From my time in IT support: the commands that solve 80% of tickets. Requires the RSAT ActiveDirectory module.
Import-Module ActiveDirectory
Get-ADUser jdoe -Properties DisplayName, Enabled, LockedOut, LastLogonDate, PasswordLastSet, PasswordExpired |
Select-Object DisplayName, Enabled, LockedOut, LastLogonDate, PasswordLastSet, PasswordExpired
# Search by name
Get-ADUser -Filter "Name -like '*doe*'" | Select-Object Name, SamAccountName
# Who is locked out right now?
Search-ADAccount -LockedOut | Select-Object Name, SamAccountName
# Unlock
Unlock-ADAccount -Identity jdoe
Set-ADAccountPassword -Identity jdoe -Reset `
-NewPassword (Read-Host -AsSecureString "New password")
Set-ADUser -Identity jdoe -ChangePasswordAtLogon $true
# A user's groups
Get-ADPrincipalGroupMembership jdoe | Select-Object Name
# Members of a group
Get-ADGroupMember "Sales" | Select-Object Name
# Add / remove
Add-ADGroupMember -Identity "Sales" -Members jdoe
Remove-ADGroupMember -Identity "Sales" -Members jdoe -Confirm:$false
Disable-ADAccount -Identity jdoe
Enable-ADAccount -Identity jdoe
Get-ADUser -Filter 'Enabled -eq $false' | Select-Object Name
# Inactive for 90+ days
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly |
Select-Object Name, LastLogonDate
LastLogonDateis based onlastLogonTimestamp, which only replicates every ~9–14 days. Don't use it for "did they log in today?"