Active Directory Skill

When to Activate

• User mentions: AD, Active Directory, user account, group membership, domain, OU, GPO
• User asks to find/create/modify AD objects
• User needs to check group memberships or locked accounts

Prerequisites Check

# Verify AD module is available
if (-not (Get-Module -ListAvailable ActiveDirectory)) {
    Write-Warning "ActiveDirectory module not installed. Install RSAT or run on a DC."
    # Alternative: Use ADSI queries
}
Import-Module ActiveDirectory -ErrorAction SilentlyContinue

Common Queries

Find User

# By name (partial match)
Get-ADUser -Filter "Name -like '*$searchTerm*'" -Properties DisplayName, EmailAddress, Enabled, LastLogonDate |
Select-Object SamAccountName, DisplayName, EmailAddress, Enabled, LastLogonDate

# By email
Get-ADUser -Filter "EmailAddress -eq '$email'" -Properties *

Check Account Status

$user = Get-ADUser -Identity $username -Properties LockedOut, Enabled, PasswordExpired, LastLogonDate, PasswordLastSet
[PSCustomObject]@{
    User = $user.SamAccountName
    Enabled = $user.Enabled
    Locked = $user.LockedOut
    PasswordExpired = $user.PasswordExpired
    LastLogon = $user.LastLogonDate
    PasswordAge = (New-TimeSpan -Start $user.PasswordLastSet).Days
}

Unlock Account

Unlock-ADAccount -Identity $username
# Verify
(Get-ADUser -Identity $username -Properties LockedOut).LockedOut

Group Membership

# User's groups
Get-ADPrincipalGroupMembership -Identity $username | Select-Object Name, GroupCategory

# Group's members
Get-ADGroupMember -Identity $groupName | Select-Object Name, ObjectClass

Find Inactive Accounts

# Users not logged in for 90 days
$cutoff = (Get-Date).AddDays(-90)
Get-ADUser -Filter {LastLogonDate -lt $cutoff -and Enabled -eq $true} -Properties LastLogonDate |
Select-Object SamAccountName, LastLogonDate | Sort-Object LastLogonDate

Computer Objects

# Find computer
Get-ADComputer -Filter "Name -like '*$hostname*'" -Properties OperatingSystem, LastLogonDate |
Select-Object Name, OperatingSystem, LastLogonDate, Enabled

# Stale computers (90 days)
Get-ADComputer -Filter {LastLogonDate -lt $cutoff} -Properties LastLogonDate |
Select-Object Name, LastLogonDate

OU Structure

# List OUs
Get-ADOrganizationalUnit -Filter * | Select-Object Name, DistinguishedName

# Objects in specific OU
Get-ADUser -SearchBase "OU=Sales,DC=contoso,DC=com" -Filter *

GPO Status

# Applied GPOs
gpresult /r

# Detailed GPO report
gpresult /h "$env:TEMP\gpo-report.html"

ADSI Fallback (No Module Required)

# Find user via ADSI
$searcher = [adsisearcher]"(samaccountname=$username)"
$searcher.FindOne().Properties

# Find all users in domain
$searcher = [adsisearcher]"(&(objectCategory=person)(objectClass=user))"
$searcher.FindAll() | ForEach-Object { $_.Properties.samaccountname }

Safety Notes

• ⚠️ Always confirm before modifying AD objects
• ⚠️ Use -WhatIf for destructive operations
• ⚠️ Document changes for audit compliance