Active Directory PowerShell Quick Reference Active Directory PowerShell Quick Reference

Other Cmdlets Recycle Bin Getting Started User Account Tasks

Add-ADComputerServiceAccount To enable the ‘AD Recycle Bin’ feature: To add the Active Directory module:
Get-ADComputerServiceAccount To see user account details:
Remove-ADComputerServiceAccount Enable-ADOptionalFeature 'Recycle Import-Module activedirectory
Remove-ADServiceAccount Bin Feature' -Scope Get-ADUser -Identity 'Joe Bloggs'
Set-ADServiceAccount Get a list of AD Commands:
ForestOrConfigurationSet -Target
To search for a user:
Add-ADDomainControllerPasswordReplicationPolicy 'test.local'
Get-ADAccountResultantPasswordReplicationPolicy Get-Command -Module
Get-ADDomainControllerPasswordReplicationPolicy activedirectory Get-ADUser -Filter 'Name -like
To restore an AD Account from the Recycle Bin
Get-ADDomainControllerPasswordReplicationPolicyUsage "Joe Bloggs"'
Remove-ADDomainControllerPasswordReplicationPolicy
For help with a cmdlet, type:
Get-ADObject -Filter Or search for users in a particular OU:
Remove-ADFineGrainedPasswordPolicy 'samaccountname -eq "JoeBloggs"'
Remove-ADFineGrainedPasswordPolicySubject Get-Help Get-ADUser -Full
Set-ADFineGrainedPasswordPolicy -IncludeDeletedObjects | Restore- Get-ADUser -Filter * -SearchBase
ADObject "OU=Sales,OU=Users,DC=test,DC=loc
Add-ADPrincipalGroupMembership Forests and Domains al"
Get-ADPrincipalGroupMembership
Remove-ADPrincipalGroupMembership Service Accounts To see Forest details: To see additional properties, not just the default set:
To see AD Service Accounts:
Disable-ADOptionalFeature Get-ADForest test.local Get-ADUser -Identity 'JoeBlogs' -
Get-ADOptionalFeature Get-ADServiceAccount -Filter *
To see Domain details:
Properties Description,Office
Get-ADObject
Move-ADObject To create a new AD Service Account: To see all the user properties, not just default set:
Get-ADDomain test.local
New-ADObject
Remove-ADObject New-ADServiceAccount -Name Get-ADUser -Identity 'JoeBloggs'
To raise the Forest functional level:
Rename-ADObject "Service1" -SamAccountName -Properties *
Set-ADObject "Service1" -DisplayName Set-ADForestMode -Identity
"Service1" -AccountPassword To create a new user:
Set-ADOrganizationalUnit test.local -ForestMode
Remove-ADOrganizationalUnit (Read-Host -AsSecureString Windows2008R2Forest New-ADUser -Name "Joe Bloggs" -
"AccountPassword") -Enabled $true
Get-ADUserResultantPasswordPolicy To raise the Domain functional level:
SamAccountName "JoeBloggs" -
Remove-ADUser
Install an existing AD service account on the local
GivenName "Joe" -Surname "Bloggs"
computer and make the required changes so that the Set-ADDomainMode -Identity -DisplayName "Joe Bloggs" -Path
Get-ADAccountAuthorizationGroup
Get-ADDomainController password can be periodically reset by the computer: test.local -DomainMode 'OU=Users,OU=Sales,DC=test,DC=loc
Windows2008R2Domain al' -OtherAttributes
Move-ADDirectoryServer Install-ADServiceAccount - @{'Title'="Sales Manager"} -
Identity 'Service1' Get the rootDSE from the default domain controller: AccountPassword (Read-Host -
Remove-ADGroupMember
AsSecureString "AccountPassword")
Uninstall an existing AD service account on the local Get-ADRootDSE
Search-ADAccount computer: -Enabled $true
Move FSMO roles:
Set-ADAccountControl To change the properties of a user:
Set-ADComputer
Uninstall-ADServiceAccount -
Set-ADDomain Identity 'Service1' Move-
ADDirectoryServerOperationMasterR Set-ADUser Joe Bloggs -City
Set-ADForest London -Remove
To reset the AD Service Account password on the ole -Identity "TESTDC" -
@{otherMailbox="Joe.Bloggs"} -Add
local computer: OperationMasterRole
@{url="test.local"} -Replace
PDCEmulator,SchemaMaster
Reset-ADServiceAccountPassword - @{title="manager"} -Clear
Identity 'Service1' description
 Active Directory PowerShell Quick Reference Active Directory PowerShell Quick Reference

Password Policies Group Tasks User Account Security Computer Account Tasks
To see the Default Domain Password Policy: To see group details:
To disable a user account: To see computer account details:
Get-ADDefaultDomainPasswordPolicy Get-ADGroup -Identity 'Sales Disable-ADAccount -Identity Get-ADComputer -Filter 'Name -
-Identity test.local Users' JoeBloggs like "Server01"'
To change the properties of the Default Domain To create a new group: To create a new computer account:
To enable a user account:
Password Policy:
New-ADGroup -Name "Sales Users" - Enable-ADAccount -Identity New-ADComputer -Name "Server01" -
Set-ADDefaultDomainPasswordPolicy SamAccountName "Server01" -Path
SamAccountName SalesUsers - JoeBloggs
-Identity test.local - "OU=Computers,OU=Resources,DC=tes
GroupCategory Security -
LockoutDuration 00:40:00 - To set the expiration date for a user account: t,DC=local" -Enabled $true -
GroupScope Global -DisplayName
LockoutObservationWindow 00:20:00 Location "London"
‘Sales Users’ -Path
-MaxPasswordAge 10.00:00:00 - Set-ADAccountExpiration -Identity
"OU=Groups,OU=Resources,DC=test,D
MinPasswordLength 8 JoeBloggs -DateTime "10/18/2008" To remove a computer account:
C=local" -Description "All Sales
To create a new Fine-Grained Password Policy: Users"
To clear the expiration date for a user account: Remove-ADComputer -Identity
"Server01" -Confirm:$false
New-ADFineGrainedPasswordPolicy - To change the properties of a group:
Clear-ADAccountExpiration -
Name "Standard Users PSO" - Identity JoeBloggs
Precedence 500 -ComplexityEnabled Set-ADGroup -Identity
$true -Description "Standard 'SalesUsers' -GroupCategory Organisational Unit Tasks
To change the password for a user account:
Users Password Policy" - Distribution -GroupScope
To see OU details:
DisplayName "Standard Users PSO" Universal -ManagedBy 'JoeBloggs' Set-ADAccountPassword -Identity
-LockoutDuration "0.12:00:00" - -Clear Description JoeBloggs -Reset -NewPassword Get-ADOrganizationalUnit -
LockoutObservationWindow (ConvertTo-SecureString - Identity
To remove a group: AsPlainText "p@ssw0rd" -Force)
"0.00:15:00" -LockoutThreshold 10 'OU=Users,OU=Sales,DC=test,DC=loc
al'
To see all Fine-Grained Password Policies: Remove-ADGroup -Identity To unlock a user account:
'SalesUsers' -Confirm:$false To create a new OU:
Get-ADFineGrainedPasswordPolicy - Unlock-ADAccount -Identity
Filter {name -like "*"} To see group members: JoeBloggs New-ADOrganizationalUnit -Name
Users -Path
To apply a Fine-Grained Password Policy to a group Get-ADGroupMember -Identity 'OU=Marketing,DC=test,DC=local'
of users: 'SalesUsers' -Recursive
Add- To add group members:
ADFineGrainedPasswordPolicySubjec
t 'Standard Users PSO' -Subjects Add-ADGroupMember -Identity How to Get More Information
'Standard Users' 'SalesUsers' -Members
Check out the AD PowerShell Blog
JoeBloggs,SarahJane
To see which users have been applied to a Fine-
Grained Password Policy: http://blogs.msdn.com/adpowershell/default.aspx
To remove group members:
Make sure you visit the following sites for PowerShell Podcasts
Get- For the latest version of this doc check
ADFineGrainedPasswordPolicySubjec Remove-ADGroupMember -Identity
http://get-scripting.blogspot.com/
t -Identity 'Standard Users PSO' 'SalesUsers' -Members http://powerscripting.net/ http://jonathanmedd.net
JoeBloggs,SarahJane v0.1