The graphical Active Directory Users and Computers console covers the basics, but nearly every AD administrator eventually moves to PowerShell for anything repetitive, anything bulk, or anything that needs to be scripted and run again next month exactly the same way. The ActiveDirectory module (part of RSAT — Remote Server Administration Tools) covers the large majority of day-to-day administration; the GroupPolicy module handles the rest. This post covers fifteen commands worth knowing well, organized by what they actually do.
User management
1. Get-ADUser
Get-ADUser -Identity jdoe -Properties *
Get-ADUser -Filter {Department -eq "Sales"} -Properties Department,TitleThe most-used AD cmdlet by a wide margin. -Identity looks up one specific account by SamAccountName, distinguished name, SID, or GUID; -Filter searches for accounts matching a condition. By default it only returns a small set of common properties — pass -Properties * (or name specific properties) to see anything beyond that default set, including things like memberOf or LastLogonDate.
2. New-ADUser
New-ADUser -Name "Jane Doe" -SamAccountName jdoe -UserPrincipalName jdoe@contoso.com `
-Path "OU=Sales,DC=contoso,DC=com" `
-AccountPassword (ConvertTo-SecureString "Temp-P@ssw0rd1" -AsPlainText -Force) `
-Enabled $true -ChangePasswordAtLogon $trueCreates a new account. A detail worth knowing: a new account is disabled by default unless you both set -Enabled $true and supply a password that satisfies the domain's password policy — trying to enable an account with no password, or one that doesn't meet complexity requirements, fails outright rather than creating a weaker-than-policy account.
3. Set-ADAccountPassword
Set-ADAccountPassword -Identity jdoe -Reset `
-NewPassword (ConvertTo-SecureString "NewP@ssw0rd1" -AsPlainText -Force)Resets a password administratively (as opposed to a user changing their own). Commonly paired with Set-ADUser -Identity jdoe -ChangePasswordAtLogon $true so the temporary password has to be replaced on next login rather than staying in place indefinitely.
4. Unlock-ADAccount
Unlock-ADAccount -Identity jdoeClears a lockout triggered by too many failed password attempts — the single most common AD help-desk request, and a one-line fix once you know the account name.
5. Search-ADAccount
Search-ADAccount -LockedOut
Search-ADAccount -PasswordExpired
Search-ADAccount -AccountDisabled -UsersOnlyRather than checking accounts one at a time, this searches the whole directory for accounts matching a specific state — every locked-out account, every account with an expired password, every disabled account. Genuinely useful for a periodic audit rather than reacting to one ticket at a time.
Group management
6. Get-ADGroupMember
Get-ADGroupMember -Identity "Domain Admins" -RecursiveLists everyone in a group. -Recursive is the detail that matters most here — without it, a group nested inside "Domain Admins" shows up as one entry (the group itself); with it, every user inside that nested group is expanded and listed individually. This is the practical, real-world version of the transitive membership problem covered in Active Directory Group Nesting Explained.
7. Get-ADPrincipalGroupMembership
Get-ADPrincipalGroupMembership -Identity jdoe | Select-Object NameThe reverse question: which groups does this user belong to? Worth knowing precisely what it does and doesn't cover — it reads the user's memberOf attribute, which only reflects direct membership. A user in "Sales," where "Sales" is itself nested inside "AllStaff," shows up as a member of Sales here, but not AllStaff — the same direct-vs-effective distinction AD Security Group Nesting Analyzer is built specifically to resolve.
8. Add-ADGroupMember / Remove-ADGroupMember
Add-ADGroupMember -Identity "Sales" -Members jdoe,asmith
Remove-ADGroupMember -Identity "Sales" -Members jdoe -Confirm:$falseBoth accept multiple members in one call, which matters for anything bulk — onboarding a new team, migrating a group of accounts between groups. Remove-ADGroupMember prompts for confirmation by default; -Confirm:$false suppresses that for scripted use, which is exactly the kind of command worth testing with -WhatIf first.
Computers and organizational units
9. Get-ADComputer
Get-ADComputer -Filter {OperatingSystem -like "*Server*"} -Properties OperatingSystem,LastLogonDateThe computer-object equivalent of Get-ADUser — same filtering syntax, applied to machine accounts instead. Useful for inventory questions ("which servers haven't checked in for 90 days") that would otherwise mean clicking through the console object by object.
10. Get-ADOrganizationalUnit
Get-ADOrganizationalUnit -Filter * -Properties Description | Select-Object Name,DistinguishedNameLists OUs — useful on its own for auditing the OU structure, and often a first step before scripting something that needs to target every object within a specific part of that structure.
11. Get-ADObject (with -LDAPFilter)
Get-ADObject -LDAPFilter "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))"The generic, works-on-anything AD query cmdlet. It's also the one that accepts -LDAPFilter directly — a real LDAP filter string, rather than PowerShell's own -Filter syntax — for the specific cases that syntax can't express, like the bitwise extensible match above (finding disabled accounts by testing a specific bit in userAccountControl). If a filter like this looks unfamiliar, LDAP Filter Parser & Validator breaks it down into plain English.
Domain and forest information
12. Get-ADDomain
Get-ADDomain | Select-Object DNSRoot,DomainSID,PDCEmulatorReports the current domain's own metadata — including its DomainSID, the exact value every domain-relative well-known RID (like -512 for Domain Admins) is computed against. Pasting that SID prefix into SID Decoder confirms exactly what it identifies.
13. Get-ADForest
Get-ADForest | Select-Object Name,ForestMode,Domains,GlobalCatalogsThe forest-level equivalent — which domains exist in the forest, which domain controllers are Global Catalogs, and the forest functional level (which determines which newer AD features are actually available).
Group Policy
14. Get-GPO / Get-GPResultantSetOfPolicy
Get-GPO -All | Select-Object DisplayName,GpoStatus
Get-GPResultantSetOfPolicy -ReportType Html -Path C:\rsop.htmlFrom the separate GroupPolicy module. Get-GPO -All lists every GPO in the domain; Get-GPResultantSetOfPolicy is the PowerShell equivalent of gpresult /h — the actual, resolved outcome of every applicable GPO for a specific user or computer, after LSDOU order, Block Inheritance, and Enforced links have all been accounted for. For working out that precedence by hand instead of generating a live report, see GPO Precedence Calculator.
Diagnostics
15. Test-ComputerSecureChannel
Test-ComputerSecureChannel -Repair -Credential (Get-Credential)Checks — and with -Repair, fixes — the trust relationship between a domain-joined computer and a domain controller. This is the direct fix for the classic "the trust relationship between this workstation and the primary domain failed" error, without needing to unjoin and rejoin the machine to the domain entirely. Unlike every other command on this list, it ships with every Windows installation and needs no RSAT module at all.
Common mistakes
- Running a bulk change without -WhatIf first. Nearly every state-changing AD cmdlet supports it; a typo in
-Filteror-Identityis far cheaper to catch beforehand than after it's already run against the wrong objects. - Assuming Get-ADPrincipalGroupMembership shows effective access. It only shows direct membership; nested groups need their own follow-up query or a tool that resolves the full chain.
- Forgetting -Properties on Get-ADUser/-Computer and getting silent gaps. The default property set is intentionally small; a property that looks missing is often just not requested.
- Reaching for a full domain unjoin/rejoin over a broken trust. Test-ComputerSecureChannel -Repair fixes the common case in one command, with far less disruption.
FAQ
Do I need to install anything before these commands will work?
Most of them come from the ActiveDirectory module, part of RSAT (Remote Server Administration Tools) — install it via "Add-WindowsFeature RSAT-AD-PowerShell" on a server, or through Windows Features on a client OS, then run "Import-Module ActiveDirectory" if it doesn't load automatically. The Group Policy commands need the separate GroupPolicy module, also part of RSAT. Test-ComputerSecureChannel is the one exception — it ships with every Windows installation and needs no extra module at all.
Why did Get-ADPrincipalGroupMembership miss a group I know the user has access through?
It reads the user's memberOf attribute directly, which only lists groups they're a direct member of — not groups reachable through nested membership (being a member of a group that's itself a member of another group). This is exactly the distinction between direct and effective membership; Get-ADGroupMember -Recursive answers a related but different question (every member of a specific group, expanded through nesting), rather than every group a specific user effectively belongs to.
What's the difference between -Filter and -LDAPFilter?
-Filter uses PowerShell's own expression syntax (Get-ADUser -Filter {Name -like "J*"}), which is friendlier to write but is really just being translated into an LDAP filter behind the scenes. -LDAPFilter lets you write that LDAP filter directly — useful when you need a specific capability PowerShell's -Filter syntax doesn't expose, like an extensible match against a specific matching rule OID (bitwise checks against userAccountControl, for instance).
Do these commands work against Azure AD / Microsoft Entra ID?
No — the ActiveDirectory module talks to on-premises Active Directory domain controllers specifically. Entra ID has its own separate command set (the Microsoft Graph PowerShell SDK, which replaced the older AzureAD and MSOnline modules) with different cmdlets and a different underlying object model, even though many concepts overlap.
Is it safe to run a command like Remove-ADGroupMember without double-checking first?
Not as a habit — nearly every AD cmdlet that changes something supports -WhatIf, which reports exactly what the command would do without actually doing it, and it costs nothing to run first. Destructive or high-impact commands (removing group members, disabling accounts, changing OUs) are exactly where a quick -WhatIf pass catches a typo'd -Identity or -Filter before it affects the wrong object.
Try it yourself
Several of the concepts above have a dedicated tool in the Active Directory Toolkit: SID Decoder, AD Security Group Nesting Analyzer, GPO Precedence Calculator, and LDAP Filter Parser & Validator — all running entirely in your browser.