Active Directory PowerShell Commands
The ActiveDirectory module for on-premises AD DS users, groups and computers.All Active Directory PowerShell pages
- Get-ADGroupMember -Recursive: list all members of an AD group, including nested groupsGet-ADGroupMember -Recursive returns every user and computer in a group and its nested groups. For groups over 5,000 members, use an LDAP filter instead.
- Install RSAT on Windows 11 to get the ActiveDirectory PowerShell moduleOn Windows 11, RSAT is an optional feature: add RSAT Active Directory Domain Services Tools in Settings or run Add-WindowsCapability -Online as admin.
- Search-ADAccount: find inactive, disabled, expired and locked-out AD accountsSearch-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly lists users with no logon in 90 days; it also has -AccountDisabled, -LockedOut and more.
- Set-ADAccountPassword -Reset: reset an Active Directory user password with PowerShellSet-ADAccountPassword -Identity USER -Reset -NewPassword (a SecureString) resets an AD password; Set-ADUser -ChangePasswordAtLogon $true forces a change.