PowerShell for Windows Admins:

Active Directory


November 27, 2017  12:10 PM

Get an AD user’s manager

Richard Siddaway Richard Siddaway Profile: Richard Siddaway
Active Directory, Powershell

Interesting question on the forum about finding the manager for a given user in AD – assuming the Manager field is populated of course. If you’ve not worked with the AD cmdlets this is a good introduction to some of their quirks. This is how you get an AD user’s manager. You need the...

August 30, 2017  8:59 AM

Comparing AD group membership on EmployeeId

Richard Siddaway Richard Siddaway Profile: Richard Siddaway
Active Directory, Powershell

Back in this post - http://itknowledgeexchange.techtarget.com/powershell/comparing-group-membership/ I showed how to compare the membership of two groups using Compare-Object. The comparison was based on the samAccountName. A question raised the issue of comparing AD group membership on...


August 9, 2017  4:59 AM

Get-ADUser filtering

Richard Siddaway Richard Siddaway Profile: Richard Siddaway
Active Directory, Powershell

Saw a question on the forums that revolved around Get-ADUser filtering. Initial code was like this Import-Csv .\users.txt | foreach { Get-ADUser -Filter {Name -like $_.Name} } which on the face of it seems reasonable. However, you get errors like this Get-ADUser : Property: 'Name' not found in...


May 9, 2017  3:23 AM

Are your domain controllers real?

Richard Siddaway Richard Siddaway Profile: Richard Siddaway
Active Directory, CIM, Powershell

A question on the forum asked about discovering if domain controllers are physical or virtual machines. In other words Are your domain controllers real? This will do the job:

foreach ($domain in (Get-ADForest).domains) {
 Get-ADDomainController -filter * -server $domain |
 sort hostname...


March 29, 2017  1:29 PM

Name mismatch

Richard Siddaway Richard Siddaway Profile: Richard Siddaway
Active Directory, CIM, Powershell

Ever wondered why you can’t do this:

Get-ADComputer -Filter * -SearchBase 'OU=Servers,DC=Manticore,DC=org' |
Get-CimInstance -ClassName Win32_OperatingSystem
The –ComputerName parameter on get-CimInstance accepts pipeline input BUT its by property name.
PS> Get-Help...


March 4, 2017  5:59 AM

Modifying AD users in bulk

Richard Siddaway Richard Siddaway Profile: Richard Siddaway
Active Directory, Powershell

Modifying AD users in bulk involves either setting one or more properties to the same value for a set of users or reading in the values you need from a data source of some kind. We prepared some test data in the last post so lets see how we use it.

$users = Import-Csv -Path...


March 3, 2017  1:52 PM

Test data for bulk AD changes

Richard Siddaway Richard Siddaway Profile: Richard Siddaway
Active Directory, Powershell

I’ve had a number of questions about changing AD user data in bulk. If you need to do that you need some test data. The specific questions were around setting the Division property and the EmployeeNumber at the same time – but some accounts didn’t have an employee number. First you need...


February 16, 2017  2:24 PM

Get-ADUser doesn’t display all properties

Richard Siddaway Richard Siddaway Profile: Richard Siddaway
Active Directory, Powershell

Microsoft’s Active Directory cmdlets have some issues. One of the ones that catches everyone when they start using them is that Get-ADUser doesn’t display all properties. A default call to Get-ADUser displays a subset of the available properties of the user object:

DistinguishedName :...


December 14, 2016  5:38 AM

Active Directory Schema Versions

Richard Siddaway Richard Siddaway Profile: Richard Siddaway
Active Directory, Powershell

With the release of Windows Server 2016 its time to update my schema versions script

$sch = [System.DirectoryServices.ActiveDirectory.ActiveDirectorySchema]::GetCurrentSchema()
$de = $sch.GetDirectoryEntry()
switch ($de.ObjectVersion) {
    13{"{0,25} " -f "Schema Version...


November 18, 2016  5:14 AM

Changing the samAccountName

Richard Siddaway Richard Siddaway Profile: Richard Siddaway
Active Directory, Powershell

I was recently asked how the samAccountName – also referred to as the login id – could be changed. First lets look at an account: PS C:\Scripts> Get-ADUser -Identity 'FredFox' DistinguishedName : CN=FOX...


Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: