Active Directory

Managing Active Directory Domain Services with the PowerShell ActiveDirectory module, plus the classic dcdiag, repadmin and ntdsutil tools for domain controller health. Run from a domain-joined machine with RSAT or on a domain controller, in an elevated PowerShell (PowerShell Cheat-Sheet). Related: Group Policy, Windows DNS Server, Windows Networking, PowerShell Remote Access.

Documentation: ActiveDirectory module

Setup #

Users #

Password Reset #

Set-ADAccountPassword -Identity <SAM> -Reset -NewPassword (Read-Host -AsSecureString "New password")
Set-ADUser -Identity <SAM> -ChangePasswordAtLogon $true
Unlock-ADAccount -Identity <SAM>

Resetting a password needs the “Reset password” permission on the object. Do not put real passwords in scripts or history.

Groups #

Group scope rule of thumb: put users in Global groups, global groups in Domain Local groups, and grant resource permissions to the domain local group.

OUs #

Computers #

Filters #

-Filter uses PowerShell-style expressions evaluated on the DC (fast). -LDAPFilter takes raw LDAP syntax. Piping to Where-Object filters on the client (slow for large directories).

Request only the properties you need with -Properties; -Properties * is slow on big result sets.

Common Reports #

# Users and their last logon, export to CSV
Get-ADUser -Filter 'Enabled -eq $true' -Properties LastLogonDate,PasswordLastSet |
  Select-Object Name,SamAccountName,LastLogonDate,PasswordLastSet |
  Sort-Object LastLogonDate |
  Export-Csv .\users.csv -NoTypeInformation

# Empty groups
Get-ADGroup -Filter * | Where-Object { -not (Get-ADGroupMember $_) } | Select Name

# Recently changed objects (last 24h)
Get-ADObject -Filter 'whenChanged -ge $d' -Properties whenChanged

DC Health: dcdiag #

Run on or against a domain controller (/s:<DC>). Output marks each test passed or failed.

Replication: repadmin #

PowerShell equivalents: Get-ADReplicationFailure, Get-ADReplicationPartnerMetadata, Sync-ADObject.

FSMO Roles #

There are five single-master roles: Schema Master and Domain Naming Master (per forest) and PDC Emulator, RID Master and Infrastructure Master (per domain).

Transfer if the current holder is online. Seize only when it is permanently lost and never bring it back online afterwards (clean its metadata and rebuild). Also check ntdsutil (roles, connections, seize ...) if the PowerShell cmdlet cannot reach a DC.

Authentication and Time #

Lockouts #

# Which DC has the lockout, and who is locked
Search-ADAccount -LockedOut | Select Name,LockedOut
# Find the source in the PDC emulator's Security log (event 4740)
$pdc = (Get-ADDomain).PDCEmulator
Get-WinEvent -ComputerName $pdc -FilterHashtable @{LogName='Security'; Id=4740} -MaxEvents 20 |
  Select TimeCreated, @{n='User';e={$_.Properties[0].Value}}, @{n='Source';e={$_.Properties[1].Value}}

More event queries in Windows Troubleshooting.

Backup and Recovery #

Test restores before you need them. Authoritative restores of deleted objects need DSRM and ntdsutil.

Not Verified #

Commands were written from the Microsoft documentation and not executed against a live domain. Run destructive ones (Remove-*, role seizure) only in a lab first.