PowerShell Active Directory

Active Directory (AD) is Microsoft's directory service that stores information about users, computers, groups, and resources in a network. PowerShell's Active Directory module lets administrators create, read, update, and delete AD objects without clicking through the GUI — turning hours of manual work into a script that runs in seconds.

What Is Active Directory?

+----------------------------------+
|         Active Directory         |
|                                  |
|  Users      → Alice, Bob, Carol  |
|  Groups     → HR, IT, Finance    |
|  Computers  → PC-01, SERVER02    |
|  OUs        → Sales, Marketing   |
|  Policies   → Password rules     |
+----------------------------------+
         |
         | PowerShell talks to AD
         | using the AD Module
         v
+----------------------------------+
|  Import-Module ActiveDirectory   |
|  (connects to Domain Controller) |
+----------------------------------+

Installing the Active Directory Module

# On Windows Server — already available via RSAT
Import-Module ActiveDirectory

# On Windows 10/11 — install RSAT tools first
Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

# Verify the module loaded
Get-Module ActiveDirectory

Working with Users

Get a Single User

# Get basic info
Get-ADUser -Identity "alice.smith"

# Get all properties
Get-ADUser -Identity "alice.smith" -Properties *

# Get specific properties
Get-ADUser -Identity "alice.smith" -Properties Department, Title, Manager, LastLogonDate |
    Select-Object Name, Department, Title, LastLogonDate

Search for Users

# Find all users in a specific department
Get-ADUser -Filter {Department -eq "Sales"} -Properties Department |
    Select-Object Name, Department

# Find users whose accounts are disabled
Get-ADUser -Filter {Enabled -eq $false} | Select-Object Name, SamAccountName

# Find users who have not logged in for 90 days
$cutoffDate = (Get-Date).AddDays(-90)
Get-ADUser -Filter {LastLogonDate -lt $cutoffDate -and Enabled -eq $true} `
    -Properties LastLogonDate |
    Select-Object Name, LastLogonDate |
    Sort-Object LastLogonDate

Create a New User

New-ADUser `
    -Name "John Carter" `
    -GivenName "John" `
    -Surname "Carter" `
    -SamAccountName "john.carter" `
    -UserPrincipalName "john.carter@company.com" `
    -Path "OU=Sales,DC=company,DC=com" `
    -Department "Sales" `
    -Title "Sales Executive" `
    -AccountPassword (ConvertTo-SecureString "P@ssword123!" -AsPlainText -Force) `
    -Enabled $true

Write-Output "User john.carter created successfully."

Update User Properties

# Change a user's department and title
Set-ADUser -Identity "john.carter" `
    -Department "Marketing" `
    -Title "Marketing Manager"

# Update the phone number
Set-ADUser -Identity "alice.smith" -OfficePhone "+1-555-0199"

# Unlock a locked account
Unlock-ADAccount -Identity "alice.smith"

# Reset a password
Set-ADAccountPassword -Identity "alice.smith" `
    -NewPassword (ConvertTo-SecureString "NewP@ss456!" -AsPlainText -Force) `
    -Reset

# Force user to change password at next login
Set-ADUser -Identity "alice.smith" -ChangePasswordAtLogon $true

Disable and Enable Accounts

# Disable an account (employee on leave)
Disable-ADAccount -Identity "bob.jones"

# Enable it again
Enable-ADAccount -Identity "bob.jones"

Delete a User

Remove-ADUser -Identity "john.carter" -Confirm:$false

Working with Groups

# List all groups
Get-ADGroup -Filter *

# Get members of a group
Get-ADGroupMember -Identity "IT-Admins" | Select-Object Name, SamAccountName

# Add a user to a group
Add-ADGroupMember -Identity "IT-Admins" -Members "alice.smith"

# Add multiple users at once
Add-ADGroupMember -Identity "Sales-Team" -Members "john.carter","carol.white","tom.black"

# Remove a user from a group
Remove-ADGroupMember -Identity "IT-Admins" -Members "alice.smith" -Confirm:$false

# Create a new group
New-ADGroup `
    -Name "DevOps-Engineers" `
    -GroupScope Global `
    -GroupCategory Security `
    -Path "OU=Groups,DC=company,DC=com" `
    -Description "DevOps engineering team"

Working with Computers

# List all computers in the domain
Get-ADComputer -Filter * | Select-Object Name, OperatingSystem

# Find computers running Windows 11
Get-ADComputer -Filter {OperatingSystem -like "*Windows 11*"} `
    -Properties OperatingSystem |
    Select-Object Name, OperatingSystem

# Find computers that have not connected in 60 days
$cutoff = (Get-Date).AddDays(-60)
Get-ADComputer -Filter {LastLogonDate -lt $cutoff} -Properties LastLogonDate |
    Select-Object Name, LastLogonDate

Working with Organizational Units (OUs)

# List all OUs
Get-ADOrganizationalUnit -Filter * | Select-Object Name, DistinguishedName

# Create a new OU
New-ADOrganizationalUnit -Name "Contractors" `
    -Path "DC=company,DC=com" `
    -Description "Temporary contractor accounts"

# Move a user to a different OU
Move-ADObject `
    -Identity "CN=John Carter,OU=Sales,DC=company,DC=com" `
    -TargetPath "OU=Marketing,DC=company,DC=com"

Active Directory Object Hierarchy

Domain: company.com  (DC=company,DC=com)
│
├── OU=Sales
│   ├── User: alice.smith
│   └── User: bob.jones
│
├── OU=IT
│   ├── User: carol.white
│   └── Computer: SERVER01
│
├── OU=Groups
│   ├── Group: Sales-Team
│   └── Group: IT-Admins
│
└── OU=Contractors
    └── User: temp.worker

Bulk Operations — Real Power of PowerShell

Create 50 Users from a CSV File

# CSV format: Name,GivenName,Surname,SamAccountName,Department
Import-Csv "C:\NewUsers.csv" | ForEach-Object {
    New-ADUser `
        -Name $_.Name `
        -GivenName $_.GivenName `
        -Surname $_.Surname `
        -SamAccountName $_.SamAccountName `
        -UserPrincipalName "$($_.SamAccountName)@company.com" `
        -Path "OU=Staff,DC=company,DC=com" `
        -Department $_.Department `
        -AccountPassword (ConvertTo-SecureString "Welcome@123" -AsPlainText -Force) `
        -Enabled $true `
        -ChangePasswordAtLogon $true

    Write-Output "Created: $($_.Name)"
}

Disable All Accounts in a List

$toDisable = @("alice.smith","bob.jones","temp.worker")
$toDisable | ForEach-Object {
    Disable-ADAccount -Identity $_
    Write-Output "Disabled: $_"
}

Generate a User Report

# Export all active users with their details to CSV
Get-ADUser -Filter {Enabled -eq $true} `
    -Properties Department, Title, LastLogonDate, EmailAddress |
    Select-Object Name, SamAccountName, Department, Title, LastLogonDate, EmailAddress |
    Sort-Object Name |
    Export-Csv "C:\Reports\ActiveUsers.csv" -NoTypeInformation

Write-Output "Report saved to C:\Reports\ActiveUsers.csv"

Summary

The PowerShell Active Directory module turns complex directory management into simple, repeatable commands. Whether creating a single user, bulk-importing hundreds of accounts from CSV, managing group memberships, or generating audit reports, AD cmdlets handle it all. Scripts replace hours of GUI clicking with seconds of automation — making PowerShell an essential skill for any Windows system administrator.