincipalName "jdoe@domain.com" `
-AccountPassword $password `
-Enabled $true `
-Path "OU=Users,DC=domain,DC=com"Modify a User
Set-ADUser -Identity "jdoe" -Description "HR Manager" -Office "Building A"Unlock a User
Unlock-ADAccount -Identity "jdoe"Group Management
Get Group Members
Get-ADGroupMember -Identity "Domain Admins" | Select-Object Name, SamAccountName, distinquishedNameAdd User to Group
Add-ADGroupMember -Identity "VPN Users" -Members "jdoe"Remove User from Group
Remove-ADGroupMember -Identity "VPN Users" -Members "jdoe" -Confirm:$falseComputer Management
Find Computers
# Find all Windows Servers
Get-ADComputer -Filter "OperatingSystem -like '*Server*'" -Properties OperatingSystemMove Computer to OU
Move-ADObject -Identity "CN=SERVER01,CN=Computers,DC=domain,DC=com" -TargetPath "OU=Servers,DC=domain,DC=com"Useful One-Liners
Find Locked Out Users
Search-ADAccount -LockedOut | Select-Object Name, SamAccountNameFind Inactive Computers (90 Days)
$date = (Get-Date).AddDays(-90)
Get-ADComputer -Filter {LastLogonDate -lt $date} -Properties LastLogonDate | Select-Object Name, LastLogonDateReturn to PowerShell Comprehensive Guide