Search\Modify Objects

Search\Modify Objects

You can use the Active Directory module for Windows PowerShell to manage your search and modify operations on objects in Active Directory Domain Services (AD DS). The topics in this section explain how to use the Active Directory module to accomplish many of the common tasks that are associated with searching for and modifying objects in AD DS:

• Counting Objects in Active Directory
  
  
• Viewing the RootDSE
  
  
• Connecting to a Well-Known Container
  
  
• Searching for a Large Number of Objects
  
  
• Viewing the Attributes of an Object
  
  
• Searching with a Bitwise Filter
  
  
• Creating an Object
  
  
• Searching the Global Catalog
  
  
• Searching for Objects in a Domain
  
  
• Deleting a Container That Has Child Objects
  
  
• Modifying an Object
  
  
• Modifying a Bit Flag Attribute
  
  
• Connecting to an Object GUID
  
  
• Dynamically Linking an Auxiliary Class
  
  
• Refreshing a Dynamic Object
  
  
• Exporting Objects to a CSV File
  
  
• Importing Objects by Using a CSV File
  
  
• Referencing an External Domain
  
  
• Renaming an Object
  
  
• Moving an Object to a Different OU or Container
  
  
• Deleting an Object
  
  
• Viewing the Created and Last Modified Time Stamp of an Object
  
  
• Searching for Deleted Objects
  
  
• Restoring a Single Object
  
  
• Restoring a Container Object and Its Children
  
  
• Viewing the ACL for an Object
  

Restoring a Container Object and Its Children,

Restoring a Container Object and Its Children

This topic explains how to use the Active Directory module for Windows PowerShell to restore a container and its child objects in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to restore the deleted organizational unit (OU) Finance_Department in the Fabrikam.com domain:
Get-ADObject -ldapFilter:"(msDS-LastKnownRDN=Finance_Department)" –IncludeDeletedObjects | Restore-ADObject
You have to first restore the parent object and then restore the child objects because the container must be in place for the objects to be restored to their proper location. The following example demonstrates how to restore the deleted child objects of the OU Finance_Department:
Get-ADObject -SearchBase "CN=Deleted Objects,DC=Fabrikam,DC=com" -Filter {lastKnownParent -eq "OU=Finance_Department,DC=Fabrikam,DC=com"} -IncludeDeletedObjects | Restore-ADObject

Additional information

For a full explanation of the parameters that you can pass to Get-ADObject or Restore-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed or Get-Help Restore-ADObject –detailed, and then press ENTER.

Viewing the ACL for an Object

This topic explains how to use the Active Directory module for Windows PowerShell to view the access control list (ACL) for an object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to view the ACL for the user TempUser. In the following example, AD is the name of the Active Directory PowerShell drive that is connected to AD DS:
(Get-ACL 'AD:\CN=TempUser,CN=Users,DC=Fabrikam,DC=com').Access | ft IdentityReference,AccessControlType -A

Additional information

For a full explanation of the parameters that you can pass to Get-ACL, at the Active Directory module command prompt, type Get-Help Get-ACL –detailed, and then press ENTER.

Viewing the Created and Last Modified Time Stamp of an Object,Searching for Deleted Objects,Restoring a Single Object

Viewing the Created and Last Modified Time Stamp of an Object

This topic explains how to use the Active Directory module for Windows PowerShell to view the Created and Last Modified time stamp of an object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to view the Created and Last Modified time stamp of the organizational unit (OU) ManagedGroups in the Fabrikam.com domain:
Get-ADObject ManagedGroups -Properties Created,Modified

Additional information

For a full explanation of the parameters that you can pass to Get-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed, and then press ENTER.

Searching for Deleted Objects

This topic explains how to use the Active Directory module for Windows PowerShell to search for deleted objects in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to search for the deleted organizational unit (OU) Finance Department in the Fabrikam.com domain:
Get-ADObject -ldapFilter:"(msDS-LastKnownRDN=Finance_Department)" –IncludeDeletedObjects

Additional information

For a full explanation of the parameters that you can pass to Get-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed , and then press ENTER.

Restoring a Single Object

This topic explains how to use the Active Directory module for Windows PowerShell to restore a single object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to restore the deleted organizational unit (OU) Accounting_Department in the Fabrikam.com domain:
Get-ADObject -ldapFilter:"(msDS-LastKnownRDN=Accounting_Department)" –IncludeDeletedObjects | Restore-ADObject

Additional information

For a full explanation of the parameters that you can pass to Get-ADObject or Restore-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed or Get-Help Restore-ADObject –detailed, and then press ENTER.

Moving an Object to a Different OU or Container,Renaming,Deleting an Object

Renaming an Object

This topic explains how to use the Active Directory module for Windows PowerShell to rename an object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to rename the name attribute of the OU ManagedGroups to Groups:
Rename-ADObject "OU=ManagedGroups,OU=Managed,DC=Fabrikam,DC=Com" -NewName Groups

Additional information

The following property value is the value that is used in the renaming of an Active Directory object:

• NewName
  

For a full explanation of the parameters that you can pass to Rename-ADObject, at the Active Directory module command prompt, type Get-Help Rename-ADObject –detailed, and then press ENTER.

Moving an Object to a Different OU or Container

This topic explains how to use the Active Directory module for Windows PowerShell to move an object to a different organizational unit (OU) or container in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to move the user object Brad Sutton from the Users container to the OU Accounting in the Fabrikam.com domain:
Move-ADObject 'CN=Brad Sutton,CN=Users,DC=Fabrikam,DC=com' -TargetPath 'OU=Accounting,DC=Fabrikam,DC=com'

Additional information

For a full explanation of the parameters that you can pass to Move-ADObject, at the Active Directory module command prompt, type Get-Help Move-ADObject –detailed, and then press ENTER.

Deleting an Object

This topic explains how to use the Active Directory module for Windows PowerShell to delete an object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to delete the computer object AmyAl-LPTOP from AD DS:
Remove-ADObject 'CN=AmyAl-LPTOP,CN=Computers,DC=FABRIKAM,DC=COM'

Additional information

For a full explanation of the parameters that you can pass to Remove-ADObject, at the Active Directory module command prompt, type Get-Help Remove-ADObject –detailed, and then press ENTER.

Exporting Objects to a CSV File,Importing Objects by Using a CSV File,Referencing an External Domain

Exporting Objects to a CSV File

This topic explains how to use the Active Directory module for Windows PowerShell to export objects in Active Directory Domain Services (AD DS) to a comma-separated value (CSV) file.

Example

The following example demonstrates how to export the OU ManagedGroups and all its child objects to a CSV file:
Get-ADObject -Filter 'Name -like "*"' -Searchbase 'OU=ManagedGroups,DC=Fabrikam,DC=com' | Export-CSV ExportOU.csv

Additional information

In addition to the standard Lightweight Directory Access Protocol (LDAP) attributes, you can retrieve the following extended properties of the Get-ADObject cmdlet by using the -Properties parameter:

• ObjectClass
  
• Created
  
• Modified
  
• Deleted
  
• ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to Get-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed, and then press ENTER.

Importing Objects by Using a CSV File

This topic explains how to use the Active Directory module for Windows PowerShell to import objects from a comma-separated value (CSV) file into Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to import the organizational unit (OU) ManagedGroups and all its child objects from a CSV file:
Import-CSV ImportOU.csv | foreach {New-ADObject -Path $_.Path -Name $_.Name -Type $_.Type}

Additional information

The following parameters are the most commonly used parameters for creating Active Directory objects:

• -Description
  
• -DisplayName
  
• -ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to New-ADObject, at the Active Directory module command prompt, type Get-Help Get-NewObject –detailed, and then press ENTER.

Referencing an External Domain

This topic explains how to use the Active Directory module for Windows PowerShell to refer to an external domain in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to create a cross-reference to the Northwind.com domain in the Fabrikam.com domain:
New-ADObject -Name northwind -Type crossref -OtherAttributes @{NcName="DC=NORTHWIND,DC=COM";DnsRoot="northwind-dc1.northwind.com"} -Path 'CN=Partitions,CN=Configuration,DC=FABRIKAM,DC=COM' -Description 'A cross reference to the external domain northwind.com'

Additional information

The following property values are the most common values that are used in the creation of a new Active Directory object:

• Description
  
• DisplayName
  
• ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to New-ADObject, at the Active Directory module command prompt, type Get-Help New-ADObject –detailed, and then press ENTER.

Connecting to an Object GUID, Refreshing a Dynamic Object,Dynamically Linking an Auxiliary Class

Connecting to an Object GUID

This topic explains how to use the Active Directory module for Windows PowerShell to connect to an object’s globally unique identifier (GUID) in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to connect to the user object SaraDavis using the object’s GUID:
Get-ADObject -Identity ccc6c0f8-5dd9-42bc-93da-407c6f9695ef

Additional information

For a full explanation of the parameters that you can pass to Get-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed, and then press ENTER.

Dynamically Linking an Auxiliary Class

This topic explains how to use the Active Directory module for Windows PowerShell to dynamically link an auxiliary class in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to dynamically link the auxiliary class object member-Fabrikam-User to the user SaraDavis:
Set-ADObject SaraDavis -Add @{ObjectClass="Fabrikam-User"}

Additional information

You can use the following parameters when you set many of the common values of Active Directory objects:

• -Description
  
• -DisplayName
  
• -ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to Set-ADObject, at the Active Directory module command prompt, type Get-Help Set-ADObject –detailed, and then press ENTER.

Refreshing a Dynamic Object

This topic explains how to use the Active Directory module for Windows PowerShell to refresh a dynamic object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to refresh the Time to Live (TTL) attribute of the dynamic user object Brad Sutton:
Set-ADObject -Identity ‘CN=Brad Sutton,OU=Accounting,DC=Fabrikam,DC=com’ -Replace @{entryTTL="200000"}

Additional information

You can use the following parameters when you set many of the common values of Active Directory objects:

• -Description
  
• -DisplayName
  
• -ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to Set-ADObject, at the Active Directory module command prompt, type Get-Help Set-ADObject –detailed, and then press ENTER.

Modifying a Bit Flag Attribute,Modifying an Object,Deleting a Container That Has Child Objects

Deleting a Container That Has Child Objects

This topic explains how to use the Active Directory module for Windows PowerShell to delete a container that has child objects in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to delete the container organizational unit (OU) Finance, which has child objects:
Remove-ADObject "OU=Finance,OU=UserAccounts,DC=FABRIKAM,DC=COM" -Recursive

Additional information

For a full explanation of the parameters that you can pass to Remove-ADObject, at the Active Directory module command prompt, type Get-Help Remove-ADObject –detailed, and then press ENTER.

Modifying an Object

This topic explains how to use the Active Directory module for Windows PowerShell to modify the attribute of an object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to modify the Description attribute of the AntonioAl Direct Reports distribution list in the Fabrikam.com domain:
Set-ADObject 'CN=AntonioAl Direct Reports,OU=Finance,OU=UserAccounts,DC=FABRIKAM,DC=COM' -Description "Distribution List of Antonio Alwan Direct Reports"

Additional information

You can use the following parameters when you set many of the common values of Active Directory objects:

• -Description
  
• -DisplayName
  
• -ProtectedFromAccidentalDeletion
  

For the full explanation of the list of the parameters that you can pass to Set-ADObject, at the Active Directory module command prompt, type Get-Help Set-ADObject –detailed.

Modifying a Bit Flag Attribute

This topic explains how to use the Active Directory module for Windows PowerShell to modify a bit flag attribute of an object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to modify the bit flag attribute userAccountControl of the user object SaraDavis to Enabled:
Set-ADObject 'SaraDavis' -Replace @{<BitflagAttributeName>='512'}

Additional information

You can use the following parameters when you set many of the common values of Active Directory objects:

• -Description
  
• -DisplayName
  
• -ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to Set-ADObject, at the Active Directory module command prompt, type Get-Help Set-ADObject –detailed, and then press ENTER.

Creating an Object,Searching the Global Catalog, Searching for Objects in a Domain

Creating an Object

This topic explains how to use the Active Directory module for Windows PowerShell to create an object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to create a new site object in the Fabrikam.com domain:
New-ADObject -Name 'BO3' -Type site -Description 'Branch Office 3' -Path 'CN=Sites,CN=Configuration,DC=FABRIKAM,DC=COM'

Additional information

The following parameters are the most commonly used parameters for creating Active Directory objects:

• -Description
  
• -DisplayName
  
• -ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to New-ADObject, at the Active Directory module command prompt, type Get-Help New-ADObject –detailed, and then press ENTER.

Searching the Global Catalog

This topic explains how to use the Active Directory module for Windows PowerShell to connect to and search the global catalog.

Example

The following example demonstrates how to connect to and search the global catalog for all the users in the Fabrikam forest:
Get-ADObject -Filter 'ObjectClass -eq "users"' –Server corp-DC12:3268 -SearchBase 'DC=Fabrikam,DC=com' -Properties Name,sAMAccountName | FT Name,sAMAccountName

Additional information

For a full explanation of the parameters that you can pass to Get-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed, and then press ENTER.

 

 

Searching for Objects in a Domain

This topic explains how to use the Active Directory module for Windows PowerShell to search for objects in a domain in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to search for all the computer objects in the Fabrikam.com domain:
Get-ADObject -Filter 'ObjectClass -eq "computer"' -SearchBase 'DC=Fabrikam,DC=com' -Properties Name,sAMAccountName | FT Name,sAMAccountName

Additional information

In addition to the standard Lightweight Directory Access Protocol (LDAP) attributes, you can retrieve the following extended properties of the Get-ADObject cmdlet by using the -Properties parameter:

• ObjectClass
  
• Created
  
• Modified
  
• Deleted
  
• ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to Get-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed, and then press ENTER.

Searching for a Large Number of Objects,Viewing the Attributes of an Object,Searching with a Bitwise Filter

Searching for a Large Number of Objects

This topic explains how to use the Active Directory module for Windows PowerShell to search for a large number of objects in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to retrieve a large number of objects from the domain partition of the Fabrikam.com domain:
Get-ADObject -filter {name-like '*'}-SearchBase 'DC=Fabrikam,DC=com'-ResultSetSize $null | Measure-Object

Additional information

In addition to the standard Lightweight Directory Access Protocol (LDAP) attributes, you can retrieve the following extended properties of the Get-ADObject cmdlet by using the -Properties parameter:

• ObjectClass
  
• Created
  
• Modified
  
• Deleted
  
• ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to Get-ADObject or Measure-Object, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed or Get-Help Measure-Object -detailed, and then press ENTER.

Viewing the Attributes of an Object

This topic explains how to use the Active Directory module for Windows PowerShell to view the attributes of an object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to view the attributes Name and CanonicalName of the sites in the Fabrikam.com domain:
Get-ADObject -Filter 'ObjectClass -eq "site"' -SearchBase 'CN=Configuration,DC=Fabrikam,DC=Com' -Properties CanonicalName | FT Name,CanonicalName -A

Additional information

In addition to the standard Lightweight Directory Access Protocol (LDAP) attributes, you can retrieve the following extended properties of the Get-ADObject cmdlet by using the -Properties parameter:

• ObjectClass
  
• Created
  
• Modified
  
• Deleted
  
• ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to Get-ADObjects, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed, and then press ENTER.

Searching with a Bitwise Filter

This topic explains how to use the Active Directory module for Windows PowerShell to search for objects in Active Directory Domain Services (AD DS), based on a bitwise filter query.

Example

The following example demonstrates how to search for all universal groups in a domain by using a bitwise filter:
Get-ADObject -Filter 'GroupType -band 8'

Additional information

For a full explanation of the parameters that you can pass to Get-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed, and then press ENTER.

Viewing the RootDSE

Viewing the RootDSE

This topic explains how to use the Active Directory module for Windows PowerShell to view the rootDSE of a domain. By viewing the attributes of the rootDSE, you can view the basic information about a forest, domain, or domain controller without having to hard-code the naming context in a search query.

Example

The following example demonstrates how to view the rootDSE of the Fabrikam.com domain:
Get-ADRootDSE

Additional information

In addition to the standard Lightweight Directory Access Protocol (LDAP) attributes, you can retrieve the following extended properties of the Get-ADRootDSE cmdlet by using the -Properties parameter:

• ConfigurationNamingContext
  
• CurrentTime
  
• DefaultNamingContext
  
• DnsHostName
  
• DomainControllerFunctionality
  
• DomainFunctionality
  
• DsServiceName
  
• ForestFunctionality
  
• HighestCommittedUSN
  
• IsGlobalCatalogReady
  
• IsSynchronized
  
• LdapServiceName
  
• NamingContexts
  
• RootDomainNamingContext
  
• SchemaNamingContext
  
• ServerName
  
• SubschemaSubentry
  
• SupportedCapabilities
  
• SupportedControl
  
• SupportedLDAPPolicies
  
• SupportedLDAPVersion
  
• SupportedRootDSEOperations
  
• SupportedSASLMechanisms
  

For a full explanation of the parameters that you can pass to Get-ADRootDSE, at the Active Directory module command prompt, type Get-Help Get-ADRootDSE –detailed, and then press ENTER.

Counting Objects in Active Directory, Connecting to a Well-Known Container

Counting Objects in Active Directory

This topic explains how to use the Active Directory module for Windows PowerShell to retrieve the total number of objects that are stored in the Active Directory database.

Example

The following example demonstrates how to retrieve the total number of objects that are stored in the Active Directory database of the Fabrikam.com domain:
Get-ADObject -Filter {name -like '*'} -SearchBase 'CN=Schema,CN=Configuration,DC=Fabrikam,DC=COM' -ResultSetSize $null | Measure-Object

Additional information

For a full explanation of the parameters that you can pass to Get-ADObject or Measure-Object, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed or Get-Help Measure-Object, and then press ENTER.

Connecting to a Well-Known Container

This topic explains how to use the Active Directory module for Windows PowerShell to connect to a well-known container. A well-known container is an object in Active Directory Domain Services (AD DS), such as Users or Computers, that contains other objects.

Example

The following example demonstrates how to connect to the well-known containers in Active Directory Domain Services (AD DS):
Get-ADDomain Fabrikam.com | FL UsersContainer,ComputersContainer,DomainControllersContainer,DeletedObjectsContainer,SystemsContainer,LostAndFoundContainer,QuotasContainer,ForeignSecurityPrincipalsContainer

Additional information

For a full explanation of the parameters that you can pass to Get-ADDomain, at the Active Directory module command prompt, type Get-Help Get-ADDomain –detailed, and then press ENTER.

Password Policies

Password Policies

You can use the Active Directory module for Windows PowerShell to manage your password policies in Active Directory Domain Services (AD DS). The topics in this section explain how to use the Active Directory module to accomplish many of the common tasks that are associated with password policy management:

• Create a New Fine-Grained Password Policy
  
  
• Retrieve Details of a Fine-Grained Password Policy
  
  
• Search for Fine-Grained Password Policies
  
  
• Modify a Fine-Grained Password Policy
  
  
• Apply a Fine-Grained Password Policy
  
  
• Remove a Fine-Grained Password Policy
  
  
• Delete a Fine-Grained Password Policy
  
  
• Get Resultant Password Policy of a User
  
  
• Find All Groups and Users to Which a Fine-Grained Password Policy Applies
  
  
• Retrieve Details of a Default Domain Password Policy
  
  
• Modify the Default Domain Password Policy
  

Modify the Default Domain Password Policy

Modify the Default Domain Password Policy

This topic explains how to use the Active Directory module for Windows PowerShell to modify the default domain password policy.

Example

The following example demonstrates how to modify the default domain password policy for the Fabrikam.com domain:
Set-ADDefaultDomainPasswordPolicy -Identity fabrikam.com -PasswordHistoryCount 10 –MinPasswordLength 7 -MinPasswordAge 1.00:00:00 -MaxPasswordAge 30.00:00:00 -LockoutObservationWindow 0.00:10:00 -LockoutThreshold 15

Additional information

You can use the following parameters when you set many of the common values that are associated with a fine-grained password policy:

• -ComplexityEnabled
  
• -Description
  
• -DisplayName
  
• -LockoutDuration
  
• -LockoutObservationWindow
  
• -LockoutThreshold
  
• -MaxPasswordAge
  
• -MinPasswordAge
  
• -MinPasswordLength
  
• -PasswordHistoryCount
  
• -ReversibleEncryptionEnabled
  

For a full explanation of the parameters that you can pass to Set-ADDefaultDomainPasswordPolicy, at the Active Directory module command prompt, type Get-Help Set-ADDefaultDomainPasswordPolicy –detailed, and then press ENTER.

Retrieve Details of a Default Domain Password Policy

Retrieve Details of a Default Domain Password Policy

This topic explains how to use the Active Directory module for Windows PowerShell to retrieve the details of the default domain password policy.

Example

The following example demonstrates how to retrieve the details of the default domain password policy for the Fabrikam.com domain:
Get-ADDefaultDomainPasswordPolicy Fabrikam

Additional information

In addition to the standard Lightweight Directory Access Protocol (LDAP) attributes, you can retrieve the following extended properties of the Get-ADDefaultDomainPasswordPolicy cmdlet by using the -Properties parameter:

• ComplexityEnabled
  
• LockoutDuration
  
• LockoutObservationWindow
  
• LockoutThreshold
  
• MaxPasswordAge
  
• MinPasswordAge
  
• MinPasswordLength
  
• PasswordHistoryCount
  
• ReversibleEncryptionEnabled
  

For a full explanation of the parameters that you can pass to Get-ADDefaultDomainPasswordPolicy, at the Active Directory module command prompt, type Get-Help Get-ADDefaultDomainPasswordPolicy –detailed, and then press ENTER.

Get Resultant Password Policy of a User,Find All Groups and Users to Which a Fine-Grained Password Policy Applies

Get Resultant Password Policy of a User

This topic explains how to use the Active Directory module for Windows PowerShell to get the resultant password policy of a user.

Example

The following example demonstrates how to get the resultant password policy of the user BobKe:
Get-ADUserResultantPasswordPolicy BobKe

Additional information

For a full explanation the parameters that you can pass to Get-ADUserResultantPasswordPolicy, at the Active Directory module command prompt, type Get-Help Get-ADUserResultantPasswordPolicy –detailed, and then press ENTER.

Find All Groups and Users to Which a Fine-Grained Password Policy Applies

This topic explains how to use the Active Directory module for Windows PowerShell to find all the groups and users to which a fine-grained password policy applies.

Example

The following example demonstrates how to find all the groups and users to which the fine-grained password policy AdminsPSO applies:
Get-ADFineGrainedPasswordPolicy AdminsPSO | ft AppliesTo -A

Additional information

For a full explanation of the parameters that you can pass to Get-ADFineGrainedPasswordPolicy, at the Active Directory module command prompt, type Get-Help Get-ADFineGrainedPasswordPolicy –detailed, and then press ENTER.

Search ,Modify ,Apply ,Remove ,Delete a Fine-Grained Password Policy

Search for Fine-Grained Password Policies

This topic explains how to use the Active Directory module for Windows PowerShell to search for fine-grained password policy policies.

Example

The following example demonstrates how to search for the fine-grained password policies in the Fabrikam.com domain:
Get-ADFineGrainedPasswordPolicy -Filter 'Name -like "*"' | ft Name, Precedence,MaxPasswordAge,MinPasswordLength -A

Additional information

For a full explanation of the parameters that you can pass to Get-ADFineGrainedPasswordPolicy, at the Active Directory module command prompt, type Get-Help Get-ADFineGrainedPasswordPolicy –detailed, and then press ENTER.

Modify a Fine-Grained Password Policy

This topic explains how to use the Active Directory module for Windows PowerShell to modify a fine-grained password policy.

Example

The following example demonstrates how to modify the minimum password length and password history count of the fine-grained password policy DomainUsersPSO:
Set-ADFineGrainedPasswordPolicy "DomainUsersPSO" -MinPasswordLength 8 -PasswordHistoryCount 24

Additional information

You can use the following parameters when you set many of the common values that are associated with a fine-grained password policy:

• -ComplexityEnabled
  
• -Description
  
• -DisplayName
  
• -LockoutDuration
  
• -LockoutObservationWindow
  
• -LockoutThreshold
  
• -MaxPasswordAge
  
• -MinPasswordAge
  
• -MinPasswordLength
  
• -PasswordHistoryCount
  
• -ReversibleEncryptionEnabled
  

For a full explanation of the parameters that you can pass to Set-ADFineGrainedPasswordPolicy, at the Active Directory module command prompt, type Get-Help Set-ADFineGrainedPasswordPolicy –detailed, and then press ENTER.

Apply a Fine-Grained Password Policy

This topic explains how to use the Active Directory module for Windows PowerShell to apply a fine-grained password policy.

Example 1

The following example demonstrates how to apply the fine-grained password policy DomainUsersPSO to the global security group Domain Users:
Add-ADFineGrainedPasswordPolicySubject DomainUsersPSO -Subjects 'Domain Users'

Example 2

The following example demonstrates how to apply the fine-grained password policy DlgtdAdminsPSO to two users with the samAccountName(s) BobKe and KimAb:
Add-ADFineGrainedPasswordPolicySubject DlgtdAdminsPSO -Subjects BobKe,KimAb

Additional information

For a full explanation of the parameters that you can pass to Add-ADFineGrainedPasswordPolicySubject, at the Active Directory module command prompt, type Get-Help Add-ADFineGrainedPasswordPolicySubject –detailed, and then press ENTER.

Remove a Fine-Grained Password Policy

This topic explains how to use the Active Directory module for Windows PowerShell to remove a fine-grained password policy from a user in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to remove the fine-grained password policy DlgtdAdminsPSO from two users, BobKe and KimAb:
Remove-ADFineGrainedPasswordPolicySubject DlgtdAdminsPSO -Subjects BobKe,KimAb

Additional information

For a full explanation of the parameters that you can pass to Remove-ADFineGrainedPasswordPolicySubject, at the Active Directory module command prompt, type Get-Help Remove-ADFineGrainedPasswordPolicySubject –detailed, and then press ENTER.

Delete a Fine-Grained Password Policy

This topic explains how to use the Active Directory module for Windows PowerShell to delete a fine-grained password policy.

Example

The following example demonstrates how to delete the fine-grained password policy DlgtdAdminsPSO:
Remove-ADFineGrainedPasswordPolicy -Identity DlgtdAdminsPSO

Additional information

For a full explanation of the parameters that you can pass to Remove-ADFineGrainedPasswordPolicy, at the Active Directory module command prompt, type Get-Help Remove-ADFineGrainedPasswordPolicy –detailed, and then press ENTER.

Retrieve Details of a Fine-Grained Password Policy

Retrieve Details of a Fine-Grained Password Policy

This topic explains how to use the Active Directory module for Windows PowerShell to retrieve the details of a fine-grained password policy.

Example

The following example demonstrates how to retrieve the details of the fine-grained password policy AdminsPSO:
Get-ADFineGrainedPasswordPolicy AdminsPSO

Additional information

In addition to the standard Lightweight Directory Access Protocol (LDAP) attributes, you can retrieve the following extended properties of the Get-ADFineGrainedPasswordPolicy cmdlet by using the -Properties parameter:

• AppliesTo
  
• ComplexityEnabled
  
• LockoutDuration
  
• LockoutObservationWindow
  
• LockoutThreshold
  
• MaxPasswordAge
  
• MinPasswordAge
  
• MinPasswordLength
  
• PasswordHistoryCount
  
• Precedence
  
• ReversibleEncryptionEnabled
  

For a full explanation of the parameters that you can pass to Get-ADFineGrainedPasswordPolicy, at the Active Directory module command prompt, type Get-Help Get-ADFineGrainedPasswordPolicy –detailed, and then press ENTER.

Create a New Fine-Grained Password Policy

Create a New Fine-Grained Password Policy

This topic explains how to use the Active Directory module for Windows PowerShell to create a new fine-grained password policy.

Example 1

The following example demonstrates how to create a new fine-grained password policy for the domain users in the Fabrikam.com domain:
New-ADFineGrainedPasswordPolicy -Name "DomainUsersPSO" -Precedence 500 -ComplexityEnabled $true -Description "The Domain Users Password Policy"-DisplayName "Domain Users PSO" -LockoutDuration "0.12:00:00" -LockoutObservationWindow "0.00:15:00" -LockoutThreshold 10 -MaxPasswordAge "60.00:00:00" -MinPasswordAge "1.00:00:00" -MinPasswordLength 8 -PasswordHistoryCount 24 -ReversibleEncryptionEnabled $false

Example 2

The following example is a sample script that demonstrates how to create a new fine-grained password policy from a template:

C#

$templatePSO = New-Object Microsoft.ActiveDirectory.Management.Commands.ADFineGrainedPasswordPolicy
$templatePSO.ComplexityEnabled = $true
$templatePSO.LockoutDuration = [TimeSpan]::Parse("0.12:00:00")
$templatePSO.LockoutObservationWindow = [TimeSpan]::Parse("0.00:15:00")
$templatePSO.LockoutObservationWindow = [TimeSpan]::Parse("0.00:15:00")
$templatePSO.LockoutThreshold = 10
$templatePSO.MinPasswordAge = [TimeSpan]::Parse("0.00:10:00")
$templatePSO.PasswordHistoryCount = 24
$templatePSO.ReversibleEncryptionEnabled = $false
New-ADFineGrainedPasswordPolicy -Instance $templatePSO -Name "SvcAccPSO" -Precedence 100 -Description "The Service Accounts Password Policy" -DisplayName "Service Accounts PSO" -MaxPasswordAge "30.00:00:00" -MinPasswordLength 20
New-ADFineGrainedPasswordPolicy -Instance $templatePSO -Name "AdminsPSO" -Precedence 200 -Description "The Domain Administrators Password Policy" -DisplayName "Domain Administrators PSO" -MaxPasswordAge "15.00:00:00" -MinPasswordLength 10

Additional information

You can use the following parameters when you set many of the common values that are associated with the creation of a new fine-grained password policy:

• -ComplexityEnabled
  
• -Description
  
• -DisplayName
  
• -LockoutDuration
  
• -LockoutObservationWindow
  
• -LockoutThreshold
  
• -MaxPasswordAge
  
• -MinPasswordAge
  
• -MinPasswordLength
  
• -PasswordHistoryCount
  
• -ReversibleEncryptionEnabled
  

For a full explanation of the parameters that you can pass to New-ADFineGrainedPasswordPolicy, at the Active Directory module command prompt, type Get-Help New-ADFineGrainedPasswordPolicy –detailed, and then press ENTER.

Domain Controller and Operations Master Management

Domain Controller and Operations Master Management

You can use the Active Directory module for Windows PowerShell to manage your domain controllers and operations master (also known as flexible single master operations or FSMO) roles in Active Directory Domain Services (AD DS). The topics in this section explain how to use the Active Directory module to accomplish many of the common tasks that are associated with domain controller and operations master management:

• Finding the Domain Controllers for a Domain
  
  
• Finding the Closest Domain Controller
  
  
• Finding a Domain Controller's Site
  
  
• Finding the Global Catalog Servers in a Forest
  
  
• Moving a Domain Controller to a Different Site
  
  
• Enabling and Disabling the Global Catalog
  
  
• Determining Whether Global Catalog Promotion Is Complete
  
  
• Finding the Domain Controllers or Global Catalog Servers in a Site
  
  
• Finding Domain Controllers and Global Catalogs with DNS
  
  
• Enabling Universal Group Caching
  
  
• Seizing an Operations Master Role
  
  
• Finding the PDC Emulator Role Owner with DNS
  
  
• Finding the Operations Master Role Holders
  
  
• Transferring an Operations Master Role
  

Finding the Operations Master Role Holders,Transferring an Operations Master Role

Finding the Operations Master Role Holders

This topic explains how to use the Active Directory module for Windows PowerShell to find the operations master (also known as flexible single master operations or FSMO) role holders.

Example

The following example demonstrates how to find the operations master role holders for the Fabrikam.com forest or Fabrikam.com domain:
Get-ADForest Fabrikam.com | FT SchemaMaster,DomainNamingMaster
or:
Get-ADDomain Fabrikam.com | FT PDCEmulator,RIDMaster,InfrastructureMaster

Additional information

For a full explanation of the parameters that you can pass to GetADForest or Get-ADDomain, at the Active Directory module command prompt, type Get-Help GetADForest –detailed or Get-Help GetADDomain –detailed, and then press ENTER.

Transferring an Operations Master Role

This topic explains how to use the Active Directory module for Windows PowerShell to transfer operations master (also known as flexible single master operations or FSMO) roles.

Example

The following example demonstrates how to transfer the Operation Master, RID Master, and Domain Naming Master roles to the server FABRIKAM-DC1 in the domain to which you are currently logged on:
Move-ADDirectoryServerOperationMasterRole -Identity FABRIKAM-DC1 -OperationMasterRole RIDMaster,InfrastructureMaster,DomainNamingMaster

Additional information

For a full explanation of the parameters that you can pass to Move-ADDirectoryServerOperationMasterRole, at the Active Directory module command prompt, type Get-Help Move-ADDirectoryServerOperationMasterRole –detailed, and then press ENTER.