Active Directory PowerShell Quick Reference Active Directory PowerShell Quick Reference

Other Cmdlets Recycle Bin Getting Started User Account Tasks

Add-ADComputerServiceAccount To enable the ‘AD Recycle Bin’ feature: To add the Active Directory module:
Get-ADComputerServiceAccount To see user account details:
Remove-ADComputerServiceAccount Enable-ADOptionalFeature 'Recycle Import-Module activedirectory
Remove-ADServiceAccount Get-ADUser -Identity 'Joe Bloggs'
Set-ADServiceAccount
Bin Feature' -Scope
ForestOrConfigurationSet -Target Get a list of AD Commands:
To search for a user:
Add-ADDomainControllerPasswordReplicationPolicy 'test.local' Get-Command -Module
Get-ADAccountResultantPasswordReplicationPolicy
Get-ADDomainControllerPasswordReplicationPolicy activedirectory Get-ADUser -Filter 'Name -like
To restore an AD Account from the Recycle Bin
Get-ADDomainControllerPasswordReplicationPolicyUsage "Joe Bloggs"'
Remove-ADDomainControllerPasswordReplicationPolicy
For help with a cmdlet, type:
Get-ADObject -Filter Or search for users in a particular OU:
Remove-ADFineGrainedPasswordPolicy 'samaccountname -eq "JoeBloggs"'
Remove-ADFineGrainedPasswordPolicySubject Get-Help Get-ADUser -Full
Set-ADFineGrainedPasswordPolicy -IncludeDeletedObjects | Restore- Get-ADUser -Filter * -SearchBase
ADObject "OU=Sales,OU=Users,DC=test,DC=loc
Add-ADPrincipalGroupMembership Forests and Domains al"
Get-ADPrincipalGroupMembership
Remove-ADPrincipalGroupMembership Service Accounts To see Forest details: To see additional properties, not just the default set:
To see AD Service Accounts:
Disable-ADOptionalFeature Get-ADForest test.local Get-ADUser -Identity 'JoeBlogs' -
Get-ADOptionalFeature
Get-ADServiceAccount -Filter * Properties Description,Office
To see Domain details:
Get-ADObject
Move-ADObject To create a new AD Service Account: To see all the user properties, not just default set:
Get-ADDomain test.local
New-ADObject
Remove-ADObject New-ADServiceAccount -Name To raise the Forest functional level:
Get-ADUser -Identity 'JoeBloggs'
Rename-ADObject "Service1" -SamAccountName -Properties *
Set-ADObject
"Service1" -DisplayName Set-ADForestMode -Identity
"Service1" -AccountPassword To create a new user:
Set-ADOrganizationalUnit test.local -ForestMode
Remove-ADOrganizationalUnit (Read-Host -AsSecureString Windows2008R2Forest New-ADUser -Name "Joe Bloggs" -
"AccountPassword") -Enabled $true SamAccountName "JoeBloggs" -
Get-ADUserResultantPasswordPolicy To raise the Domain functional level:
Remove-ADUser GivenName "Joe" -Surname "Bloggs"
Install an existing AD service account on the local
computer and make the required changes so that the Set-ADDomainMode -Identity -DisplayName "Joe Bloggs" -Path
Get-ADAccountAuthorizationGroup
Get-ADDomainController password can be periodically reset by the computer: test.local -DomainMode 'OU=Users,OU=Sales,DC=test,DC=loc
Windows2008R2Domain al' -OtherAttributes
Move-ADDirectoryServer Install-ADServiceAccount - @{'Title'="Sales Manager"} -
Identity 'Service1' Get the rootDSE from the default domain controller: AccountPassword (Read-Host -
Remove-ADGroupMember
AsSecureString "AccountPassword")
Uninstall an existing AD service account on the local Get-ADRootDSE -Enabled $true
Search-ADAccount
computer:
Move FSMO roles:
Set-ADAccountControl To change the properties of a user:
Set-ADComputer Uninstall-ADServiceAccount -
Set-ADDomain Identity 'Service1' Move- Set-ADUser Joe Bloggs -City
Set-ADForest ADDirectoryServerOperationMasterR London -Remove
To reset the AD Service Account password on the ole -Identity "TESTDC" - @{otherMailbox="Joe.Bloggs"} -Add
local computer: OperationMasterRole @{url="test.local"} -Replace
PDCEmulator,SchemaMaster
Reset-ADServiceAccountPassword - @{title="manager"} -Clear
Identity 'Service1' description
 Active Directory PowerShell Quick Reference Active Directory PowerShell Quick Reference

Password Policies Group Tasks User Account Security Computer Account Tasks
sks
To see the Default Domain Password Policy: To see group details: To disable a user account: To see computer account details:

Get-ADDefaultDomainPasswordPolicy Get-ADGroup -Identity 'Sales Disable-ADAccount -Identity Get-ADComputer -Filter 'Name -

-Identity test.local Users' JoeBloggs like "Server01"'

To change the properties of the Default Domain To create a new group: To enable a user account: To create a new computer account:
Password Policy:
Enable-ADAccount -Identity New-ADComputer -Name "Server01" -
Set-ADDefaultDomainPasswordPolicy New-ADGroup -Name "Sales Users" -
JoeBloggs SamAccountName "Server01" -Path
-Identity test.local - SamAccountName SalesUsers -
"OU=Computers,OU=Resources,DC=tes
LockoutDuration 00:40:00 - GroupCategory Security -
To set the expiration date for a user account: t,DC=local" -Enabled $true -
LockoutObservationWindow 00:20:00 GroupScope Global -DisplayName
Location "London"
-MaxPasswordAge 10.00:00:00 - ‘Sales Users’ -Path
Set-ADAccountExpiration -Identity
MinPasswordLength 8 "OU=Groups,OU=Resources,DC=test,D
JoeBloggs -DateTime "10/18/2008" To remove a computer account:
C=local" -Description "All Sales
To create a new Fine-Grained Password Policy: Users" To clear the expiration date for a user account: Remove-ADComputer -Identity
"Server01" -Confirm:$false
New-ADFineGrainedPasswordPolicy - To change the properties of a group: Clear-ADAccountExpiration -
Name "Standard Users PSO" - Identity JoeBloggs
Precedence 500 -ComplexityEnabled Set-ADGroup -Identity
Organisational Unit Tasks
$true -Description "Standard 'SalesUsers' -GroupCategory To change the password for a user account:
Users Password Policy" - Distribution -GroupScope To see OU details:
DisplayName "Standard Users PSO" Universal -ManagedBy 'JoeBloggs' Set-ADAccountPassword -Identity
-LockoutDuration "0.12:00:00" - -Clear Description JoeBloggs -Reset -NewPassword Get-ADOrganizationalUnit -
LockoutObservationWindow (ConvertTo-SecureString - Identity
"0.00:15:00" -LockoutThreshold 10 To remove a group: AsPlainText "p@ssw0rd" -Force) 'OU=Users,OU=Sales,DC=test,DC=loc
al'
To see all Fine-Grained Password Policies: Remove-ADGroup -Identity To unlock a user account:
'SalesUsers' -Confirm:$false To create a new OU:
Get-ADFineGrainedPasswordPolicy - Unlock-ADAccount -Identity
Filter {name -like "*"} To see group members: JoeBloggs New-ADOrganizationalUnit -Name
Users -Path
To apply a Fine-Grained Password Policy to a group Get-ADGroupMember -Identity 'OU=Marketing,DC=test,DC=local'
of users: 'SalesUsers' -Recursive
Add- To add group members:
ADFineGrainedPasswordPolicySubjec
t 'Standard Users PSO' -Subjects How to Get More Information
Add-ADGroupMember -Identity
'Standard Users' 'SalesUsers' -Members Check out the AD PowerShell Blog
JoeBloggs,SarahJane
To see which users have been applied to a Fine- http://blogs.msdn.com/adpowershell/default.aspx
Grained Password Policy:
To remove group members:
Make sure you visit the following sites for PowerShell Podcasts
Get- For the latest version of this doc check
ADFineGrainedPasswordPolicySubjec Remove-ADGroupMember -Identity http://get-scripting.blogspot.com/
t -Identity 'Standard Users PSO' 'SalesUsers' -Members http://powerscripting.net/ http://jonathanmedd.net
JoeBloggs,SarahJane v0.1