Active Directory Cmdlets (Get-AD*)
Overview
Official Microsoft Active Directory module cmdlets (RSAT / domain-joined Windows). Require:
Import-Module ActiveDirectory
# Or on DC / with RSAT installed — auto-loadedOSCP use: When you have a domain-joined shell or RSAT — structured LDAP queries without PowerView. Linux equivalent: ldapsearch, CrackMapExec - nxc ldap, Impacket.
Not installed? Use PowerView, net user, Bloodhound + Sharphound.
📌 Common Parameters (All Get-AD* Cmdlets)
| Parameter | Description |
|---|---|
-Identity | SamAccountName, DN, GUID, or SID |
-Filter | LDAP filter string — most important |
-Properties | Extra attributes to return — * = all |
-SearchBase | Start search at OU DN |
-SearchScope | Base, OneLevel, Subtree |
-ResultSetSize | Max results ($null = unlimited) |
-Server | Target DC hostname/IP |
-Credential | Alternate creds [PSCredential] |
-Partition | AD partition |
Filter syntax examples
-Filter * # All objects
-Filter "Name -like 'admin*'"
-Filter "SamAccountName -eq 'jsmith'"
-Filter "Enabled -eq `$true"
-Filter "servicePrincipalName -like '*'"
-Filter "userAccountControl -band 4194304" # DONT_REQ_PREAUTH (AS-REP)📌 1) Get-ADUser
Get-ADUser -Filter *
Get-ADUser -Identity jsmith
Get-ADUser -Filter "Enabled -eq `$true" -Properties *
Get-ADUser -Filter "servicePrincipalName -like '*'" -Properties servicePrincipalName
Get-ADUser -Filter * -Properties PasswordLastSet, LastLogonDate, MemberOf| Use | Filter / Properties |
|---|---|
| All users | -Filter * |
| Kerberoast targets | -Filter "servicePrincipalName -like '*'" -Properties servicePrincipalName |
| AS-REP roast | -Filter "userAccountControl -band 4194304" -Properties userAccountControl |
| Password never expires | -Filter "PasswordNeverExpires -eq $true”` |
Export sam names:
Get-ADUser -Filter * | Select-Object -ExpandProperty SamAccountName > users.txt📌 2) Get-ADComputer
Get-ADComputer -Filter *
Get-ADComputer -Identity WS01
Get-ADComputer -Filter "OperatingSystem -like '*Server*'" -Properties OperatingSystem, IPv4Address
Get-ADComputer -Filter * -Properties DnsHostName, Enabled, LastLogonDate| Use | Command |
|---|---|
| All computers | Get-ADComputer -Filter * |
| Domain controllers | Get-ADComputer -Filter {PrimaryGroupId -eq 516} |
| Unconstrained delegation | -Filter "TrustedForDelegation -eq $true” -Properties TrustedForDelegation` |
| LAPS password read | Check ms-Mcs-AdmPwd if you have rights |
📌 3) Get-ADGroup & Get-ADGroupMember
Get-ADGroup -Filter *
Get-ADGroup -Identity "Domain Admins"
Get-ADGroupMember -Identity "Domain Admins"
Get-ADGroupMember -Identity "Domain Admins" -Recursive
Get-ADGroup -Filter "GroupCategory -eq 'Security'" | Select NameHigh-value groups to query:
"Domain Admins","Enterprise Admins","Administrators","Account Operators",
"Backup Operators","Server Operators","Remote Desktop Users","DNS Admins"📌 4) Get-ADDomain / Get-ADForest
Get-ADDomain
Get-ADDomain | Select-Object DNSRoot, DomainControllers, PDCEmulator, RIDMaster
Get-ADDomain -Identity corp.local
Get-ADForest
Get-ADForest | Select-Object Domains, GlobalCatalogs
Get-ADTrust -Filter *Password policy:
Get-ADDefaultDomainPasswordPolicy
Get-ADFineGrainedPasswordPolicy -Filter *Compare: net accounts /domain, nxc smb --pass-pol
📌 5) Get-ADOrganizationalUnit
Get-ADOrganizationalUnit -Filter *
Get-ADOrganizationalUnit -SearchBase "DC=corp,DC=local" -Filter *📌 6) Get-ADObject (Generic)
Any AD object type:
Get-ADObject -Filter *
Get-ADObject -Filter "objectClass -eq 'groupPolicyContainer'" -Properties DisplayName
Get-ADObject -LDAPFilter "(adminCount=1)" -Properties *adminCount=1 — protected (high-value) objects.
📌 7) Write / Modify Cmdlets (Needs Privileges)
| Cmdlet | Action |
|---|---|
New-ADUser | Create user |
Set-ADAccountPassword | Reset password |
Add-ADGroupMember | Add to group |
Remove-ADGroupMember | Remove from group |
Set-ADUser | Modify attributes |
New-ADComputer | Add computer account |
Move-ADObject | Move OU |
New-ADUser -Name hacker -SamAccountName hacker -AccountPassword (ConvertTo-SecureString 'P@ss123!' -AsPlainText -Force) -Enabled $true
Add-ADGroupMember -Identity "Domain Admins" -Members hacker
Set-ADAccountPassword -Identity jsmith -Reset -NewPassword (ConvertTo-SecureString 'NewPass1!' -AsPlainText -Force)📌 8) Get-AD* vs PowerView vs Linux
| Task | Get-AD* | PowerView | Linux |
|---|---|---|---|
| All users | Get-ADUser -Filter * | Get-DomainUser | ldapsearch, nxc ldap --users |
| Kerberoast SPNs | -Filter "servicePrincipalName -like '*'" | Get-DomainUser -SPN | Kerberoast |
| Domain Admins | Get-ADGroupMember "Domain Admins" | Get-DomainGroupMember | Bloodhound + Sharphound |
| Computers | Get-ADComputer -Filter * | Get-DomainComputer | nxc ldap --computers |
See PowerView, ldapsearch, Kerberoast.
📌 Quick Cheat Sheet
Import-Module ActiveDirectory
Get-ADDomain
Get-ADUser -Filter * | Select SamAccountName
Get-ADUser -Filter "servicePrincipalName -like '*'" -Properties servicePrincipalName
Get-ADGroupMember "Domain Admins"
Get-ADComputer -Filter * -Properties OperatingSystem
Get-ADDefaultDomainPasswordPolicy
Get-ADTrust -Filter *