Managing Active Directory with PowerShell

The ActiveDirectory PowerShell module, installed via the Remote Server Administration Tools (RSAT) feature or present natively on Domain Controllers, exposes cmdlets like Get-ADUser, Get-ADGroup, and Get-ADComputer to query directory objects, and New-/Set-/Remove- variants to manage their lifecycle. These cmdlets communicate with Active Directory Web Services (ADWS), which must be running on at least one reachable domain controller. Nearly every cmdlet accepts a -Filter parameter using PowerShell's expression-based filter syntax (not LDAP syntax directly), plus -Properties to request additional attributes beyond the small default set returned.

New-ADUser creates accounts with mandatory parameters like -Name and -SamAccountName, and important safety details like -AccountPassword (as a SecureString) and -Enabled; by default new accounts are disabled until explicitly enabled to avoid accidentally provisioning live, unsecured logins. Set-ADUser modifies existing attributes, while Add-ADGroupMember and Remove-ADGroupMember manage group membership without touching other user attributes. Bulk operations are common: piping a CSV import through ForEach-Object with New-ADUser is the standard pattern for onboarding many users at once, and should always be wrapped with -WhatIf during testing to preview changes before committing them.

PowerShell excels at generating compliance reports impossible to produce efficiently through the GUI, such as listing all users with PasswordNeverExpires set, computers with stale passwords, or nested group membership chains via Get-ADGroupMember -Recursive. Combining Get-ADUser or Get-ADGroup output with Export-Csv produces auditable reports for security reviews, and Search-ADAccount specifically surfaces locked-out, disabled, or expired accounts in one call without needing a custom -Filter expression.