Windows - CLI - AD Lookup

Active Directory PowerShell Reference

windows powershell activedirectory cli

---

Prerequisites

Requires RSAT (Remote Server Administration Tools) for the ActiveDirectory module.

Install RSAT (Windows 10/11)

# Check if installed
Get-WindowsCapability -Name RSAT.ActiveDirectory* -Online
 
# Install
Add-WindowsCapability -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 -Online

Import Module

Import-Module ActiveDirectory

---

User Queries

Get User Information

Get-ADUser -Identity username
Get-ADUser -Identity username -Properties *
Get-ADUser -Identity username -Properties DisplayName, EmailAddress, Department

Find User by Name or Email

Get-ADUser -Filter "Name -like '*smith*'"
Get-ADUser -Filter "EmailAddress -eq 'john.smith@company.com'"
Get-ADUser -Filter "SamAccountName -like 'jsmith*'"

Identify the Full CN for a User

Get-ADUser -Identity username | Select-Object DistinguishedName

Query Groups the User is a Member In (Standard)

Get-ADUser -Identity username -Property MemberOf | Select-Object -ExpandProperty MemberOf

Query the User’s Group Membership Recursively (Nested)

(Get-ADUser -Identity username -Property MemberOf).MemberOf | ForEach-Object { Get-ADGroup -Identity $_ | Select-Object Name }

Get All Users in an OU

Get-ADUser -Filter * -SearchBase "OU=Sales,DC=company,DC=com"

---

Group Queries

Identify the Full CN for a Group

Get-ADGroup -Identity "GroupName" | Select-Object DistinguishedName

Query All Members in a Group

Get-ADGroupMember -Identity "GroupName" -Recursive | Where-Object { $_.objectClass -eq 'user' } | Select-Object Name, SamAccountName

Legacy CLI Alternative

net group GroupName /domain

Get Group Details

Get-ADGroup -Identity "GroupName" -Properties *
Get-ADGroup -Identity "GroupName" -Properties Description, ManagedBy

Find Groups by Name

Get-ADGroup -Filter "Name -like '*admin*'"

---

Computer Queries

Get Computer Information

Get-ADComputer -Identity "COMPUTERNAME"
Get-ADComputer -Identity "COMPUTERNAME" -Properties *

Find Computers by Name

Get-ADComputer -Filter "Name -like 'DESK-*'"

Get Computers in an OU

Get-ADComputer -Filter * -SearchBase "OU=Workstations,DC=company,DC=com" | Select-Object Name, DNSHostName

Find Computers by OS

Get-ADComputer -Filter "OperatingSystem -like '*Server 2019*'" -Properties OperatingSystem | Select-Object Name, OperatingSystem

Find Inactive Computers (90 days)

$date = (Get-Date).AddDays(-90)
Get-ADComputer -Filter "LastLogonDate -lt '$date'" -Properties LastLogonDate | Select-Object Name, LastLogonDate

---

Filtering and Output

Common Filter Operators

Operator	Example
-eq	"Department -eq 'IT'"
-ne	"Enabled -ne 'False'"
-like	"Name -like '*smith*'"
-notlike	"Name -notlike 'admin*'"
-and	"Department -eq 'IT' -and Enabled -eq 'True'"
-or	"Department -eq 'IT' -or Department -eq 'HR'"

Export to CSV

Get-ADUser -Filter * -Properties DisplayName, Department | Select-Object SamAccountName, DisplayName, Department | Export-Csv -Path "users.csv" -NoTypeInformation

Export Group Members

Get-ADGroupMember -Identity "GroupName" -Recursive | Select-Object Name, SamAccountName, objectClass | Export-Csv -Path "group_members.csv" -NoTypeInformation

Format as Table

Get-ADUser -Filter "Department -eq 'IT'" | Format-Table Name, SamAccountName, Enabled

---

Quick Reference

Find Disabled Users

Get-ADUser -Filter "Enabled -eq 'False'" | Select-Object Name, SamAccountName

Find Locked Accounts

Search-ADAccount -LockedOut | Select-Object Name, SamAccountName

Unlock Account

Unlock-ADAccount -Identity username

Check Password Expiry

Get-ADUser -Identity username -Properties PasswordLastSet, PasswordNeverExpires | Select-Object Name, PasswordLastSet, PasswordNeverExpires