AD-Powershell for Active Directory Administrators
Table of Contents
- Computer object commands
- Group object commands
- Organizational Unit (OU) commands
- User object commands
- See Also
Computer object commands
List all computer accounts in a domain
Get-ADComputer –Filter {Name –Like "*"}
View all computers that are logged in for 90 days to the Active Directory
Search-ADaccount -AccountInactive -Timespan 90 -ComputersOnly
OR
$lastLogon = (get-date).adddays(-90).ToFileTime()
Get-ADComputer -filter {lastLogonTimestamp -gt $lastLogon}
Find and delete all disabled Computer accounts in Active Directory
Search-ADAccount -AccountDisabled -ComputersOnly | Sort-Object | Remove-ADComputer
Find and delete disabled computer accounts from a specific OU
Search-ADAccount -AccountDisabled -Searchbase "OU=IT,DC=Contoso,DC=Com" -ComputersOnly | Sort-Object | Remove-ADComputer
Find and delete all computer accounts that no longer have signed up since 11/20/2011 to the Active Directory
Search-ADAccount -AccountInactive -DateTime "20.11.2011" –ComputersOnly | Sort-Object | Remove-ADComputer
List only disabled Computer accounts in Domain
Search-ADAccount -AccountDisabled -ComputersOnly | Format-Table Name
Move Computer to other OU (example: Computer=CLIENT1 to OU=IT)
Get-ADComputer CLIENT1 | Move-ADObject -TargetPath "OU=IT,DC=Contoso,DC=Com"
See Computer account detail (example: Computer=CLIENT1)
Get-ADComputer -Filter {Name -Like "CLIENT1"}
Get a specific computer showing all the properties (example: Computer=CLIENT1)
Get-ADComputer "CLIENT1" -Properties *
List Computers (Name, Operating System, Service Pack, Operating System version)
Get-ADComputer -Filter * -Property * | Format-Table Name,OperatingSystem,OperatingSystemServicePack,OperatingSystemVersion -Wrap –Auto
Export Computers List (Name, Operating System, Service Pack, Operating Systemversion)to CSV File
Get-ADComputer -Filter * -Property * | Select-Object Name,OperatingSystem,OperatingSystemServicePack,OperatingSystemVersion | Export-CSV AllWindows.csv -NoTypeInformation -Encoding UTF8
Get Computer IPv4 Address and DnsHostName
Get-ADComputer -Filter {Name -Like "Computer-Name"} -Properties IPv4Address | Format-List Name,DnsHostName,IPv4Address
Get all Computers in a specific OU (example: OU=IT, Domain=Contoso.com)
Get-ADComputer -SearchBase "OU=IT,DC=Contoso,DC=Com" -filter *
Get all the Computers without a specific DNS suffix
Get-ADComputer -filter "DnsHostName -notlike '*.Contoso.Com'"
Get Computer Service Principal Names (SPNs)
Get-ADComputer "Computer-Name" –Properties ServicePrincipalNames | Select-Object –Expand ServicePrincipalNames
Get Computers Security Identifiers (SIDs)
Get-ADComputer -Filter {Name -like "*"} | Select Name,SID | Format-Table -Auto
All computer accounts that were created in the last 90 days in the Active Directory
Get-ADComputer -Filter * -Properties whenCreated | ? { ((Get-Date) - $_.whenCreated).Days -lt 90} | Format-Table Name,WhenCreated,Name,DistinguishedName -Autosize -Wrap
All computer accounts that were created as of December 1, 2011 (12/01/2011) in the Active Directory
Get-ADComputer -LDAPFilter "(&(objectCategory=person)(whenCreated>=20111201000000.0Z))" -Properties whenCreated | Format-Table Name,whenCreated,distinguishedName -Autosize -Wrap
All computer accounts that were created here in a given time, between the 10/01/2011 and 12/01/2011 in Active Directory
$Start = Get-Date -Day 01 -Month 10 -Year 2011 -Hour 00
$End = Get-Date -Day 01 -Month 12 -Year 2011 -Hour 23 -Minute 59
Get-ADComputer -Filter * -Properties whenCreated | ? { ($_.whenCreated -gt $Start) -and ($_.whenCreated -le $End) } | Format-Table Name,WhenCreated,DistinguishedName -Autosize -Wrap
All computer accounts, Last Password Set in a given time, between the 10/01/2011 and 12/01/2011 in Active Directory
$Start = Get-Date -Day 01 -Month 10 -Year 2011 -Hour 00
$End = Get-Date -Day 01 -Month 12 -Year 2011 -Hour 23 -Minute 59
Get-ADComputer -Filter * -Properties PasswordLastSet | ? { ($_.PasswordLastSet -gt $Start) -and ($_.PasswordLastSet -le $End) } | Format-Table Name,WhenCreated,DistinguishedName -Autosize -Wrap
All computer accounts, Last Password Set in the last 90 days in Active Directory
$Date = (Get-Date).AddDays(-90)
Get-ADComputer -Filter * -Properties PasswordLastSet | where { $_.PasswordLastSet -le $Date } | Format-Table Name,PasswordLastSet,DistinguishedName -Autosize -Wrap
Group object commands
List all members of a group (example: Group=Experts)
Get-ADGroupMember Experts | Format-Table Name
All properties of a group (example: Group=IT)
Get-ADGroup IT -Properties *
List only Universal Security groups
Get-ADGroup –LDAPFilter "(&(objectCategory=group)(groupType:1.2.840.113556.1.4.803:=-2147483640))"
List only Global Security groups
Get-ADGroup –LDAPFilter "(&(objectCategory=group)(groupType:1.2.840.113556.1.4.803:=-2147483646))"
List only Domain Local Security groups
Get-ADGroup –LDAPFilter "(&(objectCategory=group)(groupType:1.2.840.113556.1.4.803:=-2147483644))"
List all Group memberships for a user (example: User=EdPrice)
Get-ADAccountAuthorizationGroup EdPrice
Move-ADObject "CN=Experts,OU=IT,DC=Contoso,DC=com" -TargetPath "OU=Service,DC=Contoso,DC=com"
Add members to a group (example: Group=Experts, User=EdPrice)
Add-ADGroupmember Experts -Member EdPrice
Delete Group (example: Group=Experts)
Remove-ADGroup Experts
Delete a User from a Group (example: Group=Experts, User=EdPrice)
Remove-ADGroupMember Experts -Member EdPrice
Set Description for a Group (example: Group=JoinPC, Description=This group is allowed join PCs to Domain)
Set-ADGroup JoinPC -Description "This group is allowed join PCs to Domain"
Add Users from one Group to another Group (example: from Group1=DataUsers to Group2=SQLUsers)
Get-ADGroupMember DataUsers | Select sAMAccountName | ForEach { Add-ADGroupMember SQLUsers -Members $_.sAMAccountName }
Comparing two Groups to see the Group memberships (example: Group1=Administratorso, Group2=DNSAdmins)
Compare-Object ( Get-ADGroupMember Administrators) ( Get-ADGroupMember DNSAdmins) -IncludeEqual
Organizational Unit (OU) commands
All OUs in Domain
Get-ADOrganizationalUnit -Filter {Name -like „*“} | FT Name, DistinguishedName -A
Create OU (example: OU=IT, Domain=Contoso.com)
New-ADOrganizationalUnit -Name IT -Path "DC=Contoso,DC=Com"
Contents of a specific OU (example: OU=IT, Domain=Contoso.com)
Get-ADObject -Filter {Name -Like "*"} -Searchbase "OU=IT,DC=Contoso,DC=Com"
Rename OU (example: Old-Name=IT, New-Name=Admin, Domain=Contoso.com)
Rename-ADObject "OU=IT,DC=Contoso,DC=Com" -NewName Admin
Delete OU including contents (example: OU=IT, Domain=Contoso.com)
Remove-ADOrganizationalUnit IT -Recursive
Delete user from specific OU (example: User=EdPrice, OU=IT, Domain=Contoso.com)
Remove-ADObject "CN=EdPrice,OU=IT,DC=Contoso,DC=Com"
Move all objects from one OU to another OU (example: Old-OU=IT, New-OU=Manager, Domain=Contoso.com)
Get-ADObject -Filter {Name -Like "*"} -Searchbase "OU=IT,DC=Contoso,DC=Com" -SearchScope OneLevel | Move-ADObject -TargetPath "OU=Manager,DC=Contoso,DC=Com"
User object commands
List all User accounts in the Domain
Get-ADUser –Filter *
List all User accounts in a specific OU (example: OU=IT, Domain=Contoso.com)
Get-ADUser –Filter * -Searchbase "OU=IT,DC=Contoso,DC=Com" | FT
List all User accounts from specific City (example: City=NewYork)
Get ADUser -Filter {city - like "NewYork"} | FT
List only disabled User accounts in Domain
Search-ADAccount –AccountDisabled –Usersonly | FT Name
List all User accounts whose First Name is Ed
Get-ADUser –Filter {givenName –Like "Ed"} | FT
List all User accounts whose Last Name is Price
Get-ADUser –Filter {Surname –Like "Price"} | FT
List all User accounts from the specific Department (example: Department=Support)
Get-ADUser –Filter {Department –Like "Support"} | FT
List a User's Group memberships (example: User=Richard)
Get-ADPrincipalGroupMembership -Identity Richard
List all Users from specific Group and move Users to another OU (example: Group=People, Target OU=NewYork, Domain=Contoso.com)
Get-ADGroupMember People -Recursive | Move-ADObject –TargetPath "OU=NewYork,DC=Contoso,DC=Com"
Remove all users in an OU from a specific Group (example: Group=People, OU=NewYork, Domain=Contoso.com)
$Users = Get-ADUser -Filter * -Searchbase "OU=NewYork,DC=Contoso,DC=Com"
Remove-ADGroupMember -Identity People -Member $Users -Confirm:0
See Also
Here are two great article about Active Directory LDAP Syntax and Active Directory Characters to Escape:
- Active Directory: Characters to Escape (Richard Mueller - MVP)
- Active Directory: LDAP Syntax Filters (Richard Mueller - MVP)
- Move (Transfering or Seizing) FSMO roles with AD-Powershell command to another Domain Controller
- How To Revert Back or downgrade Windows Server 2008 R2 Forest and Domain functional Level
- PowerShell Portal
- Wiki: Portal of TechNet Wiki Portals
AD-Powershell for Active Directory Administrators的更多相关文章
- Powershell About Active Directory Server
一.获取域控制器服务器清单 (Get-ADForest).Domains | %{ Get-ADDomainController -Filter * -Server $_ } | select hos ...
- Powershell About Active Directory Group Membership of a domain user
使用Get-User命令去寻找group membership of a domain user $((Get-ADUser Wendy -Properties *).MemberOf -split ...
- Active Directory 域服务 (AD DS) 虚拟化
TechNet 库 Windows Server Windows Server 2012 R2 和 Windows Server 2012 服务器角色和技术 Active Directory Acti ...
- 介绍 Active Directory 域服务 (AD DS) 虚拟化
TechNet 库 Windows Server Windows Server 2012 R2 和 Windows Server 2012 服务器角色和技术 Active Directory Acti ...
- Active Directory的基本概念
前言 本文是面对准备加入Active Directory编程的初学者的一份文章,主要是讲解Active Directory(活动目录)的一些概念和相关知识.这篇文章本来是不想写下来的,因为概念性内容的 ...
- Configuring Active Directory Federation Services 2.0 (配置 adfs 2.0) -摘自网络
Active Directory Federation Services (AD FS) 2.0 makes it possible to deploy a federation server and ...
- Windows Server 2016-WinSer2016 Active Directory新增功能
Windows Server 2016 Active Directory 域服务 (AD DS)新增很多功能用来提升Active Directory域及组织环境安全等,并帮助他们面向云的部署或混合部署 ...
- Active Directory Domain Services in Windows Server 2016/2012
Applies To: Windows Server 2016, Windows Server 2012 R2, Windows Server 2012 You will find links to ...
- Active Directory的LDAP协议与DN(Distinguished Name)详解
前言 光copy几段代码的文章没什么意思,本章上最基础的代码,主要是为了从编程方面聊LDAP和DN,其它的后面聊,一步步慢慢来吧. Active Directory编程须知 1.域控服务器: Wind ...
随机推荐
- 【洛谷2624】[HNOI2008] 明明的烦恼(Python+利用prufer序列结论求解)
点此看题面 大致题意: 给你某些点的度数,其余点度数任意,让你求有多少种符合条件的无根树. \(prufer\)序列 一道弱化版的题目:[洛谷2290][HNOI2004] 树的计数. 这同样也是一道 ...
- 【洛谷P3119】[USACO15JAN]草鉴定Grass Cownoisseur
草鉴定Grass Cownoisseur 题目链接 约翰有n块草场,编号1到n,这些草场由若干条单行道相连.奶牛贝西是美味牧草的鉴赏家,她想到达尽可能多的草场去品尝牧草. 贝西总是从1号草场出发,最后 ...
- Android学习笔记_56_应用Tween动画 (渐变、缩放、位移、旋转)
1.实现listview每个项先向右移动,再向左移动(回到原来位置) TranslateAnimation ta = new TranslateAnimation( Animation.RELATIV ...
- Entity Framework 六
实体框架中的存储过程: 我们在创建edmx的时候把存储过程勾选了,所以在我们的上下文上中生成了方法. 存储过程为:就是需要显示多个表的字段.以往需要显示多个表的字段都是新建一个类把需要的字段当做属性写 ...
- py faster rcnn的lib编译出错问题
真是好事多磨啊,计算机系统依然是14.04,而cuda依然是8.0,唯一不同的是时间不一样,下载的各种库版本有差别,GPU的driver不一样. 但是这样就出问题了,py-faster rcnn的li ...
- Es6的那些事
现在看招聘网站上的要求,作为前端er~都要熟悉甚至精通(滑稽脸)es6,项目中也经常用,啥let,const,尤其是用react的同学,肯定对解构赋值不会陌生,今天逛淘宝前端的博客,看到一篇名为Es6 ...
- 洛谷P1196 [NOI2002]银河英雄传说(带权并查集)
题目描述 公元五八○一年,地球居民迁至金牛座α第二行星,在那里发表银河联邦创立宣言,同年改元为宇宙历元年,并开始向银河系深处拓展. 宇宙历七九九年,银河系的两大军事集团在巴米利恩星域爆发战争.泰山压顶 ...
- For macOS.百度网盘 破解SVIP、下载速度限制~
For macOS.百度网盘 破解SVIP.下载速度限制~ 是插件的 https://github.com/CodeTips/BaiduNetdiskPlugin-macOS 2019-01-03 让 ...
- 【原创】面向对象作业:选课系统中用pickle储存多个对象间组合引用关系的那些坑
转载请注明出处:https://www.cnblogs.com/oceanicstar/p/9030121.html 想直接看结论先提前列出: 1.存储一个对象,文件不是真的给你存储的了对象这种东西, ...
- centos7 openvpn代理搭建
系统环境:centos7.1 拨号ip地址:125.112.194.40(公网) server端部署 一.准备工作 1.检查SELinux状态,关闭 sed -i 's/enforcing/disab ...