![\"\"](\"/images/content/5b6/8d27592a3a4e65d8b4599/1200_-424-)
Active Directory and PowerShell together offer a powerful set of cmdlets to manage and automate standard domain-related tasks. Here are the most useful cmds.
\nIn this article we'll look at some of the basics of working with Active Directory groups and accounts using PowerShell. You'll learn how to add accounts, delete them and edit their group memberships. We'll also go over how to search around and discover information about those accounts and about the domain itself.
But first, let's start with how to create a test domain to play around with using PowerShell 5 and its default access to the PowerShell Gallery and Desired State Configuration (DSC) resources. This is to ensure that we're playing in a safe environment.
Don't worry, these steps are super easy thanks to DSC and the PowerShell Gallery. Start by creating a Windows Server 2012 R2 virtual machine (VM). We'll create ours in Azure, but you can decide where to create yours. Azure makes it easy to isolate VMs into individual networks and not run the risk of doing something on a production network that could make people cranky.
\r\nIf you're running PowerShell 5 you get access to the PowerShell Gallery by default. If you aren't running Powershell 5 yet, go ahead and download it for your VM from this Microsoft Download Center page. Once it's installed, execute the script below to install the xActiveDirectory module.
\r\n| Install-Module xActiveDirectory | \r\n
After the module is installed, you can use the script from this excellent blog post by Ashley McGlone on how to set up a new Domain Controller from scratch with a single script. Don't forget to tweak the drive letters to match your current environment, and set the domain name to one that you want to use. I changed mine to ADTestDomain.com just because AdamTheAutomator.com is too long for a NetBios name.
\r\nYour computer will restart, and when it comes back you will be able to log in with the same username and password you did before. The difference is that this account is now a domain account, not a machine account.
\r\nTo start with, let's get some basic information about our new domain by executing the Get-AdDomain cmdlet.
\r\nOne of the interesting things we can see in this screen is the DomainMode. The DomainMode has a big influence on some features that will be available, like whether you can use the latest version of Managed Service Accounts. If you didn't set up the domain you're looking around in, it's handy to be able to get this information easily.
\r\nPowerShell will tell you anything you want to know about a domain, and to get an idea of what's available we can use the Get-Command cmdlet to show us all of the cmdlets that use the Get verb.
\r\nThere are 43 Active Directory Get cmdlets in the module, so as you can see you can get a lot of information. One of the first things we are usually going to want to find is information about users. Let's use Get-ADUser to find one.
\r\nUh oh. We've already run into something unexpected. This is an easy fix though. If you think about it, in most domains, we don't really want to return every single user in a domain, so Get-ADUSer always requires some sort of filter whenever you use it. Let's try again.
\r\nWe can either call Get-ADUser and give it a single user name, or provide a filter to find multiple accounts. Either one will work, but I'll use the filter syntax just so we can see what that looks like.
\r\nThe filter parameter can target any of the properties you see in that list and will use some of the standard PowerShell comparison operators against the value you enter for the second part of the filter. I say some because not all comparison operators are supported by the –Filter parameter. To see what I mean, execute the following script for a detailed description.
\r\n| Get-Help Get-ADUser –Parameter filter | \r\n
The properties you see here are in fact only a few of the properties of this object type. If you add the -Properties * parameter you can get a full listing of available properties.
Now that we've seen the filter syntax, you don't always have to type out an entire filter to find a user. You could just call Get-ADUserabertram if you know the specific user you want to look at.
The next thing we might want to find would be groups. Getting groups is just as easy as finding users if you use Get-ADGroup, so let's look at finding a user's group membership instead.
The cmdlet for finding those uses a slightly different name; it's called Get-ADPrincipalGroupMembership. The cmdlet refers to an AD Principal instead of a User because you could be talking about computers just as easily as users. To illustrate, we will find the group memberships of the current computer.
To add users to the domain it's easy to use the New-ADUser cmdlet, but let's take advantage of PowerShell's ability to automate things and create lots of users at once and set some properties as well.
\r\nFirst, we'll create a few security groups so we can add the users to them later using the one liner in the screenshot below.
\r\nNow we'll add some users with the next script.
\r\nAs you can see, if we had something like a csv file with users and the groups we wanted to add them to, we could add a lot of users very fast. I did forget something though. If you don't explicitly mark accounts as enabled when you create them, then by default they are disabled.
We will need to use the Set-ADUser cmdlet to enable them, but there's no need to do that one by one. Use a script like the one below to find them and pipe them to Set-ADUser and get them all enabled at once.
That script will get all six of the users we just created and enable them. In a mature domain with lots and lots of users, this kind of filtering and pipelining is a lifesaver, and can make you look like a wizard to your non-PowerShell coworkers.
\r\nThe last part of the script we used to create our users also added them to security groups. The script didn't return any output so we should check to confirm that it worked the way we expected it to. Use the script below to find one of the groups we thought we were adding users into and make sure it has the users we expect.
\r\nTo practice disabling accounts let's assume that we know there is some unusual activity happening on the network associated with one of the QA accounts. We can disable accounts one at a time or in groups using the pipeline. Both are shown below.
\r\nNow we'll say that it's a few weeks later, and after an investigation Alan is cleared of all charges, but Grace is let go. What we need to do now is delete Grace's account, and re-enable Alan's.
\r\nTo delete an account we simply use Remove-ADUser and specify the account. Needless to say that if you have lots of accounts to delete this could be powerful, but use caution and make sure you have backups. The script below shows how to delete a single account.
\r\n| Remove-ADUserGhopperQA | \r\n
Next, we can re-enable Alan's account we just use the Enable-ADAccount cmdlet.
\r\n| Enable-ADAccountATuringQA | \r\n
To practice removing group members let's say we found that our method of adding users to groups was wrong. It's not hard to imagine. We just added every user to every group. The first group we want to fix is the administrators group.
\r\nWe can remove users one at a time by targeting them individually as shown below.
\r\n| Remove-ADGroupMember -Identity testAdministrators -Members ATuringTest | \r\n
That works for a few at a time, but this could easily happen to lots of users, and you don't want to remove them each by hand. Instead if we can articulate some blanket statement like \"users from either Dev or Test should not be admins, only QA department accounts\" then we can express that as a script like the one below.
\r\nThat script will work but you might notice and wonder why we didn't just pipe the results of the Get-ADUser command directly to Remove-ADGroupMember. The answer has to do with which parameters for that cmdlet will take pipeline input and which ones won't.
If we look at the help information for the cmdlet using Get-Help we will see that the –Members parameter doesn't accept pipeline input, or wildcards for filtering either.
The solution is found in the same Get-Help output where we see that it will accept an array of ADPrinciple Objects as denoted by the [TypeName[]] notation for its input type.
You can also get this little hint by using your arrow keys to get down to the –Members parameter while the Intellisense menu is up, and the tooltip will give you the input type information just like the screenshot below.
So after all of the shuffling around of users and deleting and adding group memberships, we can check to see who's in what groups by invoking the Get-ADPrincipalGroupMemberships one at a time like this.
\r\n| Get-ADPrincipalGroupMembership -Identity ghoppertest | \r\n
Since one at a timing user accounts isn't great, we could also get a bunch of account memberships at once.
\r\nThe problem, as you can see from the output above, is that if we use the pipeline to do this, our output only knows about the groups that are returned by Get-ADPrincipalGroupMemberships, and nothing about which account it's dealing with.
The result is a list of groups with no information about which user caused that group to show up in the listing. For example, TestAdministrators shows up in the listing above only once, but the listing on its own doesn't show us which user is a member of that group, only that there is only one member. To fix that, we can generate a kind of report using the script below.
Now that you're familiar with the basics, check out some of the more advanced topics dealing with Active Directory and PowerShell. You can start with this article on the Hey, Scripting Guy! Blog, which is all about the Active Directory Schema and how to manage it with PowerShell.
\n","docType":"article","guid":"articles_7a45eb7e619fdfd12fb096d24c7e61fa","lastModified":"2018-09-04T08:00:00.000Z","published":"2018-09-04T08:00:00.000Z","structuredData":null,"subtitle":"Administering Active Directory is one of the most critical roles in any Windows network.","template":"v1","title":"Essential PowerShell Cmdlets For Managing Active Directory","type":"article","author":{"avatar":null,"bio":"Adam Bertram is a 20-year veteran of IT and experienced online business professional. He's an entrepreneur, IT influencer, Microsoft MVP, blogger, trainer and content marketing writer for multiple technology companies. Adam is also the founder of the popular IT career development platform TechSnips. Catch up on Adam's articles at adamtheautomator.com, connect on LinkedIn, or follow him on Twitter at @adbertram or the TechSnips Twitter account at @techsnips_io.","name":"Adam Bertram","image":null,"slug":null,"social":{"facebook":"","linkedin":"https://www.linkedin.com/in/adambertram/","twitter":"https://twitter.com/adbertram","website":"https://www.adamtheautomator.com/"},"status":"enabled","title":null,"type":"Contributing Writer","user":{"imagePath":"https://staging.business.com/images/undefined","profile":{"company":"eGain Communications","jobTitle":"Product Management Analyst","website":""}}},"breadcrumbs":null,"channels":{"primary":{"name":"Technology","slug":"technology"},"sub":{"name":"Technology Solutions","slug":"technology-solutions"}},"meta":{"robots":"index, follow","description":"Active Directory and PowerShell together offer a powerful set of cmdlets to manage and automate standard domain related tasks.","title":"Essential PowerShell Cmdlets For Managing Active Direct - business.com"},"parsedContent":{"toc":[{"id":"how-to-create-a-test-domain","title":"How to create a test domain"},{"id":"exploring-a-domain-with-powershell","title":"Exploring a domain with PowerShell"},{"id":"creating-and-working-with-users","title":"Creating and working with users"}],"json":[{"component":"p","children":["Active Directory and PowerShell together offer a powerful set of cmdlets to manage and automate standard domain-related tasks. Here are the most useful cmds."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":["Administering Active Directory is one of the most critical roles in any Windows network, and it doesn't take long before the number of servers, client computers, and users gets very large. In that kind of environment you're going to rely on automation to get your job done efficiently. PowerShell has the tools you need to get the job done, but you need to understand the basics of how to use them first."]},{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/8d1fd1039ebd9798b456b/1200_-900- 1200w, /images/content/5b6/8d1fd1039ebd9798b456b/668_-501- 668w, /images/content/5b6/8d1fd1039ebd9798b456b/320_-240- 320w","sizes":"668px, 100%"}}]}]},{"component":"p","children":["In this article we'll look at some of the basics of working with Active Directory groups and accounts using PowerShell. You'll learn how to add accounts, delete them and edit their group memberships. We'll also go over how to search around and discover information about those accounts and about the domain itself. ",{"component":"br"},{"component":"br"},"But first, let's start with how to create a test domain to play around with using PowerShell 5 and its default access to the PowerShell Gallery and Desired State Configuration (DSC) resources. This is to ensure that we're playing in a safe environment. "]},{"component":"h2","props":{"id":"how-to-create-a-test-domain"},"children":["How to create a test domain"]},{"component":"p","children":["Don't worry, these steps are super easy thanks to DSC and the PowerShell Gallery. Start by creating a Windows Server 2012 R2 virtual machine (VM). We'll create ours in Azure, but you can decide where to create yours. Azure makes it easy to isolate VMs into individual networks and not run the risk of doing something on a production network that could make people cranky."]},{"component":"p","children":["If you're running PowerShell 5 you get access to the PowerShell Gallery by default. If you aren't running Powershell 5 yet, go ahead and download it for your VM from this ",{"component":"a","props":{"href":"https://www.microsoft.com/en-us/download/details.aspx?id=50395","target":"_blank"},"children":["Microsoft Download Center page"]},". Once it's installed, execute the script below to install the ",{"component":"strong","children":["xActiveDirectory module"]},"."]},{"component":"table","props":{"className":"editorTblTable editorTblSize100 editorTblStyleStyle1"},"children":[{"component":"tbody","children":[{"component":"tr","children":[{"component":"td","children":["Install-Module xActiveDirectory"]}]}]}]},{"component":"p","children":["After the module is installed, you can use the script from this excellent ",{"component":"a","props":{"href":"https://blogs.technet.microsoft.com/ashleymcglone/2015/03/20/deploy-active-directory-with-powershell-dsc-a-k-a-dsc-promo/","target":"_blank"},"children":["blog post by Ashley McGlone"]}," on how to set up a new Domain Controller from scratch with a single script. Don't forget to tweak the drive letters to match your current environment, and set the domain name to one that you want to use. I changed mine to ADTestDomain.com just because AdamTheAutomator.com is too long for a NetBios name."]},{"component":"p","children":["Your computer will restart, and when it comes back you will be able to log in with the same username and password you did before. The difference is that this account is now a domain account, not a machine account."]},{"component":"h2","props":{"id":"exploring-a-domain-with-powershell"},"children":["Exploring a domain with PowerShell"]},{"component":"p","children":["To start with, let's get some basic information about our new domain by executing the ",{"component":"strong","children":["Get-AdDomain"]}," cmdlet."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/8d27592a3a4e65d8b4599/1200_-424- 1200w, /images/content/5b6/8d27592a3a4e65d8b4599/668_-236- 668w, /images/content/5b6/8d27592a3a4e65d8b4599/320_-113- 320w","sizes":"668px, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/8d27592a3a4e65d8b4599/1193-422-","alt":"","width":"1193","height":"422","data-content-img-id":"5b68d27592a3a4e65d8b4599"}}]}]},{"component":"p","children":["One of the interesting things we can see in this screen is the ",{"component":"strong","children":["DomainMode"]},". The DomainMode has a big influence on some features that will be available, like whether you can use the latest version of ",{"component":"a","props":{"href":"https://technet.microsoft.com/en-us/library/hh831782(v=ws.11).aspx","target":"_blank"},"children":["Managed Service Accounts"]},". If you didn't set up the domain you're looking around in, it's handy to be able to get this information easily."]},{"component":"p","children":["PowerShell will tell you anything you want to know about a domain, and to get an idea of what's available we can use the ",{"component":"strong","children":["Get-Command"]}," cmdlet to show us all of the cmdlets that use the Get verb."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/8d29351ee47222c8b4584/1200_-657- 1200w, /images/content/5b6/8d29351ee47222c8b4584/668_-365- 668w, /images/content/5b6/8d29351ee47222c8b4584/320_-175- 320w","sizes":"668px, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/8d29351ee47222c8b4584/679-372-","alt":"","width":"679","height":"372","data-content-img-id":"5b68d29351ee47222c8b4584"}}]}]},{"component":"p","children":["There are 43 Active Directory Get cmdlets in the module, so as you can see you can get a lot of information. One of the first things we are usually going to want to find is information about users. Let's use ",{"component":"strong","children":["Get-ADUser"]}," to find one."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/8d2b41039eb155f8b456f/742_-145- 742w, /images/content/5b6/8d2b41039eb155f8b456f/412_-81- 412w, /images/content/5b6/8d2b41039eb155f8b456f/206_-40- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"/images/content/5b6/8d2b41039eb155f8b456f/356-70-","alt":"","width":"356","height":"70","data-content-img-id":"5b68d2b41039eb155f8b456f"}}]}]},{"component":"p","children":["Uh oh. We've already run into something unexpected. This is an easy fix though. If you think about it, in most domains, we don't really want to return every single user in a domain, so Get-ADUSer always requires some sort of filter whenever you use it. Let's try again."]},{"component":"p","children":["We can either call Get-ADUser and give it a single user name, or provide a filter to find multiple accounts. Either one will work, but I'll use the filter syntax just so we can see what that looks like."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/8d2d292a3a4875a8b4591/742_-239- 742w, /images/content/5b6/8d2d292a3a4875a8b4591/412_-132- 412w, /images/content/5b6/8d2d292a3a4875a8b4591/206_-66- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"/images/content/5b6/8d2d292a3a4875a8b4591/527-170-","alt":"","width":"527","height":"170","data-content-img-id":"5b68d2d292a3a4875a8b4591"}}]}]},{"component":"p","children":["The filter parameter can target any of the properties you see in that list and will use some of the standard PowerShell comparison operators against the value you enter for the second part of the filter. I say some because not all comparison operators are supported by the ",{"component":"strong","children":["–Filter"]}," parameter. To see what I mean, execute the following script for a detailed description."]},{"component":"table","props":{"className":"editorTblTable editorTblSize100 editorTblStyleStyle1"},"children":[{"component":"tbody","children":[{"component":"tr","children":[{"component":"td","children":["Get-Help Get-ADUser –Parameter filter"]}]}]}]},{"component":"p","children":["The properties you see here are in fact only a few of the properties of this object type. If you add the ",{"component":"strong","children":["-Properties *"]}," parameter you can get a full listing of available properties. ",{"component":"br"},{"component":"br"},"Now that we've seen the filter syntax, you don't always have to type out an entire filter to find a user. You could just call ",{"component":"strong","children":["Get-ADUserabertram"]}," if you know the specific user you want to look at."]},{"component":"p","children":["The next thing we might want to find would be groups. Getting groups is just as easy as finding users if you use ",{"component":"strong","children":["Get-ADGroup"]},", so let's look at finding a user's group membership instead. ",{"component":"br"},{"component":"br"},"The cmdlet for finding those uses a slightly different name; it's called ",{"component":"strong","children":["Get-ADPrincipalGroupMembership"]},". The cmdlet refers to an AD Principal instead of a User because you could be talking about computers just as easily as users. To illustrate, we will find the group memberships of the current computer."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/8d2f91039eba75b8b45ae/1200_-281- 1200w, /images/content/5b6/8d2f91039eba75b8b45ae/668_-156- 668w, /images/content/5b6/8d2f91039eba75b8b45ae/320_-75- 320w","sizes":"668px, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/8d2f91039eba75b8b45ae/639-150-","alt":"","width":"639","height":"150","data-content-img-id":"5b68d2f91039eba75b8b45ae"}}]}]},{"component":"h2","props":{"id":"creating-and-working-with-users"},"children":["Creating and working with users"]},{"component":"p","children":["To add users to the domain it's easy to use the ",{"component":"strong","children":["New-ADUser"]}," cmdlet, but let's take advantage of PowerShell's ability to automate things and create lots of users at once and set some properties as well."]},{"component":"p","children":["First, we'll create a few security groups so we can add the users to them later using the one liner in the screenshot below."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/8d3251039eb1b728b456f/742_-41- 742w, /images/content/5b6/8d3251039eb1b728b456f/412_-23- 412w, /images/content/5b6/8d3251039eb1b728b456f/206_-11- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"/images/content/5b6/8d3251039eb1b728b456f/551-31-","alt":"","width":"551","height":"31","data-content-img-id":"5b68d3251039eb1b728b456f"}}]}]},{"component":"p","children":["Now we'll add some users with the next script."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/8d3411039ebd9798b456e/1200_-363- 1200w, /images/content/5b6/8d3411039ebd9798b456e/668_-202- 668w, /images/content/5b6/8d3411039ebd9798b456e/320_-96- 320w","sizes":"668px, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/8d3411039ebd9798b456e/842-255-","alt":"","width":"842","height":"255","data-content-img-id":"5b68d3411039ebd9798b456e"}}]}]},{"component":"p","children":["As you can see, if we had something like a csv file with users and the groups we wanted to add them to, we could add a lot of users very fast. I did forget something though. If you don't explicitly mark accounts as enabled when you create them, then by default they are disabled. ",{"component":"br"},{"component":"br"},"We will need to use the ",{"component":"strong","children":["Set-ADUser"]}," cmdlet to enable them, but there's no need to do that one by one. Use a script like the one below to find them and pipe them to Set-ADUser and get them all enabled at once."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/8d35f1039eb50058b456e/742_-45- 742w, /images/content/5b6/8d35f1039eb50058b456e/412_-25- 412w, /images/content/5b6/8d35f1039eb50058b456e/206_-12- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"/images/content/5b6/8d35f1039eb50058b456e/554-34-","alt":"","width":"554","height":"34","data-content-img-id":"5b68d35f1039eb50058b456e"}}]}]},{"component":"p","children":["That script will get all six of the users we just created and enable them. In a mature domain with lots and lots of users, this kind of filtering and pipelining is a lifesaver, and can make you look like a wizard to your non-PowerShell coworkers."]},{"component":"p","children":["The last part of the script we used to create our users also added them to security groups. The script didn't return any output so we should check to confirm that it worked the way we expected it to. Use the script below to find one of the groups we thought we were adding users into and make sure it has the users we expect."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/8d37851ee475b338b457e/1200_-234- 1200w, /images/content/5b6/8d37851ee475b338b457e/668_-130- 668w, /images/content/5b6/8d37851ee475b338b457e/320_-62- 320w","sizes":"668px, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/8d37851ee475b338b457e/716-140-","alt":"","width":"716","height":"140","data-content-img-id":"5b68d37851ee475b338b457e"}}]}]},{"component":"p","children":["To practice disabling accounts let's assume that we know there is some unusual activity happening on the network associated with one of the QA accounts. We can disable accounts one at a time or in groups using the pipeline. Both are shown below."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/8d39f92a3a4064e8b45a3/1200_-521- 1200w, /images/content/5b6/8d39f92a3a4064e8b45a3/668_-290- 668w, /images/content/5b6/8d39f92a3a4064e8b45a3/320_-138- 320w","sizes":"668px, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/8d39f92a3a4064e8b45a3/585-254-","alt":"","width":"585","height":"254","data-content-img-id":"5b68d39f92a3a4064e8b45a3"}}]}]},{"component":"p","children":["Now we'll say that it's a few weeks later, and after an investigation Alan is cleared of all charges, but Grace is let go. What we need to do now is delete Grace's account, and re-enable Alan's."]},{"component":"p","children":["To delete an account we simply use ",{"component":"strong","children":["Remove-ADUser"]}," and specify the account. Needless to say that if you have lots of accounts to delete this could be powerful, but use caution and make sure you have backups. The script below shows how to delete a single account."]},{"component":"table","props":{"className":"editorTblTable editorTblSize100 editorTblStyleStyle1"},"children":[{"component":"tbody","children":[{"component":"tr","children":[{"component":"td","children":["Remove-ADUserGhopperQA"]}]}]}]},{"component":"p","children":["Next, we can re-enable Alan's account we just use the ",{"component":"strong","children":["Enable-ADAccount"]}," cmdlet."]},{"component":"table","props":{"className":"editorTblTable editorTblSize100 editorTblStyleStyle1"},"children":[{"component":"tbody","children":[{"component":"tr","children":[{"component":"td","children":["Enable-ADAccountATuringQA"]}]}]}]},{"component":"p","children":["To practice removing group members let's say we found that our method of adding users to groups was wrong. It's not hard to imagine. We just added every user to every group. The first group we want to fix is the administrators group."]},{"component":"p","children":["We can remove users one at a time by targeting them individually as shown below."]},{"component":"table","props":{"className":"editorTblTable editorTblSize100 editorTblStyleStyle1"},"children":[{"component":"tbody","children":[{"component":"tr","children":[{"component":"td","children":["Remove-ADGroupMember -Identity testAdministrators -Members ATuringTest"]}]}]}]},{"component":"p","children":["That works for a few at a time, but this could easily happen to lots of users, and you don't want to remove them each by hand. Instead if we can articulate some blanket statement like \"users from either Dev or Test should not be admins, only QA department accounts\" then we can express that as a script like the one below."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/8d3c392a3a4f55d8b45a5/1200_-58- 1200w, /images/content/5b6/8d3c392a3a4f55d8b45a5/668_-32- 668w, /images/content/5b6/8d3c392a3a4f55d8b45a5/320_-15- 320w","sizes":"668px, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/8d3c392a3a4f55d8b45a5/600-29-","alt":"","width":"600","height":"29","data-content-img-id":"5b68d3c392a3a4f55d8b45a5"}}]}]},{"component":"p","children":["That script will work but you might notice and wonder why we didn't just pipe the results of the Get-ADUser command directly to Remove-ADGroupMember. The answer has to do with which parameters for that cmdlet will take pipeline input and which ones won't. ",{"component":"br"},{"component":"br"},"If we look at the help information for the cmdlet using ",{"component":"strong","children":["Get-Help"]}," we will see that the ",{"component":"strong","children":["–Members"]}," parameter doesn't accept pipeline input, or wildcards for filtering either."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/8d4b11039ebd9798b4570/1200_-485- 1200w, /images/content/5b6/8d4b11039ebd9798b4570/668_-270- 668w, /images/content/5b6/8d4b11039ebd9798b4570/320_-129- 320w","sizes":"668px, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/8d4b11039ebd9798b4570/963-390-","alt":"","width":"963","height":"390","data-content-img-id":"5b68d4b11039ebd9798b4570"}}]}]},{"component":"p","children":["The solution is found in the same Get-Help output where we see that it will accept an array of ",{"component":"strong","children":["ADPrinciple Objects"]}," as denoted by the ",{"component":"strong","children":["[TypeName[]]"]}," notation for its input type. ",{"component":"br"},{"component":"br"},"You can also get this little hint by using your arrow keys to get down to the –Members parameter while the Intellisense menu is up, and the tooltip will give you the input type information just like the screenshot below."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/8d4d21039eb277d8b4575/1200_-328- 1200w, /images/content/5b6/8d4d21039eb277d8b4575/668_-183- 668w, /images/content/5b6/8d4d21039eb277d8b4575/320_-87- 320w","sizes":"668px, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/8d4d21039eb277d8b4575/719-197-","alt":"","width":"719","height":"197","data-content-img-id":"5b68d4d21039eb277d8b4575"}}]}]},{"component":"p","children":["So after all of the shuffling around of users and deleting and adding group memberships, we can check to see who's in what groups by invoking the ",{"component":"strong","children":["Get-ADPrincipalGroupMemberships"]}," one at a time like this."]},{"component":"table","props":{"className":"editorTblTable editorTblSize100 editorTblStyleStyle1"},"children":[{"component":"tbody","children":[{"component":"tr","children":[{"component":"td","children":["Get-ADPrincipalGroupMembership -Identity ghoppertest"]}]}]}]},{"component":"p","children":["Since one at a timing user accounts isn't great, we could also get a bunch of account memberships at once."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/8d4e91039eb155f8b4571/1200_-691- 1200w, /images/content/5b6/8d4e91039eb155f8b4571/668_-385- 668w, /images/content/5b6/8d4e91039eb155f8b4571/320_-184- 320w","sizes":"668px, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/8d4e91039eb155f8b4571/673-388-","alt":"","width":"673","height":"388","data-content-img-id":"5b68d4e91039eb155f8b4571"}}]}]},{"component":"p","children":["The problem, as you can see from the output above, is that if we use the pipeline to do this, our output only knows about the groups that are returned by Get-ADPrincipalGroupMemberships, and nothing about which account it's dealing with. ",{"component":"br"},{"component":"br"},"The result is a list of groups with no information about which user caused that group to show up in the listing. For example, TestAdministrators shows up in the listing above only once, but the listing on its own doesn't show us which user is a member of that group, only that there is only one member. To fix that, we can generate a kind of report using the script below."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/8d5001039eb50058b4570/1200_-838- 1200w, /images/content/5b6/8d5001039eb50058b4570/668_-466- 668w, /images/content/5b6/8d5001039eb50058b4570/320_-223- 320w","sizes":"668px, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/8d5001039eb50058b4570/780-545-","alt":"","width":"780","height":"545","data-content-img-id":"5b68d5001039eb50058b4570"}}]}]},{"component":"p","children":["Now that you're familiar with the basics, check out some of the more advanced topics dealing with Active Directory and PowerShell. You can start with ",{"component":"a","props":{"href":"https://blogs.technet.microsoft.com/heyscriptingguy/2015/06/16/powershell-and-the-active-directory-schema-part-1/"},"children":["this article on the Hey, Scripting Guy! Blog"]},", which is all about the Active Directory Schema and how to manage it with PowerShell."]}]},"resource":null,"sponsorship":null,"thumbnail":{"path":"https://staging.business.com/images/content/5cf/90cab7b4374ab068b456f/1500-0-","caption":"Puhhhah/Shutterstock","isBlurred":false},"bestPicks":null},"related":{"relatedArticles":[{"title":"PowerShell: Everything You Need to Know","canonical":"https://www.business.com/articles/powershell-everything-you-need-to-know/","slug":"powershell-everything-you-need-to-know","thumbnail":"https://www.business.com/images/content/5b8/998581039eb8f738b457b/1500-0-","dek":"What you need to know to unlock Microsoft PowerShell's full capabilities.","lastModified":"2018-09-05T17:00:00Z","published":"2018-09-05T17:00:00Z","sponsored":false},{"title":"Essential PowerShell Cmdlets For Auditing And Maintaining Storage","canonical":"https://www.business.com/articles/powershell-for-storage/","slug":"powershell-for-storage","thumbnail":"https://www.business.com/images/content/5d0/18e065a215ea2498b4588/1500-0-","dek":"PowerShell v5 offers some new features for managing storage.","lastModified":"2018-09-04T11:00:00Z","published":"2018-09-04T11:00:00Z","sponsored":false},{"title":"Mobile Wallet Guide: Google Pay vs. Apple Pay vs. Samsung Pay - 08-05","canonical":"https://staging.business.com/articles/google-pay-vs-apple-pay-vs-samsung-pay/","slug":"google-pay-vs-apple-pay-vs-samsung-pay","thumbnail":"https://staging.business.com/images/content/5c5/afd7f54d26d67178b458d/1500-0-","dek":"Edit 07-24 - subtitle","lastModified":"2019-08-05T20:58:00Z","published":"2018-06-21T16:05:00Z","sponsored":null},{"title":"Using Lean Strategies to Achieve Team Synergy and Efficiency","canonical":"https://www.business.com/articles/lean-strategies-team-efficiency/","slug":"lean-strategies-team-efficiency","thumbnail":"https://www.business.com/images/content/5be/480e49c658a51108b458c/1500-0-","dek":"Learn more about lean manufacturing strategies and how to implement them in your business.","lastModified":"2018-11-08T08:00:00Z","published":"2018-11-08T08:00:00Z","sponsored":false},{"title":"Your Guide to Creating a Small Business Marketing Plan","canonical":"https://www.business.com/articles/sample-marketing-plan-outline-and-template/","slug":"sample-marketing-plan-outline-and-template","thumbnail":"https://www.business.com/images/content/5f3/3e1765a215eb62d8b4567/1500-0-","dek":"Follow these templates and guidelines to get started on creating your business's marketing plan.","lastModified":"2020-08-12T12:28:00Z","published":"2018-03-02T13:00:00Z","sponsored":false},{"title":"From COVID-19 to Hurricane Season: Disaster Preparedness for Small Business","canonical":"https://www.business.com/articles/business-disaster-prep/","slug":"business-disaster-prep","thumbnail":"https://www.business.com/images/content/5e7/a495e5a215eb11d8b4569/1500-0-","dek":"Natural disasters – whether a hurricane, tornado or outbreak like COVID-19 – can have a disastrous effect on small businesses, but they don't have to. Here's how to weather a disaster successfully.","lastModified":"2020-03-25T15:19:00Z","published":"2018-09-26T07:00:00Z","sponsored":false},{"title":"Mobile Wallet Guide: Google Pay vs. Apple Pay vs. Samsung Pay","canonical":"https://www.business.com/articles/google-pay-vs-apple-pay-vs-samsung-pay/","slug":"google-pay-vs-apple-pay-vs-samsung-pay","thumbnail":"https://www.business.com/images/content/5c5/e0a269c658a457c8b4591/1500-0-","dek":"You no longer need to carry a bulky wallet filled with numerous credit cards or cash.","lastModified":"2018-06-21T16:06:00Z","published":"2018-06-21T16:05:00Z","sponsored":false},{"title":"Resources for Veteran-Owned Businesses","canonical":"https://www.business.com/articles/resources-veteran-owned-business/","slug":"resources-veteran-owned-business","thumbnail":"https://www.business.com/images/content/5b7/425da51ee47e7568b458a/1500-0-","dek":"How to start a business, find funding and gain customers as a veteran business owner.","lastModified":"2018-08-15T12:01:00Z","published":"2018-08-15T12:01:00Z","sponsored":false},{"title":"Microsoft Azure vs. Amazon Web Services: Cloud Comparison","canonical":"https://www.business.com/articles/azure-vs-aws-cloud-comparison/","slug":"azure-vs-aws-cloud-comparison","thumbnail":"https://www.business.com/images/content/5cf/ff3445a215ed86a8b459d/1500-0-","dek":"Which one is right for your business?","lastModified":"2018-05-25T07:00:00Z","published":"2018-05-25T07:00:00Z","sponsored":false},{"title":"How to Hire for Your Business","canonical":"https://www.business.com/articles/how-to-staff-business/","slug":"how-to-staff-business","thumbnail":"https://www.business.com/images/content/5ea/9c8bb9c658aee018b456c/1500-0-","dek":"Sterling Staffing Solutions CEO Stephen Carter shares his tips on staffing your business.","lastModified":"2020-07-31T15:00:00Z","published":"2018-08-16T12:00:00Z","sponsored":false},{"title":"Use PowerShell to Make WSUS Suck Less","canonical":"https://www.business.com/articles/powershell-windows-software-update-services/","slug":"powershell-windows-software-update-services","thumbnail":"https://www.business.com/images/content/5b8/eca2d92a3a4ee5a8b4574/1500-0-","dek":"Windows Software Update Services can use PowerShell to work with servers and Windows.","lastModified":"2018-09-04T10:00:00Z","published":"2018-09-04T10:00:00Z","sponsored":false},{"title":"How To Remove Pre-Installed Windows 10 Applications With PowerShell","canonical":"https://www.business.com/articles/remove-pre-installed-windows-10-applications-powershell/","slug":"remove-pre-installed-windows-10-applications-powershell","thumbnail":"https://www.business.com/images/content/5d0/b99037b4374d0428b4567/1500-0-","dek":"How to quickly and easily uninstall pre-installed Windows 10 apps using PowerShell.","lastModified":"2018-09-05T08:00:00Z","published":"2018-09-05T08:00:00Z","sponsored":false}],"relatedReviews":[{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df908cc5a215e8c4a8b4568/conferencecall_Antonio_Diaz_Getty.jpg","canonical":"https://staging.business.com/categories/best-conference-call-services/","title":"The Best Conference Call Services of 2021","dek":"Which conference call service is right for your business in 2021? We review the top-rated services.","slug":"best-conference-call-services","lastModified":"2021-03-17T18:17:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df3d8695a215e58428b4570/POS_GETTY_DERO2084.jpg","canonical":"https://staging.business.com/categories/best-pos-systems/","title":"The Best POS Systems of 2021","dek":"Before you choose a POS system, check out our reviews of the best picks for 2021. ","slug":"best-pos-systems","lastModified":"2021-03-17T17:33:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5e00d4787b43745d6a8b456e/Laptop_undrey_getty.jpg","canonical":"https://staging.business.com/categories/employee-monitoring-software/","title":"The Best Employee Monitoring Software of 2021","dek":"We've narrowed down the best employee monitoring software for businesses. Check out our best picks and reviews.","slug":"employee-monitoring-software","lastModified":"2021-03-05T15:40:00Z"}],"relatedSponsoredArticles":null}},"pageContext":{"displayModified":"2018-09-04T08:00:00.000Z","template":"v1","title":"Essential PowerShell Cmdlets For Managing Active Directory","meta":{"robots":"index, follow"},"docType":"articles","slug":"powershell-active-directory-cmdlets","canonical":"https://staging.business.com/articles/powershell-active-directory-cmdlets/","skipTOC":false}},"staticQueryHashes":[]}![\"\"](\"/images/content/5b6/8d29351ee47222c8b4584/1200_-657-)
![\"\"](\"/images/content/5b6/8d2b41039eb155f8b456f/742_-145-)
![\"\"](\"/images/content/5b6/8d2d292a3a4875a8b4591/742_-239-)
![\"\"](\"/images/content/5b6/8d2f91039eba75b8b45ae/1200_-281-)
![\"\"](\"/images/content/5b6/8d3251039eb1b728b456f/742_-41-)
![\"\"](\"/images/content/5b6/8d3411039ebd9798b456e/1200_-363-)
![\"\"](\"/images/content/5b6/8d35f1039eb50058b456e/742_-45-)
![\"\"](\"/images/content/5b6/8d37851ee475b338b457e/1200_-234-)
![\"\"](\"/images/content/5b6/8d39f92a3a4064e8b45a3/1200_-521-)
![\"\"](\"/images/content/5b6/8d3c392a3a4f55d8b45a5/1200_-58-)
![\"\"](\"/images/content/5b6/8d4b11039ebd9798b4570/1200_-485-)
![\"\"](\"/images/content/5b6/8d4d21039eb277d8b4575/1200_-328-)
![\"\"](\"/images/content/5b6/8d4e91039eb155f8b4571/1200_-691-)
![\"\"](\"/images/content/5b6/8d5001039eb50058b4570/1200_-838-)