PowerShell AD users

Query the intended users, request the properties you need, and verify the directory scope.

Lesson 2 min read Windows PowerShell 5.1 and PowerShell 7

Written and tested by Dhrub Bharali · Updated 02 October 2026

Overview

Suppose HR needs the department of enabled users in a specific OU. Define the OU and domain controller first. An unqualified query can return a valid answer from the wrong scope, which is harder to notice than an error.

Use -Filter or -LDAPFilter for a condition the directory can apply, -SearchBase to constrain the subtree, and -Properties for attributes beyond the default set. Selecting Department later does not retrieve it if the query did not request it.

The example selects only the first five enabled users for inspection. It is not a complete enabled-user inventory. Remove or change that limit deliberately when producing a report, and record the query scope alongside the result.

An empty field can mean the attribute was not retrieved, the stored value is empty, or access limits what you can read. Check one known account by stable identity before interpreting an entire empty column.

See the objects move

Inspect this authored example with fictional data in the bounded browser model. The numbered stages show how its objects change.

Get-ADUser -Filter 'Enabled -eq $true' -Properties Department | Where-Object Department -eq 'IT' | Select-Object Name

Stage 1Get-ADUser-Filter -Properties
Stage 2Where-Object-eq
Stage 3Select-ObjectPositional values or no named parameters

What happens

Inspect Name, SamAccountName and Department. In the browser these are fictional records. For a real export, check the count and one known included and excluded account before sending the report.

Worth remembering

A successful query does not prove the scope is correct. Validate identity, properties and completeness.

Primary documentation

Microsoft Learn: get-aduser

Try it

Browser simulation · fictional data; no changes to your computer.

Your task: Return the enabled users in IT from the fictional dataset, with Name in the result.

Command

Interactive simulation · fictional data

Hint

Use the Enabled filter and a Department comparison.

Compare a solution

Get-ADUser -Filter 'Enabled -eq $true' -Properties Department | Where-Object Department -eq 'IT' | Select-Object Name

Queries enabled users and requests Department, which is not in the default property set.

Show reference output

Sample output · fictional data, shaped like the real thing

Name      SamAccountName  Department
--------  --------------  ----------
Asha Das  adas            IT        
Nina Roy  nroy            IT

Practise this

Choose a task

Read domain users

Import ActiveDirectory first. Return all fictional AD user records.

Review the lesson

Keep going

Next: PowerShell AD groups