Active Directory PowerShell commands cheat sheet

Install the AD DS and AD LDS tools, including the ActiveDirectory module, on Windows 10 or 11.

Run from an elevated PowerShell window. Get-WindowsCapability -Online | Where-Object Name -like 'RSAT*' lists every RSAT tool.

Install the AD DS and AD LDS management tools, including the module, on Windows Server.

Load the ActiveDirectory module into the current session.

PowerShell loads it automatically the first time you run an AD cmdlet; import it explicitly at the top of scripts.

Show the current domain, its functional level and the PDC emulator, RID master and infrastructure master.

Show the forest, its domains, global catalogs, functional level and schema and domain naming masters.

Find a domain controller through the DC locator, optionally one offering a given service.

-Service "GlobalCatalog" finds a global catalog server; -ForceDiscover skips the cached result.

List every domain controller in the domain.

Show every attribute of one user account.

-Identity accepts a sAMAccountName, distinguished name, GUID or SID. Without -Properties only a small default set is returned.

Find users that match a filter.

-Filter is required when you do not use -Identity; -Filter * returns every user.

List the users in one OU and the OUs below it.

-SearchScope OneLevel limits the search to that OU only.

Create a user account with a password and enable it.

Without -Enabled $true the account is created disabled, with or without a password. Without -Path it goes into the default Users container.

Change attributes on an existing user.

For attributes without their own parameter use -Replace @{attribute='value'}, -Add, -Remove or -Clear.

Reset a user's password as an administrator.

Follow with Set-ADUser -Identity jsmith -ChangePasswordAtLogon $true to force a change at next sign-in.

Unlock an account that was locked out by failed sign-ins.

Enable a disabled user, computer or service account.

Disable an account so it can no longer sign in.

Safer than deleting a leaver: the SID, group memberships and attributes stay intact if you need them back.

List accounts that are currently locked out.

Find accounts that have not signed in within a period.

-DateTime uses a fixed date instead of a period. Requires Windows Server 2003 domain functional level or higher.

List accounts whose password has expired.

List accounts set so their password never expires, a common audit finding.

Set the date an account stops working, for contractors and temporary staff.

Delete a user account.

Warning: The account, its SID and its group memberships are removed. Without the AD Recycle Bin you need an authoritative restore from backup to get it back. Prompts for confirmation by default.

Find groups by name, scope or category.

Use -Identity <group> -Properties member to read one group's member list.

Create a security or distribution group.

-GroupScope takes DomainLocal, Global or Universal; -GroupCategory takes Security or Distribution.

Add users, computers or groups to a group.

Users pick up a new security group membership at their next sign-in.

List the members of a group, including members of nested groups.

-Recursive returns the users and computers at the end of the nesting chain, not the nested groups themselves.

Remove members from a group.

Warning: The member loses any access granted through that group. Prompts for confirmation; scripts add -Confirm:$false.

List the groups a user, computer or group is a member of.

Find computer accounts and read properties such as OS and IP address.

Use -Identity <name> -Properties * to see everything about one computer.

Find computer accounts that have not signed in to the domain within a period.

Check the trust between this domain member and its domain; returns True or False.

Run it on the member computer, not on a domain controller. Windows PowerShell 5.1 only.

Repair a broken trust relationship without rejoining the domain.

The account needs permission to reset the computer account. Windows PowerShell 5.1 only.

Reset the computer account password that this machine shares with the domain.

Windows PowerShell 5.1 only.

Create an organizational unit.

New OUs are protected from accidental deletion unless you pass -ProtectedFromAccidentalDeletion $false.

Move a user, computer, group or OU to another OU.

Group Policy linked to the new OU applies from the next policy refresh.

Turn deletion protection on or off for an object.

A protected OU cannot be deleted or moved until protection is cleared. Turn it back on afterwards.

Show the AD Recycle Bin feature and where it is enabled.

Enable the Active Directory Recycle Bin for the forest.

Cannot be disabled once enabled. Needs Windows Server 2008 R2 forest functional level and Enterprise Admins rights. Objects deleted before you enable it can only come back from a backup.

Find deleted objects, including ones in the Deleted Objects container.

Restore a deleted object with its attributes and group memberships from the recycle bin.

Works only if the Recycle Bin was enabled before the object was deleted. -TargetPath restores to a different OU.

Show replication partners of a DC with last success time and last result.

LastReplicationResult of 0 means success; also check ConsecutiveReplicationFailures.

Show replication status for every DC in a domain.

List replication failures for a DC, site, domain or forest.

Summarize replication across domain controllers and flag the ones that are failing.

/errorsonly shows only DCs with partner errors. Installed with the AD DS tools.

Show when a DC last tried inbound replication for each partition and whether it worked.

Run the standard domain controller health tests against a DC.

/q prints only errors, /v adds detail, /e tests every DC in the enterprise and /c runs the comprehensive set.

Test DNS registration, forwarders and delegation for domain controllers.

Show the domain password and lockout policy: length, complexity, age and lockout threshold.

List fine-grained password policies (PSOs) and their precedence.

Show which fine-grained password policy actually applies to a user.

A PSO linked directly to the user wins over ones linked to groups; among groups the lowest precedence value wins.