Active Directory users and groups cheat sheet
Inspect domain identity, user status and group membership using RSAT.
On-premises Active Directory Domain Services; ActiveDirectory PowerShell module.
Updated · Active Directory · 7 min read
| Command | What it does |
|---|---|
Get-ADDomain | Identify the current domain |
Get-ADUser -Identity 'jdoe' -Properties Enabled,LockedOut,PasswordLastSet | Inspect a user account |
Get-ADPrincipalGroupMembership -Identity 'jdoe' | List principal group memberships |
Get-ADGroupMember -Identity 'Helpdesk' | Inspect direct group members |
Walkthrough
Install RSAT through your approved software process. Use a domain-connected administrative workstation and an account with directory read access.
Step 1: Identify the current domain
Get-ADDomain
Confirm DNSRoot, distinguished name and domain controllers. Querying the wrong domain can look like a missing user.
Step 2: Inspect a user account
Get-ADUser -Identity 'jdoe' -Properties Enabled,LockedOut,PasswordLastSet
Replace jdoe with a real sAMAccountName. Compare Enabled and LockedOut separately; neither field alone proves that sign-in will succeed.
Step 3: List principal group memberships
Get-ADPrincipalGroupMembership -Identity 'jdoe'
Review returned groups against expected access. This list is not a complete effective-access calculation across ACLs, claims and all resource domains.
Step 4: Inspect direct group members
Get-ADGroupMember -Identity 'Helpdesk'
Replace the example group. This returns direct membership; nested groups need separate inspection or the -Recursive parameter.