Active Directory PowerShell
The ActiveDirectory module for on-premises AD DS users, groups and computers.
Official documentation- Get-ADUser : Cannot find an object with identity: 'jdoe' under: 'DC=contoso,DC=com'Get-ADUser -Identity accepts only a sAMAccountName, DN, GUID or SID, so a UPN or email fails. Search those with -Filter, or add -Server for another domain.
- The term 'Get-ADUser' is not recognized as the name of a cmdlet, function, script file, or operable programGet-ADUser and the other AD cmdlets come from the ActiveDirectory module in RSAT. Without RSAT the command is not found; install RSAT, then open a new window.
- Import-Module : The specified module 'ActiveDirectory' was not loaded because no valid module file was foundThe ActiveDirectory module ships with RSAT, not the PowerShell Gallery. Install the RSAT capability on Windows 10/11 or RSAT-AD-PowerShell on Windows Server.
- Unable to find a default server with Active Directory Web Services running.The ActiveDirectory module could not reach a domain controller running ADWS on TCP 9389: machine not in the domain, DNS, firewall or ADWS stopped. Try -Server.
- Get-ADGroupMember -Recursive: list all members of an AD group, including nested groupsGet-ADGroupMember -Recursive returns every user and computer in a group and its nested groups. For groups over 5,000 members, use an LDAP filter instead.
- Install RSAT on Windows 11 to get the ActiveDirectory PowerShell moduleOn Windows 11, RSAT is an optional feature: add RSAT Active Directory Domain Services Tools in Settings or run Add-WindowsCapability -Online as admin.
- Search-ADAccount: find inactive, disabled, expired and locked-out AD accountsSearch-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly lists users with no logon in 90 days; it also has -AccountDisabled, -LockedOut and more.
- Set-ADAccountPassword -Reset: reset an Active Directory user password with PowerShellSet-ADAccountPassword -Identity USER -Reset -NewPassword (a SecureString) resets an AD password; Set-ADUser -ChangePasswordAtLogon $true forces a change.
- Get-ADUser -Filter syntax: examples with -like, variables, dates and -PropertiesGet-ADUser -Filter takes a query string such as "Name -like 'Ann*'". Quote the values, add -Properties for extra attributes and use -SearchBase for one OU.
- Get-ADUser -Properties: get attributes beyond the default set (and why * is slow)Get-ADUser returns ten default properties; -Properties adds mail, Department, LastLogonDate or any LDAP attribute. Why -Properties * is slow in scripts.
- Get-ADUser -SearchBase and -SearchScope: search one OU, with or without sub-OUsGet-ADUser -SearchBase limits a search to one OU and its sub-OUs; -SearchScope OneLevel excludes sub-OUs. DN syntax, Users container and common errors.
- Get-ADUser -Server: query a specific domain controller or another domainGet-ADUser -Server targets a specific domain controller, another domain or a global catalog port. How the default server is chosen and ADWS requirements.