PowerShell Active Directory Reference
A professional collection of modern PowerShell 7 scripts for Active Directory administration — covering the full lifecycle from user provisioning to domain replication health and database-level recovery.
26
Scripts
8
Categories
PS7
Minimum
RSAT
Required
Disclaimer:
All scripts are provided for technical reference and educational purposes only. The author accepts no responsibility for any consequences arising from their use in production or non-production environments. Always test in an isolated lab before deploying to a live domain.
Prerequisites & Requirements
General Requirements (All Scripts)
- Windows — these scripts are Windows-only
- PowerShell 7.0+ — install from
winget install Microsoft.PowerShell - RSAT AD Module — Windows 10/11: install from Optional Features
- Domain membership — host must be joined to the target AD domain
- Run as Administrator — all scripts require elevated privileges
# Install RSAT on Windows 10/11 Add-WindowsCapability -Online ` -Name 'Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0' # Install RSAT Group Policy tools (GPO scripts) Add-WindowsCapability -Online ` -Name 'Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0'
Domain Controller Only
- Invoke-ADSnapshotManager requires a Domain Controller
- Needs ntdsutil.exe and dsamain.exe (installed with AD DS)
- Snapshot creation requires sufficient VSS storage space
- Mount operations require a free TCP port (default: 50000)
- Use
Invoke-Command -ComputerName <DC>to run remotely
# Check VSS storage
vssadmin list shadowstorage
# Verify ntdsutil is present (on DC)
Get-Command ntdsutil.exe
# Run snapshot manager remotely
Invoke-Command -ComputerName DC01 -ScriptBlock {
& ".\Invoke-ADSnapshotManager.ps1" -Action List
}
Script Categories
| Category | Scripts | Quick Access |
|---|---|---|
| User Lifecycle | 5 |
Get-ADUserAuditReport
Invoke-ADUserDeprovisioning
New-ADUserBulkProvisioning
Set-ADUserBulkAttributes
Get-ADInactiveUsers
|
| Group Management | 5 |
Export-ADGroupMembership
Get-ADNestedGroupMembership
Invoke-ADGroupAudit
Remove-ADStaleGroupMemberships
Sync-ADGroupFromCSV
|
| Computer Management | 4 |
New-ADBulkComputerAccounts
Invoke-ADComputerDeprovisioning
Get-ADComputerOSInventory
Get-ADComputerStaleAccounts
|
| OU & Object Management | 3 |
Get-ADOUStructure
Move-ADObjectsByAttribute
Protect-ADObjectDeletion
|
| GPO Operations | 3 |
Get-ADGPOLinkReport
Export-ADGPOBackup
Get-ADLinkedGPOsByOU
|
| Domain & Replication | 3 |
Get-ADReplicationStatus
Get-ADDomainControllerInventory
Get-ADSiteTopology
|
| Security & Forensics | 2 |
Get-ADPrivilegedGroupMembers
Get-ADPasswordPolicyReport
|
| Database Recovery | 1 |
Invoke-ADSnapshotManager
|
User Lifecycle Management
5 scriptsGet-ADUserAuditReport.ps1
Generates a comprehensive audit report of user accounts covering account status, password age, last logon date, group membership count, and inactive-account flagging. Supports OU scoping and CSV export.
Invoke-ADUserDeprovisioning.ps1
Executes a complete user deprovisioning workflow: disables the account, removes group memberships (preserving Domain Users), moves to a Disabled OU, and stamps a dated description note. Supports single user or bulk CSV input.
New-ADUserBulkProvisioning.ps1
Provisions user accounts in bulk from a CSV file with secure random password generation, UPN assignment, group membership, and per-run results export. Detects duplicate accounts automatically.
Set-ADUserBulkAttributes.ps1
Updates any writable AD user attribute in bulk from a CSV file. Each CSV column maps to an AD attribute. Validates user existence before applying and reports per-user success or failure.
Get-ADInactiveUsers.ps1
Identifies enabled user accounts inactive beyond a configurable threshold. Supports OU exclusions, SamAccountName pattern exclusions, and optionally flags accounts that have never logged on.
Group Management
5 scriptsExport-ADGroupMembership.ps1
Exports membership data for one or more groups with optional recursive nested resolution. Accepts pipeline input of group names. Outputs CSV or JSON with member type, status, and department.
Get-ADNestedGroupMembership.ps1
Resolves the complete nested group membership tree for a user or group, traversing the memberOf hierarchy recursively. Detects and reports circular references. Returns depth and parent chain for each group.
Invoke-ADGroupAudit.ps1
Audits all groups for empty membership, nested group members, sole-member groups, and privileged group status. Returns structured audit flags per group for compliance reporting.
Remove-ADStaleGroupMemberships.ps1
Scans group memberships for disabled accounts and orphaned DNs (deleted objects still referenced). Reports all stale entries and removes them on commit. Skips protected built-in groups.
Sync-ADGroupFromCSV.ps1
Synchronizes group membership to a CSV-defined desired state. Adds missing members and removes extra members not in the CSV. Protected accounts (Administrator, krbtgt) are never removed.
Computer Management
4 scriptsNew-ADBulkComputerAccounts.ps1
Creates pre-staged computer accounts in bulk from a CSV with name, target OU, description, managed-by, and group membership. Detects existing accounts and skips them rather than failing.
Invoke-ADComputerDeprovisioning.ps1
Deprovisions computer accounts: disables the account, removes group memberships (excluding Domain Computers), moves to a Decommission OU, and stamps a dated description note. Supports single or bulk CSV mode.
Get-ADComputerOSInventory.ps1
Generates an OS inventory from AD computer account attributes — no WinRM connectivity required. Flags potentially end-of-life operating systems (XP, Vista, 2003, 2008, Windows 7, etc.).
Get-ADComputerStaleAccounts.ps1
Identifies computer accounts that have not authenticated to a DC within a configurable threshold. Automatically excludes domain controllers. Supports pattern-based exclusions and CSV export.
OU & Object Management
3 scriptsGet-ADOUStructure.ps1
Renders the complete OU hierarchy as an indented tree in the console, or returns flat objects with depth metadata. Optional object count per OU (users, computers, groups). Supports CSV export.
Move-ADObjectsByAttribute.ps1
Moves user or computer objects to target OUs based on attribute-value rules defined in a CSV mapping file. First matching rule applies. Useful for OU restructuring and post-HR-feed migrations.
Protect-ADObjectDeletion.ps1
Enables or disables the ProtectedFromAccidentalDeletion flag on OUs, users, computers, or groups. Supports single-object or bulk OU-scoped application. Reports before/after state per object.
GPO Operations
3 scriptsGet-ADGPOLinkReport.ps1
Reports all GPO links across all OUs and the domain container. Parses the gpLink attribute to surface link order, enforced/disabled status, and GPO enabled state. No GPMC GUI required.
Export-ADGPOBackup.ps1
Backs up all or specified GPOs to a timestamped directory using Backup-GPO. Generates a manifest CSV and optionally compresses the backup to a ZIP archive for archival or migration.
Get-ADLinkedGPOsByOU.ps1
Lists all GPOs linked to a specific OU and optionally its child OUs. Resolves GPO names from GUIDs and reports link order, enforced and enabled flags per OU.
Domain & Replication Health
3 scriptsGet-ADReplicationStatus.ps1
Queries replication metadata for all directory partitions across all domain controllers. Flags failed partners, consecutive failure counts, and replication lag above a configurable threshold (default: 60 min).
Get-ADDomainControllerInventory.ps1
Inventories all domain controllers with OS version, FSMO role assignments, site membership, Global Catalog status, RODC detection, and network reachability. Exportable to CSV.
Get-ADSiteTopology.ps1
Reports the complete AD Sites and Services topology: all sites, subnet assignments, and site link objects with cost and replication frequency. Outputs a console tree and optionally three category CSVs.
Security & Forensics
2 scriptsGet-ADPrivilegedGroupMembers.ps1
Enumerates all members of 11 privileged built-in groups (Domain Admins, Enterprise Admins, Schema Admins, etc.) with optional nested resolution. Flags disabled accounts and non-expiring passwords.
Get-ADPasswordPolicyReport.ps1
Reports the Default Domain Password Policy and all Fine-Grained Password Policy (PSO) objects with their subjects. Optionally computes the effective resultant policy per user in a given OU.
Database Recovery
1 scriptEssential — DC Only
Invoke-ADSnapshotManager.ps1
Manages the complete Active Directory database snapshot lifecycle using the built-in
ntdsutil snapshot facility and dsamain.exe. Enables object-level and attribute-level
recovery from a point-in-time snapshot without rebooting any domain controller or
performing an authoritative restore. This is the preferred recovery path for
accidentally deleted or modified AD objects in Windows Server 2008 R2 and later.
- New-ADDatabaseSnapshot — Create a VSS snapshot of the live NTDS database with disk space pre-check
- Get-ADDatabaseSnapshot — List all available snapshots via ntdsutil; optional VSS query mode
- Mount-ADDatabaseSnapshot — Mount snapshot on a free LDAP port via dsamain.exe with 30s ready wait
- Dismount-ADDatabaseSnapshot — Stop dsamain and unmount the snapshot cleanly
- Remove-ADDatabaseSnapshot — Permanently delete old snapshots (requires -Commit)
- Repair-ADObjectAttribute — Restore a specific attribute value from snapshot to live directory (dry-run default)
- Repair-ADUserGroupMembership — Restore a user's group membership delta from snapshot (dry-run default)