List Domain Controllers with PowerShell
Active Directory administrators can use PowerShell to enumerate domain controllers reliably by querying AD with Get-ADDomainController and filtering results by site, operating system, role, or replication status. This approach works across single-domain and multi-domain forests without third-party modules, provided you run commands from a domain-joined machine with the RSAT AD PowerShell tools installed and have the appropriate read permissions. The results can be formatted, exported to CSV, or passed into scripts that monitor replication health, track OS build levels, or validate that specific DC roles are online in given sites.
More from this site
Keep reading the latest coverage
Core Cmdlets and Syntax
The primary cmdlet is Get-ADDomainController from the ActiveDirectory module. Pipe it to Format-Table or Select-Object to control what fields appear, and use -Filter or Where-Object to narrow results. Common properties include Name, HostName, IPv4Address, OperatingSystem, Site, IsGlobalCatalog, and DsaGuid. For non-DC AD computers, you can also query Get-ADComputer with a LDAP filter that targets userAccountControl flags or check dNSHostName against known DC naming conventions, but Get-ADDomainController is the direct and supported method.
Common One-Liners
- List all DCs in the current domain: Get-ADDomainController -Filter * | Format-Table Name, HostName, IPv4Address, OperatingSystem, Site, IsGlobalCatalog
- List DCs in a specific site: Get-ADDomainController -Filter {Site -eq "Default-First-Site-Name"} | Format-Table Name, HostName, IPv4Address, OperatingSystem
- List only global catalog servers: Get-ADDomainController -Filter {IsGlobalCatalog -eq $true} | Format-Table Name, HostName, IPv4Address, OperatingSystem
- Export to CSV: Get-ADDomainController -Filter * | Select-Object Name, HostName, IPv4Address, OperatingSystem, Site, DsaGuid | Export-Csv -Path .\dcs.csv -NoTypeInformation
- Find DCs by OS version: Get-ADDomainController -Filter * | Where-Object { $_.OperatingSystem -like "*Windows Server 2019*" } | Format-Table Name, HostName, IPv4Address
- List DCs with replication status: Get-ADDomainController -Filter * | Select-Object Name, HostName, IPv4Address, Site, @{N='LastReplicationSuccess';E={$_.LastSuccessfulReplication}} | Format-Table -AutoSize
Filtering and Formatting Tips
Use -Filter server-side when possible because it limits data transfer and improves performance. Use Where-Object for client-side checks where the property is not supported in server-side filtering or when you need complex logic. Combine Select-Object to keep output narrow, and use -ExpandProperty when you need a single scalar value such as a domain controller's GUID or IP address. For example, (Get-ADDomainController -Identity DC01).IPv4Address returns the IP directly. When building scripts, parameterize the domain or site name so you can reuse the same commands across environments.
Permissions and Requirements
You need an account with read access to Active Directory and the RSAT-AD-PowerShell feature (built into Windows Server and the AD module for Windows 10/11). Domain-joined is ideal; from a non-domain-joined workstation, bind explicitly with -Credential and ensure the target allows LDAP/ADWS connections. For workgroup scenarios, you can use Get-ADDomainController -Discover to locate a DC in a specified domain, then query that DC directly.
| Scenario | Command | Notes |
|---|---|---|
| All DCs in forest | Get-ADDomainController -Filter * | ft Name,HostName,IPv4Address,Site | Reads from the current domain unless a different server is specified |
| Single DC by name | Get-ADDomainController -Identity DC01 | Returns one DC object; use .NET properties like .SiteName or .Domain |
| Discover DCs in domain | Get-ADDomainController -Discover -DomainName contoso.com | Works from non-domain-joined machines with credentials |
| Replication summary | Get-ADReplicationFailure -Target DC01 -Scope Server | Format-Table | Requires AD PowerShell and read access to replication data |
| Export DC list | Get-ADDomainController -Filter * | Export-Csv dcs.csv -NoTypeInformation | Easily imported to other tools or reports |
Scripting and Automation
Wrap the commands in a function to standardize output across your environment. A minimal pattern: accept a site or server name as a parameter, call Get-ADDomainController with -Filter using that parameter, and return the object to the pipeline. This lets you combine discovery with alerts or scheduled reports. For example, a function can return DCs that have not replicated successfully in a set time window, or confirm that expected DC roles exist in the correct AD sites before application deployments. Keep the function generic so the same script works for production and test domains by passing the domain or site name as a parameter.
Common Errors and Checks
If the command returns nothing, verify the ActiveDirectory module is imported and the account has read permissions. Check firewall and LDAP/ADWS ports (389/636/9389) if running remotely. For forest-wide searches, ensure you are querying a Global Catalog or a writable DC in each domain when gathering cross-domain data. When filtering by site, confirm the site name matches AD Sites and Services exactly; typos or extra spaces will produce empty results. Test locally first with Get-ADDomainController -Filter * to verify connectivity before adding complex Where-Object logic.