Query Active Directory with PowerShell: Core Commands and Practical Patterns

Query Active Directory with PowerShell

Querying Active Directory with PowerShell means using the ActiveDirectory module to retrieve objects like users, computers, groups, and organizational units. The primary cmdlets are Get-ADUser, Get-ADComputer, Get-ADGroup, and Get-ADOrganizationalUnit, all part of the RSAT toolset. Once the module is available, a basic query such as Get-ADUser -Filter * returns every user object, while more targeted filters let you narrow results by name, email, department, or custom attributes. This is the foundation for reporting, auditing, and automation in Windows environments.

Before you can run these commands, the ActiveDirectory module must be installed and imported. On Windows 10 and 11, RSAT is delivered as an optional feature. You can install it through Settings, via Server Manager on a domain controller, or with the Add-WindowsCapability cmdlet. After installation, import the module with Import-Module ActiveDirectory. A simple test is Get-ADDomain, which returns your current domain object if permissions and connectivity are correct. Without the module loaded, every AD cmdlet will throw a command-not-found error.

Core Cmdlets for Querying AD

Each cmdlet targets a specific object class. Get-ADUser retrieves user accounts and supports filtering on properties like SamAccountName, DisplayName, EmailAddress, and Title. Get-ADComputer returns workstation and server objects, useful for finding stale or unauthorized machines. Get-ADGroup lists security and distribution groups, and with the -Members parameter you can expand group membership recursively. Get-ADOrganizationalUnit returns OU structure, which helps map delegation and policy scope.

Get-ADUser Examples

• Get-ADUser -Identity jsmith -Properties Email,Department
• Get-ADUser -Filter "Department -eq 'Sales'" -Properties Email
• Get-ADUser -Filter {Enabled -eq $false} -Properties LastLogonDate
• Get-ADUser -Filter "Name -like '*Smith*'"

Get-ADComputer and Get-ADGroup Examples

• Get-ADComputer -Filter "OperatingSystem -like 'Windows 10*'" -Properties LastLogonDate
• Get-ADGroup -Identity "VPN Users" -Members
• Get-ADGroup -Filter "GroupCategory -eq 'Security'"

Building LDAP and PowerShell Filters

The -Filter parameter accepts PowerShell expressions or LDAP query strings. PowerShell expressions are more readable for equality, like, and comparison operators. For complex conditions, LDAP filter syntax gives you access to attributes that do not map cleanly to cmdlet parameters. You can pass an LDAP string directly with -LDAPFilter, for example: -LDAPFilter "(&(objectClass=user)(memberOf=CN=VPN Users,OU=Groups,DC=contoso,DC=com))" to return only users in a specific group.

Common filter patterns include checking for empty attributes with -not (Attribute -like '*'), combining conditions with -and and -or, and using wildcard -like for partial matches. Always test filters on a small subset before running them against the entire directory, because broad queries with no filter can be slow and return large result sets.

Exporting Query Results

Piping results to Export-Csv is the standard way to save AD query output for reporting. Use Select-Object to choose only the columns you need, which keeps files small and readable. For example: Get-ADUser -Filter "Department -eq 'Engineering'" -Properties DisplayName,Email,LastLogonDate | Select-Object Name,Email,LastLogonDate | Export-Csv C:\Reports\engineers.csv -NoTypeInformation. You can also export to HTML with ConvertTo-Html or pipe to Out-GridView for interactive exploration in a GUI window.

Paging and Performance Considerations

By default, AD queries return up to 1,000 objects. If you expect more results, increase the page size with the -ResultSetSize parameter, set it to $null for unlimited, or use the -ResultPageSize parameter to control how many objects are fetched per LDAP page. For very large directories, narrow your filter early, request only needed properties with -Properties, and avoid returning the Member attribute on large groups, which can cause extremely large result sets and timeouts.

Troubleshooting Common Issues

If a query returns nothing, check three things: connectivity to a domain controller, the identity under which the command runs, and the filter syntax. Run Test-Connection to a DC and Test-ADDefaultPartition to confirm the directory is reachable. Permission errors often appear as access-denied messages when querying properties that are not in your read scope. Filter syntax errors are common when quotes are mismatched or when LDAP strings are missing the enclosing parentheses around the logical operator.

Summary of Common Patterns

When to Use LDAP Filter Instead

Use LDAPFilter when you need to query on attributes that are not exposed as cmdlet parameters, such as memberOf for group membership or when combining multiple conditions with logical AND and OR. LDAP queries are also required when searching across multiple domains or when you need to force a specific search base with -SearchBase and -SearchScope. For routine queries, PowerShell expression filters are faster to write and easier to read.