Get-ADUser without RSAT

ADSearch is a PowerShell module for machines where you can't install RSAT (Remote Server Administration Tools). It reads Active Directory, DNS, Group Policy links and Exchange configuration as an ordinary domain user.

RSAT-style commands: Get-ADUser, Get-ADGroupMember, Get-ADComputer and others, with the same names and main parameters
Read-only: nothing in AD is changed
Free, MIT license. PowerShell 5.1 or later

Messages and warnings from the module are in Japanese. The English README (README.en.md in the ZIP) explains the common ones.

Download (ZIP)

Query Active Directory with ADSI in PowerShell

Without RSAT, the usual way to read AD from PowerShell is to write [adsisearcher] or System.DirectoryServices.DirectorySearcher code by hand. ADSearch wraps that in RSAT-style commands, using only .NET's System.DirectoryServices (ADSI/LDAP).

What it handles for you

Hand-written code has to build the LDAP filter, list the attributes to load, convert FileTime values and userAccountControl bits, and handle paging and large groups.

-Filter accepts PowerShell-style expressions (-like, -eq, parentheses, -and/-or) and turns them into LDAP filters. Raw LDAP filters pass through unchanged
Dates come back as dates, and LockedOut and PasswordExpired are read from the attributes the DC computes
Get-ADGroupMember -Recursive handles nested and circular groups, groups with more than 1,500 members, and members through primaryGroupID (such as Domain Users)
SID and ObjectGUID are returned as the same .NET types as RSAT

Download and load

Download the ZIP with the button above, unzip it and put the ADSearch folder on your machine or a file share
Load it in PowerShell

Import-Module C:\tools\ADSearch\ADSearch.psd1

If it will not load, see the usage page and its FAQ.

File share and the execution policy

From a file share:

Import-Module \\fileserver\tools\ADSearch\ADSearch.psd1 -Force

If the execution policy (RemoteSigned etc.) blocks it, use the bundled Import-ADSearch.ps1.

. ([scriptblock]::Create((Get-Content 'C:\tools\ADSearch\Import-ADSearch.ps1' -Raw)))
Import-ADSearch -Path 'C:\tools\ADSearch'

For downloaded files, unblocking them first with Get-ChildItem -Recurse | Unblock-File lets them load normally.

Examples and commands (42)

# Get a user
Get-ADUser -Identity jsmith -Server dc01.corp.local

# Group members, recursively
Get-ADGroupMember -Identity "IT-Staff" -Recursive -Server dc01.corp.local

Domain and user names in the examples are fictitious.

More examples

# Filter
Get-ADUser -Filter "DisplayName -like 'Smith*'" -Server dc01.corp.local

# Enabled accounts that are locked out
Get-ADUser -Filter "Enabled -eq '$true'" -Server dc01 | Where-Object LockedOut

# DNS records (with IP addresses)
Get-ADDnsRecord -Name pc001 -ComputerName dc01.corp.local

# Self-test: loaded correctly, and the DC is reachable
Invoke-ADSearchSelfTest -Server dc01.corp.local

All 42 commands

Sites, replication, GPO and DNS

Get-ADReplicationSiteGet-ADReplicationSiteLinkGet-ADReplicationSubnetGet-ADReplicationConnectionGet-ADGpoLinkGet-ADDnsRecord

Exchange configuration

Get-ExchangeServerGet-ReceiveConnectorGet-SendConnectorGet-AcceptedDomainGet-RemoteDomainGet-TransportRuleGet-MailboxDatabaseGet-DatabaseAvailabilityGroupGet-AddressListGet-GlobalAddressListGet-OfflineAddressBookGet-EmailAddressPolicy

Exchange recipients

Get-RecipientGet-MailboxGet-RemoteMailboxGet-MailUserGet-MailContactGet-DistributionGroupGet-DynamicDistributionGroupGet-DistributionGroupMember

Diagnostics and inventory

Invoke-ADSearchSelfTestGet-ADUserHealthSearch-ADAccountGet-ADComputerHealth

The Exchange commands read what Exchange stores in AD; they don't connect to an Exchange server. Parameters and output are in the reference manual (Japanese).

This is an English translation of the Japanese page. If the two differ, the Japanese version prevails.

Test a proxy PAC file against a list of URLs → PAC File Tester