Essential Active Directory Commands Cheat Sheet: PowerShell and CMD Reference

Introduction: What is Active Directory and Why It Matters

Active Directory (AD) is Microsoft’s directory service for Windows domain networks. It stores information about objects on the network and makes this information available to users and administrators. AD provides centralized authentication, authorization, and management of resources, making it the backbone of enterprise Windows environments. Mastering AD commands is essential for efficient network administration, security management, and troubleshooting.

Core Concepts and Components

• Domain: A logical group of network objects (users, devices, groups) that share the same AD database
• Domain Controller (DC): Server that runs AD Domain Services and stores the AD database
• Forest: Collection of one or more domains that share a common schema and global catalog
• Organizational Unit (OU): Container for organizing objects within a domain
• Group Policy: Feature for implementing specific configurations for users and computers
• LDAP (Lightweight Directory Access Protocol): Protocol used to communicate with AD
• Global Catalog (GC): Contains a partial copy of all objects in a multi-domain forest

Command Environments

Active Directory can be managed through multiple command-line interfaces:

1. PowerShell with Active Directory module (modern, preferred method)
2. dsquery, dsmod, dsadd and other command-line tools
3. ADSI (Active Directory Service Interfaces)
4. ldp.exe and other LDAP tools
5. ntdsutil for advanced directory operations

PowerShell Active Directory Commands

Module Import and Authentication

# Import AD Module (required for most AD PowerShell commands)
Import-Module ActiveDirectory

# Connect to a specific domain (optional)
Set-ADDomainController -Identity "DC01.domain.com"

# Connect to AD with alternate credentials
$credential = Get-Credential
New-PSDrive -Name ADDrive -PSProvider ActiveDirectory -Root "//RootDSE/" -Credential $credential

User Management Commands

Group Management Commands

Computer Management Commands

Organizational Unit (OU) Management

Domain Controller Management

Group Policy Management

Classic Command-Line Tools (dsquery, dsmod, dsadd)

DSQuery Commands

DSAdd Commands

DSMod Commands

DSRm Commands

LDAP Query Syntax

LDAP filters are used in many AD commands to specify search criteria.

Common LDAP Filters

Using LDAP Filters in PowerShell

# Find disabled users
Get-ADUser -LDAPFilter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))"

# Find computers running Windows 10
Get-ADComputer -LDAPFilter "(&(objectClass=computer)(operatingSystem=*Windows 10*))"

# Find members of a specific group using LDAP
Get-ADUser -LDAPFilter "(&(objectCategory=person)(objectClass=user)(memberOf=CN=IT Support,OU=Groups,DC=domain,DC=com))"

Advanced Domain Operations with ntdsutil

ntdsutil is a command-line tool used for AD database maintenance.

# Launch ntdsutil
ntdsutil

# Activate instance NTDS
ntdsutil: activate instance ntds

# Launch authoritative restore
ntdsutil: authoritative restore

# Perform FSMO role transfer
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server dc01.domain.com
server connections: quit
fsmo maintenance: transfer pdc
fsmo maintenance: quit
ntdsutil: quit

# Perform AD database maintenance
ntdsutil: activate instance ntds
ntdsutil: files
file maintenance: compact to c:\temp
file maintenance: quit
ntdsutil: quit

# Reset Directory Service Restore Mode (DSRM) password
ntdsutil: set dsrm password
reset password on server null: reset password
Please type password for DS Restore Mode Administrator Account: ********
Please confirm new password: ********
ntdsutil: quit

Common Challenges and Solutions

Best Practices and Tips

• PowerShell One-Liners: Create reusable one-liner scripts for common tasks

  # Create a CSV report of disabled user accounts
  Get-ADUser -Filter {Enabled -eq $false} -Properties Name,LastLogonDate,Description | Select Name,LastLogonDate,Description | Export-CSV "C:\DisabledUsers.csv" -NoTypeInformation
  
  # Find inactive computers (not logged in for 90 days)
  $date = (Get-Date).AddDays(-90)
  Get-ADComputer -Filter {LastLogonDate -lt $date} -Properties LastLogonDate | Select Name,LastLogonDate
  
  # Clean up inactive user accounts
  Get-ADUser -Filter {LastLogonDate -lt $date -and Enabled -eq $true} -Properties LastLogonDate | Disable-ADAccount
  

• Use PowerShell for Bulk Operations:

  # Import users from CSV
  Import-Csv "C:\Users.csv" | ForEach-Object {
      New-ADUser -Name $_.Name -GivenName $_.FirstName -Surname $_.LastName -SamAccountName $_.Username -Path $_.OU -AccountPassword (ConvertTo-SecureString $_.Password -AsPlainText -Force) -Enabled $true
  }
  
  # Export all users to CSV
  Get-ADUser -Filter * -Properties * | Select-Object Name,GivenName,Surname,SamAccountName,EmailAddress,Department,Title,LastLogonDate | Export-Csv "C:\AllUsers.csv" -NoTypeInformation
  

• Security Best Practices:

  • Use fine-grained password policies for different user groups
  • Implement least privilege access model
  • Regularly audit AD using built-in or third-party tools
  • Use tiered administration model for AD management
  • Enable and monitor AD auditing

• Maintenance Tips:

  • Schedule regular backups of AD (System State backup)
  • Clean up orphaned or inactive accounts
  • Monitor AD replication health
  • Document your AD structure and changes

PowerShell Reporting Examples

# Password expiration report
Get-ADUser -Filter * -Properties PasswordLastSet,PasswordNeverExpires,PasswordExpired |
Select-Object Name,SamAccountName,PasswordLastSet,PasswordNeverExpires,PasswordExpired |
Export-CSV "C:\PasswordReport.csv" -NoTypeInformation

# Group membership report
$groups = Get-ADGroup -Filter *
$report = foreach ($group in $groups) {
    $members = Get-ADGroupMember -Identity $group.DistinguishedName | Select-Object -ExpandProperty Name
    [PSCustomObject]@{
        GroupName = $group.Name
        Members = ($members -join ", ")
        MemberCount = $members.Count
    }
}
$report | Export-CSV "C:\GroupMembership.csv" -NoTypeInformation

# AD health check
$report = @()
$dcs = Get-ADDomainController -Filter *
foreach ($dc in $dcs) {
    $dcName = $dc.HostName
    # Test LDAP
    $ldapTest = Test-NetConnection -ComputerName $dcName -Port 389 -InformationLevel Quiet
    # Test RPC
    $rpcTest = Test-NetConnection -ComputerName $dcName -Port 135 -InformationLevel Quiet
    # Test PING
    $pingTest = Test-Connection -ComputerName $dcName -Count 1 -Quiet
    # Get uptime
    try {
        $os = Get-WmiObject -Class Win32_OperatingSystem -ComputerName $dcName -ErrorAction SilentlyContinue
        $uptime = (Get-Date) - $os.ConvertToDateTime($os.LastBootUpTime)
        $uptimeStr = "$($uptime.Days) days, $($uptime.Hours) hours, $($uptime.Minutes) minutes"
    } catch {
        $uptimeStr = "Unable to retrieve"
    }
    
    $report += [PSCustomObject]@{
        DomainController = $dcName
        LDAP = if ($ldapTest) {"Available"} else {"Unavailable"}
        RPC = if ($rpcTest) {"Available"} else {"Unavailable"}
        Ping = if ($pingTest) {"Available"} else {"Unavailable"}
        Uptime = $uptimeStr
    }
}
$report | Export-CSV "C:\DCHealthCheck.csv" -NoTypeInformation

Resources for Further Learning

Official Documentation

• Microsoft Active Directory Documentation
• PowerShell Active Directory Module Documentation
• Understanding AD Database Concepts

Books

• “Active Directory: Designing, Deploying, and Running Active Directory” by Brian Desmond
• “Windows Server 2019 & PowerShell All-in-One For Dummies” by Sara Perrott
• “Learn Windows PowerShell in a Month of Lunches” by Don Jones and Jeffrey Hicks

Online Resources

• Microsoft Learn: Active Directory Paths
• PowerShell Gallery – Repository for AD management scripts
• Windows Server Support Forum

Tools

• Active Directory Administrative Center
• Active Directory Users and Computers (ADUC)
• Active Directory Module for Windows PowerShell
• Group Policy Management Console (GPMC)
• RSAT (Remote Server Administration Tools)