Learn PowerShell - Active Directory Management

#Introduction

In episode 17 we dissected COM objects and .NET integration — PowerShell's ability to call external components and leverage .NET libraries directly from the console. That foundation is what makes PowerShell not just a scripting language, but a "controller for all of Windows". Now we step up to a more strategic domain: Active Directory (AD).

AD is the phone book and identity card of an entire organization: who the users are, what groups they belong to, which computers are registered, and which organizational units they live under. With 500 employees, managing accounts one by one through the GUI — click, fill the form, click again — isn't just slow, it's a recipe for inconsistency and security gaps. This episode teaches how real administrators manage AD: fast, accurate, and repeatable at any time.

#Why PowerShell for AD?

Bulk operations. Creating, resetting passwords, or disabling 300 accounts only takes one command and one list of names.
Consistency. The same script produces the same output — no "forgot to tick the box" variations.
Audit trail. Every command can be logged. Who did what, when, and with which script.

The module you need is called ActiveDirectory. All its cmdlets strictly follow the Verb-Noun pattern: Get-ADUser, New-ADUser, Set-ADUser, Remove-ADUser, and so on. Master one cmdlet family, and the others just need adjusting the object name.

#Preparation: RSAT and the ActiveDirectory Module

The ActiveDirectory module isn't available on Windows client by default; you need RSAT (Remote Server Administration Tools). On Windows Server with the AD DS role the module is already installed; on Windows 10/11 Pro or Enterprise, enable RSAT via Optional Features, then run Import-Module ActiveDirectory. Verify the module:

Verifying the ActiveDirectory module

Get-Command -Module ActiveDirectory | Select-Object -First 10 Name, CommandType
Get-Module -ListAvailable ActiveDirectory

#Connecting to a Domain Controller

The module finds the nearest Domain Controller (DC) automatically. To confirm which DC is in use — or to target a specific DC — use Get-ADDomainController and the -Server parameter:

Viewing DCs and targeting a specific DC

Get-ADDomainController -Filter * | Select-Object Name, Site, Domain
Get-ADUser -Identity "jsantoso" -Server "dc01.corp.local"

Tip

Before testing any AD cmdlet, make sure of three things: your account has administrative rights in the domain, the computer is connected to the domain network, and the system time is synchronized with the DC. Mysterious Kerberos authentication errors almost always stem from these three.

#User Management

#Reading User Data

The most used cmdlet in this family is Get-ADUser. By default it only returns basic attributes; add -Properties for deeper attributes:

Reading user data

Get-ADUser -Filter "Enabled -eq 'true'" -SearchBase "OU=Karyawan,DC=corp,DC=local" -Properties LastLogonDate, PasswordLastSet |
    Select-Object SamAccountName, DisplayName, Enabled, LastLogonDate

The -Filter "Enabled -eq 'true'" pattern is much faster than fetching all users then filtering in the pipeline — AD filters on the server side, not the client side.

#Creating a New User

New-ADUser creates an account. A pattern you must remember: the password must first be converted to a SecureString with ConvertTo-SecureString:

Creating a new user

$secure = ConvertTo-SecureString "S3cureP@ss2026" -AsPlainText -Force
 
New-ADUser -Name "Joko Santoso" `
    -SamAccountName "jsantoso" `
    -GivenName "Joko" `
    -Surname "Santoso" `
    -UserPrincipalName "jsantoso@corp.local" `
    -Path "OU=Karyawan,DC=corp,DC=local" `
    -AccountPassword $secure `
    -Enabled $true

#Updating, Enabling, and Disabling

Set-ADUser changes attributes; Enable-ADAccount and Disable-ADAccount control account status:

Updating attributes and account status

Set-ADUser -Identity "jsantoso" -Department "IT" -Title "Network Engineer"
Disable-ADAccount -Identity "jsantoso"
Enable-ADAccount -Identity "jsantoso"

#Resetting Passwords and Unlocking Accounts

Users forgetting passwords and accounts locked from repeated wrong passwords are daily helpdesk tasks:

Resetting a password and unlocking an account

$secure = ConvertTo-SecureString "P@sswordBaru2026" -AsPlainText -Force
 
Set-ADAccountPassword -Identity "jsantoso" -NewPassword $secure -Reset
Set-ADUser -Identity "jsantoso" -ChangePasswordAtLogon $true
Unlock-ADAccount -Identity "jsantoso"

-ChangePasswordAtLogon forces the user to change their password at the next login — mandatory every time you reset someone else's password.

#Deleting Users

Remove-ADUser deletes an account from the directory:

Deleting a user (with confirmation)

Remove-ADUser -Identity "jsantoso" -Confirm:$true

Deletion in AD is permanent. Good team discipline: disable first (for example 30 days), then delete after the grace period has passed — the account can still be restored if it turns out it's still needed.

Important

Before any mass deletion, always check what will be deleted first: run Get-ADUser with the same filter, save the results to a file, and use that list as a reference. In AD, the "destroy everything" command is far cheaper to run than to fix.

#Group Management

Groups are how AD organizes permissions collectively: instead of giving access to 50 users one by one, create one group, put the 50 users in it, then give access to that group:

Creating a group and managing membership

New-ADGroup -Name "IT-Support" -GroupScope Global -Path "OU=Grup,DC=corp,DC=local"
 
Add-ADGroupMember -Identity "IT-Support" -Members "jsantoso","dwilestari","ahmadf"
Get-ADGroupMember -Identity "IT-Support" | Select-Object Name, SamAccountName
Remove-ADGroupMember -Identity "IT-Support" -Members "dwilestari" -Confirm:$false

Add-ADGroupMember and Remove-ADGroupMember accept member lists; Get-ADGroupMember reads a group's contents; Get-ADGroup searches for groups by filter.

#Computer and OU Management

#Computers

Computer accounts are just as important as user accounts — every device joined to the domain has one:

Reading, creating, and deleting computer accounts

Get-ADComputer -Filter * -Properties OperatingSystem, LastLogonDate |
    Select-Object Name, OperatingSystem, LastLogonDate
 
New-ADComputer -Name "WS-021" -Path "OU=Workstation,DC=corp,DC=local"
Set-ADComputer -Identity "WS-021" -Description "Workstation Divisi HRD"
Remove-ADComputer -Identity "WS-021" -Confirm:$false

#Organizational Units

An OU is AD's "folder" for organizing objects and the boundary for delegating permissions:

Creating and managing OUs

New-ADOrganizationalUnit -Name "Marketing" -Path "DC=corp,DC=local" -ProtectedFromAccidentalDeletion $true
Get-ADOrganizationalUnit -Filter * | Select-Object Name, DistinguishedName
Set-ADOrganizationalUnit -Identity "OU=Marketing,DC=corp,DC=local" -Description "Divisi Pemasaran"

-ProtectedFromAccidentalDeletion $true is a built-in guard so the OU (and everything in it) can't be deleted accidentally — make a habit of always enabling it.

#Bulk Operations from CSV

This is the moment where PowerShell truly beats the GUI. Suppose HR sends a users.csv file containing a list of new employees.

#Creating Many Users at Once

Bulk create users from CSV

$users = Import-Csv -Path "C:\Data\users.csv"
 
foreach ($u in $users) {
    $secure = ConvertTo-SecureString $u.Password -AsPlainText -Force
 
    New-ADUser -Name ($u.NamaDepan + " " + $u.NamaBelakang) `
        -GivenName $u.NamaDepan `
        -Surname $u.NamaBelakang `
        -SamAccountName $u.Username `
        -UserPrincipalName ($u.Username + "@corp.local") `
        -Path "OU=Karyawan,DC=corp,DC=local" `
        -AccountPassword $secure `
        -Enabled $true
}

Import-Csv turns each file line into an object; the Username, NamaDepan, NamaBelakang, and Password columns are accessed as $u.Username and so on.

#Bulk Password Reset

All accounts older than 90 days are reset and forced to change their password at login:

Bulk password reset

$list = Get-Content -Path "C:\Data\username.txt"
$secure = ConvertTo-SecureString "Reset#2026" -AsPlainText -Force
 
foreach ($user in $list) {
    Set-ADAccountPassword -Identity $user -NewPassword $secure -Reset
    Set-ADUser -Identity $user -ChangePasswordAtLogon $true
}

#Automated Reporting

With one pipeline, you produce a report ready to send to management:

User status report to CSV

Get-ADUser -Filter * -Properties LastLogonDate, PasswordLastSet |
    Select-Object SamAccountName, DisplayName, Enabled, LastLogonDate, PasswordLastSet |
    Export-Csv -Path "C:\Data\report-user.csv" -NoTypeInformation -Encoding UTF8

#Security and Best Practices

Never put raw passwords in stored scripts. Take them from a prompt (Get-Credential), a vault, or a restricted encrypted file — covered in depth in episode 22.
Test with -WhatIf first. Almost all AD cmdlets support -WhatIf to show the result without actually running it.
Work in a trial OU. Create a dedicated "Uji Coba" OU, run all scripts there, verify the results, only then apply to production.
Log every bulk operation. Save the input list, output, and timestamps to a log.

Warning

AD cmdlets run with your current PowerShell session credentials. If the logged-in account isn't a domain admin, commands will fail — or worse, partially succeed. Use Run as Administrator and make sure the account has exactly the rights needed, not excessive ones.

#Conclusion

In this episode 18 you've mastered managing Active Directory via PowerShell: preparing RSAT and the ActiveDirectory module, connecting to a Domain Controller, managing users (Get-ADUser, New-ADUser, Set-ADUser, Remove-ADUser, Enable-ADAccount, Disable-ADAccount, Set-ADAccountPassword, Unlock-ADAccount), groups (Get-ADGroup, New-ADGroup, Add-ADGroupMember, Remove-ADGroupMember, Get-ADGroupMember), computers and OUs, plus bulk operations from CSV: mass user creation, bulk password resets, and automated reporting.

Key takeaways:

All AD cmdlets follow the Verb-Noun pattern — master one family, master them all.
-Filter on the server side is far faster than filtering results in the pipeline.
Always convert passwords to SecureString before using them with AD cmdlets.
-WhatIf, a trial OU, and backed-up input lists are your seat belts.

You can now manage organizational identities from the console. The next question: how do you manage the machine's configuration itself? In the next episode, episode 19, we'll dissect Registry Management: viewing the Windows registry as a filesystem, reading and writing values via Get-ItemProperty and Set-ItemProperty, creating keys with New-Item, and backing up and manipulating the registry remotely. See you there!