grichardContact

Active Directory (RSAT PowerShell)

ActiveDirectory (RSAT) module cmdlets and command-line tools to administer and troubleshoot a domain: accounts, groups, replication, GPOs, domain controllers.

Getting started

Prerequisites

Install the RSAT tools once (Windows 11), then import the module.

Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

Elevated prompt. For GPOs: Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0.

Import-Module ActiveDirectory; Get-ADDomain | Select DNSRoot,PDCEmulator,DomainMode

Checks the connection to the domain.

Filter by category

    Test with -WhatIf first when it exists. AD changes replicate to every domain controller: prefer a test organizational unit.

    Full list

    Show all 29 entries

    • Get-ADUser

      Get-ADUser -Identity <sam> | -Filter <expression> [-Properties <list>]

      Reads one or more user accounts.

      Get-ADUser jdupont -Properties * | Select Name,Enabled,LastLogonDate,PasswordLastSet,LockedOut
Get-ADUser -Filter {Enabled -eq $true -and Department -eq 'Compta'} -Properties Department,Mail | Select Name,Mail
Get-ADUser -Filter * -SearchBase 'OU=Employes,DC=contoso,DC=local' | Measure-Object

    • New-ADUser

      New-ADUser -Name <name> -SamAccountName <sam> -AccountPassword <SecureString> -Enabled $true -Path <OU>

      Creates a user account.

      New-ADUser -Name 'Jean Dupont' -GivenName Jean -Surname Dupont -SamAccountName jdupont -UserPrincipalName jdupont@contoso.local -Path 'OU=Employes,DC=contoso,DC=local' -AccountPassword (Read-Host -AsSecureString 'Mot de passe') -Enabled $true -ChangePasswordAtLogon $true

    • Set-ADUser

      Set-ADUser -Identity <sam> [-Property value]

      Changes a user's attributes (department, title, manager, expiration).

      Set-ADUser jdupont -Department 'Compta' -Title 'Comptable' -Manager mmartin
Set-ADUser jdupont -AccountExpirationDate (Get-Date).AddDays(30)
Set-ADUser jdupont -Replace @{ extensionAttribute1 = 'valeur' }

    • Unlock-ADAccount

      Unlock-ADAccount -Identity <sam>

      Unlocks an account locked after too many wrong passwords.

      Unlock-ADAccount jdupont
Search-ADAccount -LockedOut | Unlock-ADAccount -WhatIf

    • Set-ADAccountPassword

      Set-ADAccountPassword -Identity <sam> -Reset -NewPassword <SecureString>

      Resets an account's password.

      Set-ADAccountPassword jdupont -Reset -NewPassword (Read-Host -AsSecureString 'Nouveau mot de passe')
Set-ADUser jdupont -ChangePasswordAtLogon $true

    • Search-ADAccount

      Search-ADAccount [-LockedOut] [-AccountDisabled] [-AccountInactive -TimeSpan <d>] [-PasswordExpired] [-PasswordNeverExpires]

      Finds locked, disabled, inactive or password-expired accounts.

      Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly | Select Name,LastLogonDate
Search-ADAccount -LockedOut | Select Name,LockoutTime
Search-ADAccount -PasswordNeverExpires -UsersOnly | Select Name

    • Disable-ADAccount

      Disable-ADAccount -Identity <sam>

      Disables an account (when someone leaves); Enable-ADAccount re-enables it.

      Disable-ADAccount jdupont
Move-ADObject (Get-ADUser jdupont) -TargetPath 'OU=Desactives,DC=contoso,DC=local'

    • Get-ADGroupMember

      Get-ADGroupMember -Identity <group> [-Recursive]

      Lists a group's members, including nested groups with -Recursive.

      Get-ADGroupMember 'Administrateurs du domaine' -Recursive | Select Name,SamAccountName
Get-ADGroupMember 'GRP_Compta' | Get-ADUser -Properties Mail | Select Name,Mail

    • Add-ADGroupMember

      Add-ADGroupMember -Identity <group> -Members <accounts>

      Adds members to a group; Remove-ADGroupMember removes them.

      Add-ADGroupMember -Identity GRP_Compta -Members jdupont,mmartin
Remove-ADGroupMember -Identity GRP_Compta -Members jdupont -Confirm:$false

    • Get-ADPrincipalGroupMembership

      Get-ADPrincipalGroupMembership -Identity <sam>

      Lists the groups a user or computer belongs to.

      Get-ADPrincipalGroupMembership jdupont | Select Name,GroupCategory | Sort Name
Get-ADUser jdupont -Properties MemberOf | Select -Expand MemberOf

    • New-ADGroup

      New-ADGroup -Name <name> -GroupScope Global|DomainLocal|Universal -GroupCategory Security -Path <OU>

      Creates a security or distribution group.

      New-ADGroup -Name GRP_Compta -GroupScope Global -GroupCategory Security -Path 'OU=Groupes,DC=contoso,DC=local' -Description 'Service comptabilité'

    • Get-ADComputer

      Get-ADComputer -Filter <expression> [-Properties <list>]

      Reads computer accounts (operating system, last logon).

      Get-ADComputer -Filter * -Properties OperatingSystem,LastLogonDate | Group OperatingSystem | Select Count,Name
Get-ADComputer -Filter {LastLogonDate -lt $date} -Properties LastLogonDate | Select Name,LastLogonDate

    • Reset-ComputerMachinePassword

      Reset-ComputerMachinePassword -Server <DC> -Credential <account>

      Repairs the trust relationship of a domain member machine (run it on the machine).

      Reset-ComputerMachinePassword -Server DC01 -Credential CONTOSO\adminAD
Test-ComputerSecureChannel -Repair -Credential CONTOSO\adminAD

    • Move-ADObject

      Move-ADObject -Identity <DN> -TargetPath <OU>

      Moves a user, computer or group to another OU.

      Get-ADComputer PC01 | Move-ADObject -TargetPath 'OU=Postes,DC=contoso,DC=local'

    • repadmin /replsummary

      repadmin /replsummary | /showrepl | /syncall /AdeP

      AD replication summary and forcing synchronization between domain controllers.

      repadmin /replsummary
repadmin /showrepl * /csv | ConvertFrom-Csv | Where 'Number of Failures' -gt 0
repadmin /syncall /AdeP

    • dcdiag

      dcdiag [/s:<DC>] [/test:<test>] [/v]

      Full diagnostic of a domain controller (DNS, replication, FSMO, services).

      dcdiag /v
dcdiag /test:dns /v /e
dcdiag /s:DC01 /test:replications

    • netdom query fsmo / Get-ADForest

      netdom query fsmo

      Identifies the controllers holding the five FSMO roles.

      netdom query fsmo
Get-ADDomain | Select PDCEmulator,RIDMaster,InfrastructureMaster
Get-ADForest | Select SchemaMaster,DomainNamingMaster

    • Move-ADDirectoryServerOperationMasterRole

      Move-ADDirectoryServerOperationMasterRole -Identity <DC> -OperationMasterRole PDCEmulator

      Transfers an FSMO role to another domain controller.

      Move-ADDirectoryServerOperationMasterRole -Identity DC02 -OperationMasterRole PDCEmulator,RIDMaster,InfrastructureMaster

    • Get-ADDomainController

      Get-ADDomainController -Filter * | Select Name,IPv4Address,Site,OperatingSystem

      Lists the domain controllers and their roles.

      Get-ADDomainController -Filter * | Select Name,IPv4Address,Site,IsGlobalCatalog
Get-ADDomainController -Discover -Service PrimaryDC

    • Get-ADReplicationFailure

      Get-ADReplicationFailure -Target <DC>

      Replication failures of a domain controller.

      Get-ADReplicationFailure -Target DC01 | Select Server,Partner,FirstFailureTime,FailureCount,LastError
Get-ADReplicationPartnerMetadata -Target * -Scope Server | Select Server,Partner,LastReplicationSuccess

    • Get-GPO

      Get-GPO -All | -Name <name>

      Lists Group Policy objects.

      Get-GPO -All | Select DisplayName,GpoStatus,ModificationTime | Sort ModificationTime -Descending

    • Get-GPOReport

      Get-GPOReport -All -ReportType Html -Path <file>

      Exports the content of one or all GPOs as an HTML or XML report.

      Get-GPOReport -Name 'Postes - Sécurité' -ReportType Html -Path C:\Temp\gpo.html
Get-GPOReport -All -ReportType Xml -Path C:\Temp\toutes-gpo.xml

    • New-GPLink

      New-GPLink -Name <GPO> -Target <OU> [-LinkEnabled Yes] [-Enforced Yes]

      Links a GPO to an organizational unit, a site or the domain.

      New-GPLink -Name 'Postes - Sécurité' -Target 'OU=Postes,DC=contoso,DC=local' -LinkEnabled Yes
Get-GPInheritance -Target 'OU=Postes,DC=contoso,DC=local'

    • Invoke-GPUpdate

      Invoke-GPUpdate -Computer <name> -Force

      Forces GPO application on a remote machine (equivalent of gpupdate /force).

      Invoke-GPUpdate -Computer PC01 -Force -RandomDelayInMinutes 0
gpresult /s PC01 /r

    • Backup-GPO

      Backup-GPO -All -Path <folder>

      Backs up GPOs (and Restore-GPO to put them back).

      Backup-GPO -All -Path D:\SauvegardeGPO
Restore-GPO -Name 'Postes - Sécurité' -Path D:\SauvegardeGPO

    • Get-ADObject (AD Recycle Bin)

      Get-ADObject -Filter 'isDeleted -eq $true' -IncludeDeletedObjects

      Finds and restores a deleted object when the AD Recycle Bin is enabled.

      Get-ADObject -Filter 'isDeleted -eq $true -and Name -like "Jean*"' -IncludeDeletedObjects -Properties LastKnownParent
Get-ADObject -Filter 'Name -like "Jean*"' -IncludeDeletedObjects | Restore-ADObject

    • Get-ADDefaultDomainPasswordPolicy

      Get-ADDefaultDomainPasswordPolicy ; Get-ADFineGrainedPasswordPolicy -Filter *

      The domain password policy and fine-grained policies.

      Get-ADDefaultDomainPasswordPolicy
Get-ADUserResultantPasswordPolicy jdupont

    • Get-ADUser (audit: never-logged-on accounts, old passwords)

      Get-ADUser -Filter {...} -Properties PasswordLastSet,LastLogonDate

      Common audit queries on accounts.

      Get-ADUser -Filter {Enabled -eq $true} -Properties PasswordLastSet | Where PasswordLastSet -lt (Get-Date).AddDays(-365) | Select Name,PasswordLastSet
Get-ADUser -Filter * -Properties LastLogonDate | Where {$_.LastLogonDate -eq $null -and $_.Enabled} | Select Name
Get-ADUser -Filter {AdminCount -eq 1} -Properties AdminCount | Select Name

    • ldifde / csvde

      csvde -f <export.csv> -r "(objectClass=user)" -l <attributs>

      Exports or imports AD objects as CSV (csvde) or LDIF (ldifde).

      csvde -f C:\Temp\users.csv -r "(&(objectCategory=person)(objectClass=user))" -l sAMAccountName,mail,displayName
ldifde -f C:\Temp\group.ldf -d "CN=GRP_Compta,OU=Groupes,DC=contoso,DC=local"

    More cheatsheets

    Related projects