Twelve everyday Active Directory PowerShell commands

Before you start

Use a domain-connected Windows administration machine with the Active Directory module installed through the appropriate RSAT feature, or a server where the AD management tools are available. Windows PowerShell 5.1 is a useful baseline for these examples. Check compatibility separately if you use another PowerShell version.

Your account needs permission to perform the operation in the target OU. Running an elevated shell does not grant directory rights that your account does not already hold. Read operations and delegated administration often do not require Domain Admin membership.

Import-Module ActiveDirectory
Get-Module ActiveDirectory
Get-ADDomain | Select-Object DNSRoot, DistinguishedName

The final command should show the domain you intend to administer. If you work with several forests or domains, specify the appropriate domain controller using -Server rather than relying on the default connection.

Check the OU path before creating anything:

Get-ADOrganizationalUnit -Identity 'OU=Sales,DC=ad,DC=example,DC=com'

If this lookup fails, resolve the path or connection first. The examples below use a fictitious user, Tom Smith, and should be adapted to a test OU before production use.

1. Create a user account

Specify the destination OU, UPN, password and account state explicitly. Read the initial password securely instead of placing a reusable password in the script.

$password = Read-Host 'Enter the initial password' -AsSecureString
$user = @{
    Name                  = 'Tom Smith'
    GivenName             = 'Tom'
    Surname               = 'Smith'
    SamAccountName        = 'TSmith'
    UserPrincipalName     = 'TSmith@ad.example.com'
    DisplayName           = 'Tom Smith'
    Path                  = 'OU=Sales,DC=ad,DC=example,DC=com'
    Description           = 'Sales team test account'
    AccountPassword       = $password
    Enabled               = $true
    ChangePasswordAtLogon = $true
}
New-ADUser @user -WhatIf
# After checking the preview and approving the change:
# New-ADUser @user

-WhatIf previews the intended operation; it does not prove that the password meets policy or that every dependency is valid. Remove it only when you are ready to create the account. After creation, inspect the account with Get-ADUser and confirm its location and enabled state.

2. Create a security group

The following example creates a global security group for users from the same domain. Choose the group scope according to your access model; a global group is not a universal answer to cross-domain access.

$group = @{
    Name           = 'Sales Team'
    SamAccountName = 'SalesTeam'
    GroupCategory  = 'Security'
    GroupScope     = 'Global'
    Path           = 'OU=Groups,DC=ad,DC=example,DC=com'
    Description    = 'Sales team access group'
}
New-ADGroup @group -WhatIf

Preview first, then run without -WhatIf when approved. Verify with Get-ADGroup -Identity 'SalesTeam'.

3. Pre-stage a computer object

Creating a computer object prepares a directory record. It does not itself join the device to the domain or install software.

$computer = @{
    Name           = 'SALES-PC01'
    SamAccountName = 'SALES-PC01$'
    Path           = 'OU=Computers,DC=ad,DC=example,DC=com'
    Description    = 'Sales test workstation'
}
New-ADComputer @computer -WhatIf

Use the intended naming convention and check delegated permissions for the eventual domain join separately.

4. Create an organisational unit

An OU can hold objects and be used for delegation or Group Policy. Think about those dependencies before adding it to the directory structure.

$ou = @{
    Name                            = 'Pilot'
    Path                            = 'DC=ad,DC=example,DC=com'
    ProtectedFromAccidentalDeletion = $true
}
New-ADOrganizationalUnit @ou -WhatIf

5. Add or remove group members

Confirm the group and account identities before changing access. A membership change can affect resource access, but a user’s existing logon token may not immediately reflect it.

Get-ADGroup -Identity 'SalesTeam'
Get-ADUser -Identity 'TSmith'
Add-ADGroupMember -Identity 'SalesTeam' -Members 'TSmith' -WhatIf
Remove-ADGroupMember -Identity 'SalesTeam' -Members 'TSmith' -WhatIf

These are alternatives, not a sequence to execute together. Run the appropriate operation without -WhatIf when ready, then inspect the group’s members. Keep a record of the previous membership so that the change can be reversed if necessary.

6. Read user properties

Ask for the properties you need. Requesting everything is useful occasionally, but makes larger reports harder to read and can increase the work performed.

Get-ADUser -Identity 'TSmith' -Properties Department, PasswordNeverExpires |
    Select-Object Name, UserPrincipalName, Enabled, Department,
        PasswordNeverExpires, DistinguishedName

7. Read computer properties

Get-ADComputer -Identity 'SALES-PC01' -Properties OperatingSystem, OperatingSystemVersion |
    Select-Object Name, Enabled, OperatingSystem, OperatingSystemVersion, DistinguishedName

The OS fields are directory attributes, not a live inventory query against the computer.

8. Read group properties

Get-ADGroup -Identity 'SalesTeam' -Properties Description, ManagedBy |
    Select-Object Name, GroupCategory, GroupScope, Description, ManagedBy

9. List group members

Get-ADGroupMember -Identity 'SalesTeam' |
    Select-Object Name, SamAccountName, ObjectClass

This returns direct members. For nested membership, use -Recursive and interpret the result carefully: it is not a full audit of every effective permission a person has.

10. Update a user attribute

Record the current value before replacing it. Forcing a password change is a different action and should not be casually combined with a metadata update.

Get-ADUser -Identity 'TSmith' -Properties Department |
    Select-Object SamAccountName, Department
Set-ADUser -Identity 'TSmith' -Department 'Sales' -WhatIf

After the approved update, run the read command again and confirm the new department. To undo it, restore the previous value; if it was unset, clear the attribute rather than inventing a replacement.

11. Update a computer description

Get-ADComputer -Identity 'SALES-PC01' -Properties Description |
    Select-Object Name, Description
Set-ADComputer -Identity 'SALES-PC01' -Description 'Sales pilot workstation' -WhatIf

A description is useful administrative metadata. Avoid manually editing operating-system attributes to make inventory appear current; investigate the inventory or update process instead.

12. Update a group description

Get-ADGroup -Identity 'SalesTeam' -Properties Description |
    Select-Object Name, Description
Set-ADGroup -Identity 'SalesTeam' -Description 'Sales pilot access group' -WhatIf

Changing a description does not change membership. Scope conversion and ownership changes should be considered separately because they have different constraints and access implications.

Troubleshooting and final checks

For every change, compare the before and after values, retain a record of the affected object, and allow for replication when checking a different domain controller. A successful command is only one part of verifying the result.

References and revision notes

This revision replaces the original command list with explicit scope, safer password entry, previews and post-change checks. It has not been executed against your directory.

• Microsoft Learn: Active Directory PowerShell reference
• Microsoft Learn: New-ADUser