/flags/active-directory/get-aduser-server
Get-ADUser -Server: query a specific domain controller or another domain
- tool
- Active Directory PowerShell
- command
- Get-ADUser
- flag
- -Server <domain or DC[:port]>
- default
- from the pipeline object, the AD drive, or the domain of the computer running PowerShell
Get-ADUser -Identity anna -Server dc02.contoso.com sends the query to a specific domain controller; -Server emea.contoso.com sends it to a domain controller of another domain. Without -Server, the ActiveDirectory module picks a server itself. Use it after changing an account (to read it from the DC you wrote to, before replication), to work with child or trusted domains, to query a global catalog, and to avoid "Unable to find a default server" when the computer is not in the domain.
Import-Module ActiveDirectory
Get-ADUser -Identity anna -Server dc02.contoso.com -Properties LockedOut, BadLogonCount
Get-ADUser -Filter "Surname -eq 'Rossi'" -Server emea.contoso.com
Get-ADUser -Filter * -Server dc01.contoso.com:3268 -SearchBase "" # global catalog, all domainsAccepted values and the default
The reference lists domain name values (FQDN or NetBIOS name) and directory server values (fully qualified server name, NetBIOS name, or fully qualified name with port). When you omit -Server, the value is determined in this order:
- "By using Server value from objects passed through the pipeline."
- "By using the server information associated with the Active Directory PowerShell provider drive, when running under that drive."
- "By using the domain of the computer running PowerShell."
| Value | Example | Use |
|---|---|---|
| Domain FQDN | -Server emea.contoso.com | any DC of that domain (located through DNS) |
| NetBIOS domain name | -Server EMEA | same, by NetBIOS name |
| DC FQDN | -Server dc02.contoso.com | one specific domain controller |
| DC with port | -Server dc01.contoso.com:3268 | global catalog (3268) or an AD LDS instance port |
Pitfalls
- Non-domain computers. On a workgroup or Entra-joined machine, "the domain of the computer running PowerShell" does not exist, and cmdlets fail with Unable to find a default server with Active Directory Web Services running. Pass
-Server(and-Credentialwhen needed). - ADWS required. The module talks to Active Directory Web Services on TCP 9389. A DC without ADWS, or a firewall blocking the port, fails even with
-Server. - Replication delay. A change written to one DC appears on others only after replication; pass the same
-ServertoSet-ADAccountPasswordand to the check (reset a password). - SearchBase must match. With another domain, the
-SearchBaseDN must be in that domain (-SearchBase and -SearchScope). - Group members across domains. Group cmdlets need the same care; see Get-ADGroupMember -Recursive.
FAQ
How do I query a user in a child or trusted domain?
Pass that domain's DNS name: Get-ADUser -Identity anna -Server emea.contoso.com. The account running the command needs read access there, and the target domain must have domain controllers running Active Directory Web Services.
How do I read a value from every domain controller?
Loop over Get-ADDomainController -Filter * and pass each HostName to -Server, for example to read the non-replicated lastLogon attribute on each DC.
Can -Server point to a global catalog?
Yes, with the port: -Server dc01.contoso.com:3268. A global catalog query covers all domains of the forest but returns only the attributes in the partial attribute set.