PowerShell is a scripting language developed to simplify administrative and IT operation tasks in systems such as Active Directory, Microsoft Exchange and many other Windows-based systems, reducing time and effort.

PowerShell can integrate with services and applications, helping system administrators control and manage users, groups, computers and servers. In addition, Powershell is ever-evolving, becoming more advanced with every new update adding new features.

Let’s take a look at some of the primary and everyday PowerShell cmdlets that can help simplify and automate the management of Active Directory.

 

Note: Before using the Active Directory cmdlets in Powershell, you must import the Active Directory Module into Powershell, also remembering to run Powershell as an Administrator. You do this by running the following command in Windows Powershell:

Import-Module activedirectory

 

1. Using Powershell to create a “New User Account” in Active Directory

Below we can create a new user account using Powershell. When creating user accounts, a few properties are set by default, which are:

• Accounts created are put into the “Users” container
• Accounts are created in a disabled state
• No password is set on the account
• Users are required to change the password on the first login
• Accounts become a member of the “Domain Users” group

With that in mind, we will create a usable user account by setting a default password and setting it as enabled; below are the attributes used for making the user account:

• Name – Tom Smith
• Given Name – Tom
• Surname – Smith
• Sam Account Name – Tsmith
• Display Name – Tom Smith
• User Principal Name – Tsmith@company.com
• Description – Sales Person
• Path of account location in AD – “OU=Sales, DC=dev, DC=local”
• Account password = L3tMe1nOK
• Status – Enabled

Here is the command we will use to perform the account creation:

New-ADUser -Name “Tom Smith” -GivenName “Tom” -Surname “Smith” -SamAccountName “TSmith” -DisplayName “Tom Smith” -UserPrincipalName “TSmith@company.com” -Description “Sales Person” -Path “OU=Sales,DC=dev,DC=local” -AccountPassword (ConvertTo-SecureString “L3tMe1nOK” -AsPlainText -Force) -Enabled $true

Note: You can also amend the command to request a password during the creation instead of entering into the command; below is the amended command:

New-ADUser -Name “Tom Smith” -GivenName “Tom” -Surname “Smith” -SamAccountName “TSmith” -DisplayName “Tom Smith” -UserPrincipalName “TSmith@company.com” -Description “Sales Person” -Path “OU=Sales,DC=dev,DC=local” -AccountPassword (Read-Host -AsSecureString “Input Password”) -Enabled $true

 

2. Creating Security Groups with Powershell

In this example, we will create a security group in Active Directory with the following attributes:

• Name – Sales Team
• Sam Account Name – SalesTeam
• Group Category – Security (This can also be set to Distribution)
• Group Scope – Global (This can also be set to Universal and DomainLocal)
• Display name – Sales Team
• Description – Access for Sales Team Data
• Path of group location in AD – “OU=Groups, DC=dev, DC=local”

Here is the command that we will use to perform the group creation:

New-ADGroup -Name “Sales Team” -SamAccountName “SalesTeam” -GroupCategory Security -GroupScope Global -DisplayName “Sales Team” -Description “Access for Sales Team Data” -Path “OU=Groups,DC=dev,DC=local”

 

3. Creating a Computer Object using Powershell

This example will show how to create a Computer Object in Active Directory, possibly pre-staging a computer being joined to the domain, with the following attributes:

• Name – TomsComputer (Normally, the asset details go here)
• Sam Account Name – TomsComputer
• Path of computer in AD – “OU= ComputerObjects, DC=dev, DC=local”
• Description – Toms Laptop (You could put a serial number here)

Here is the command we will use to perform the computer object creation:

New-ADComputer -Name “TomsComputer” -SamAccountName “TomsComputer” -Path “OU=ComputerObjects,DC=dev,DC=local” -Description “Toms Laptop”

 

4. Creating new OU with Powershell

This example will show how to create an OU using Powershell with the following attributes:

• Name – Edinburgh
• Path of OU in AD – “DC=dev, DC=local”
• Description – For Edinburgh User Accounts

Here is the command we will use to perform the OU creation:

New-ADOrganizationalUnit -Name “Edinburgh” -Path “DC=dev,DC=local” -Description “For Edinburgh User Accounts”

 

5. Adding/Removing Objects in to or out of Groups

Below is the command to add a user to a group:

Add-ADGroupMember SalesTeam -Members TSmith

Note: The command can also be used to add computer objects to groups

Below is the command to remove a user from a group:

Remove-ADGroupMember SalesTeam -Members Tsmith

Once you run the command, you will be asked to confirm if you are sure to perform this action:

Note: The command can also be used to remove computer objects from groups

 

6. Getting information of a user account using Powershell

Below is the command to get information about an AD user. The command has many different options to get, filter and save information. The example command shows basic usage, returning all attributes on the user account:

Get-ADUser Tsmith -Properties *

If you want to filter on specific attributes, you can use this:

Get-ADUser -Identity Tsmith -Properties * | select DisplayName, GivenName, Surname, Enabled, PasswordNeverExpires

 

7. Getting information of a computer object using Powershell

Below is the command to get information about a computer object. The command has many different options to return information of the computer object. The example command shows basic usage, returning all attributes on the computer object:

Get-ADComputer -Identity tomscomputer -Properties *

If you want to filter on specific attributes, you can use this:

Get-ADComputer -Identity tomscomputer -Properties * | select Name, Operatingsystem, Operatingsystemversion, Description

 

8. Getting information of a group using Powershell

Below is the command to get information about a group. The command has many different options to return information of a group. The example command shows basic usage, returning all attributes of the group:

Get-ADGroup -Identity salesteam -Properties *

If you want to filter on specific attributes, you can use this:

Get-ADGroup -Identity salesteam -Properties * | select Name, GroupCategory, GroupScope

 

9. Getting information on the members of a group using Powershell

Below is a simple command that allows you to get a list of members of a group:

Get-ADGroupMember -Identity salesteam

You can also select to show only specific attributes of the members by using this command:

Get-ADGroupMember -Identity salesteam | select name

 

10. Setting or applying new attributes on user account with Powershell

The command below will allow you to add extra information to a user account, such as adding a department, company, address or even forcing a user to change password at the next login:

Set-ADUser -Identity tsmith -Department Sales -Company “Mega Sales” -ChangePasswordAtLogon $true

 

11. Setting or applying new attributes on a computer object with Powershell

The command below will allow you to make changes or add extra information to a computer object, such as adding an operating system name, version or even a location:

Set-ADComputer -Identity tomscomputer -OperatingSystem “Windows 10 Pro”  -OperatingSystemVersion “10.0 (18363)”

 

12. Setting or applying new attributes on a group with Powershell

The command below will allow you to make changes or add extra information to a group, such as adding a description, changing group scope from a global group to a universal group or adding someone to manage the group:

Set-ADGroup -Identity salesteam -Description “Access for Sales Team Data” -GroupScope Universal -ManagedBy fblog

 

Conclusion

To conclude, these twelve PowerShell commands should help improve your Active Directory environment’s basic management and support. I hope this article has helped you understand how Powershell can help speed up some basic tasks.