Learn Active Directory - PowerShell for Active Directory

#Introduction

In episode 7 you created users, groups, and OUs one by one through the ADUC console — and you may have felt how exhausting that is once you reach dozens. Episode 8 reveals the real weapon: PowerShell for Active Directory. With the ActiveDirectory module, work that takes an hour through the GUI finishes in seconds — and more importantly, it's repeatable with identical results every time.

We'll cover: installing and loading the module, read/write cmdlets like Get-ADUser and Set-ADUser, filter and search techniques, account status management, discovering computers, groups, and domain controllers, and a real-world case study of creating hundreds of users from a single CSV file with a safe script.

#Installing and Loading the ActiveDirectory Module

AD cmdlets live in the ActiveDirectory module, which ships with the RSAT-AD-PowerShell feature:

Install-WindowsFeature RSAT-AD-PowerShell
Import-Module ActiveDirectory

On a Windows Server with the AD DS role, this module is already installed automatically. To confirm all cmdlets are available:

Get-Command -Module ActiveDirectory | Measure-Object

There are hundreds of cmdlets, but you only need to master a few dozen of the most frequently used ones. PowerShell AD's strength isn't in the count, but in its pipeline: one cmdlet's output can be directly filtered, transformed, or piped into another cmdlet.

#Get-ADUser: Reading Accounts

The most basic cmdlet is Get-ADUser:

Get-ADUser -Identity budi.santoso -Properties Department, Title, LastLogonDate
Get-ADUser -Filter * -SearchBase "OU=Karyawan,DC=ad,DC=example,DC=com"

Notice two things. First, -Properties is required to read attributes not carried by the default query — without it, attributes like Department show up empty. Second, -SearchBase restricts the search to one OU, preventing results from exploding in a large domain. Don't make a habit of -Filter * without limits in production — in a directory with hundreds of thousands of objects, such a query burdens the DC.

#Filters and Searching

The -Filter parameter uses the AD module's own syntax, not regular PowerShell syntax:

Get-ADUser -Filter 'Name -like "Budi*"' -Properties LastLogonDate
Get-ADUser -Filter 'Enabled -eq $true' | Select-Object Name, SamAccountName

For more precise queries, use -LDAPFilter with native LDAP syntax — e.g. (&(objectClass=user)(department=IT)). An important rule: filter as early as possible on the directory side (the -Filter or -LDAPFilter parameters) rather than fetching all objects and filtering them in PowerShell with Where-Object. DCs have indexes for common attributes; using them is far more efficient.

#Set-ADUser: Modifying Accounts

Modifying attributes is done with Set-ADUser:

Set-ADUser -Identity budi.santoso -Department "IT" -Title "System Administrator"
Set-ADUser -Identity budi.santoso -Add @{extensionAttribute5="KaryawanKontrak"}

The -Add parameter adds values to a multivalued attribute, -Replace replaces values, and -Clear empties them. Combining Get-ADUser with a filter piped into Set-ADUser is the most powerful automation pattern — for example, changing the department of a hundred users at once with a single command.

#Managing Account Status

Account lifecycle is handled by dedicated cmdlets:

Disable-ADAccount -Identity budi.santoso
Enable-ADAccount -Identity budi.santoso
Unlock-ADAccount -Identity budi.santoso

Reset passwords with Set-ADAccountPassword:

Set-ADAccountPassword -Identity budi.santoso -Reset -NewPassword (ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force)

Note that the status cmdlets follow a consistent pattern: Enable, Disable, Unlock. This aligns with the PowerShell Verb-Noun philosophy — once you know one, the rest can be guessed.

#Discovering Computers and Groups

Get-ADComputer finds computer objects:

Get-ADComputer -Filter 'OperatingSystem -like "Windows 11*"' -Properties OperatingSystem
Get-ADComputer -Identity PC-001 | Select-Object Name, Enabled, LastLogonDate

This is very useful for audits: a list of all computers inactive for 90 days can trigger a cleanup. For groups:

Get-ADGroup -Filter * | Select-Object Name, GroupScope, GroupCategory
Get-ADGroupMember -Identity "Domain Admins" | Select-Object Name, ObjectClass

#Discovering Domain Controllers

During troubleshooting, you often need to know which DC is currently serving the domain:

Get-ADDomainController -Filter * | Select-Object Name, Site, IPv4Address
Get-ADDomainController -Discover -Service GlobalCatalog

The first command lists all DCs; the second mimics the same process a client runs when looking for the nearest GC. This is an excellent debugging tool for the "why is login slow in a particular location" problem — the answer is often that the targeted DC is far away.

#Case Study: Bulk User Creation from CSV

Now let's put it all together. We'll create many users from a single CSV file. The file structure:

Username,NamaDepan,NamaBelakang,Password
budi.santoso,Budi,Santoso,P@ssw0rd
siti.rahayu,Siti,Rahayu,P@ssw0rd
eko.prasetyo,Eko,Prasetyo,P@ssw0rd

The import script:

$users = Import-Csv -Path "C:\users.csv"
 
foreach ($u in $users) {
    $securePassword = ConvertTo-SecureString -String $u.Password -AsPlainText -Force
    try {
        New-ADUser `
            -Name "$($u.NamaDepan) $($u.NamaBelakang)" `
            -GivenName $u.NamaDepan `
            -Surname $u.NamaBelakang `
            -SamAccountName $u.Username `
            -UserPrincipalName "$($u.Username)@ad.example.com" `
            -Path "OU=Karyawan,DC=ad,DC=example,DC=com" `
            -AccountPassword $securePassword `
            -Enabled $true
        Write-Host "OK: $($u.Username)" -ForegroundColor Green
    } catch {
        Write-Host "FAILED: $($u.Username)" -ForegroundColor Red
    }
}

A pattern you can replicate: Import-Csv reads rows into objects, foreach iterates each row, and try-catch ensures one failure (e.g. a duplicate username) doesn't stop the whole process. The result: a hundred users created in one command — work that could take hours through the GUI.

#Good Automation Patterns

Some patterns you'll use again and again:

• Splatting — group parameters in a hashtable then call the cmdlet with @name. It makes long scripts readable.
• Pipeline — chain Get-ADUser and Set-ADUser for mass changes without loops.
• Functions — wrap recurring routines into functions so they can be reused.
• Error handling — always anticipate failure; in a bulk context, one error shouldn't fail everything.

#Conclusion

Episode 8 transforms you from a click-and-fill admin into an automating admin: installing and loading the ActiveDirectory module, reading accounts with Get-ADUser, modifying attributes with Set-ADUser, managing account status, discovering computers and groups, tracing domain controllers, and creating hundreds of users from a CSV with a robust script.

Key takeaways:

• Filter on the directory side, not in PowerShell — the DC has indexes for that.
• -Properties is required to read non-default attributes.
• The Import-Csv + foreach + try-catch pattern is the heart of bulk operations.
• -WhatIf is your best friend before mass changes.

Now you can manage objects at scale. But managing objects alone isn't enough — how do you centrally govern the behavior of all machines and users? In episode 9 we enter the heart of Windows administration: Group Policy Fundamentals. See you in episode 9!