Active Directory Domain Services Section (Version 1.1)

This article will show you how to use a graphical menu to discover and administer your Active Directory Environment.  It is a graphical menu I created for the administration of Active Directory Domain Services. It’s like sconfig, but much more powerful when it comes to automation in Active Directory Domain Services.

The latest version is 1.1 (May 2018). For all those who have downloaded my first release, I would strongly recommend taking a look at this update. It fixes bugs and adds new features like Onboarding, Offboarding and much more.

Version 1.1

The tool has undergone a major update since the march release with more options and a fresher look.

Active Directory Domain Services Section

What can we do with it? This is the question for this part. I wanna give you a foretaste. Here’s the menu of version 1.1.


The Subsections

1 – Forest | Domain | Sites Configuration


2 – List Domain Controller

Note that in this section you are also able to test the connectivity to your Domain Controller. It’s your choice 😉


3 – Replicate all Domain Controller

Tired of pressing replicate on all DC’s? You’ve come to the right place.


4 – Show Default Password Policy

It’s good to have an eye on your password settings…


5 – List Domain Admins


6 – List of Active GPOs


7 – List all Windows Clients (Client Operating System only)


8 – List all Windows Server


9 – List all Computers


10 – Run SystemInfo on Remote Computer

You are able to select a scope …


11 – Move Computer to OU


Don’t worry I will intercept wrong entries and save the user…


12 – List all Groups


13 – List Group Memberships


14 – List all enabled Users


15 – List User Properties


16 – User’s last Domain Logon

The forums are full of questions like “is the LastLogon attribute important, or LastLogonTimestamp or LastLogonDate…, when is it replicated … why is it so difficult to find the right logon date …”. I don’t care and contact every DC and ask for the LastLogon and take the latest…, surprise, surprise it always shows me the correct latest logon …


Don’t worry. I will take care if the user has never logged on.


17 – Show currently logged on User

This is a live query. The target host will be contacted with the quser command.


18 – Send Messages to users desktop

Cool, ha? One of my favorites … Make your choice to send it to all Windows Server …


19 – Find orphaned User or Computer Accounts

Who forgot to remove the computer or user account? You have to provide the computer or user account and a timespan.


20 – Configure Time-based-Group-Membership

This only works in a Windows Server 2016 Forest Mode. Don’t worry, the tool will first check the Forest Mode and if the feature is enabled. Provide User, Group and Timespan in days.


21 – Onboarding | Create New AD User (from existing)

Do you dream of creating a user based on an existing in a few seconds … to have more time for other tasks? Here we go.


22 – Offboarding | Disable AD User

When an employee leaves the company, he should be deactivated.


Ok, that’s it for now.

PowerShell Web Access

You are also able to run this in PowerShell Web Access:


If you haven’t installed PowerShell Web Access yet, here’s a walk through: Windows Server 2012/2016: Installing and Configuring PowerShell Web Access (PSWA)

The Script

I have decided not to present the entire code here. Too many lines of code. You can download the script here, it’s a psm1 file, a PowerShell script module file:


Prerequisites and Notes:

  • Tested in an Active Directory environment with Windows Server 2012/2016 Domain Controllers and Windows 7/8/10 clients
  • WinRm must be enabled on all Client computers (WinRm is enabled on Windows Server 2012/2016 by default) manually (winrm qc) or by GPO. Take a look at my article: Enabling WinRM for Windows Client Operating Systems (Windows 10, Windows 8, Windows 7)
  • Run the tool on a Domain Controller (You may run into troubles with RSAT)
  • 0 and Enter (instead of Enter only) to go back to the main menu is due to the possible integration of PowerShell Web Access where pressing Enter only will not work

After downloading create a folder “AD” in C:\Program Files\Windows PowerShell\Modules and save the AD.psm1 file there.



It should be then available every time you start PowerShell and run the command ad.


Or as mentioned in PowerShell Web Access.

Have fun with it! I am very grateful for ideas for further functions.

56 replies »

  1. Hello, I just wanted to say thank you so much for this script! It kicks ass and I was looking for an onboarding powershell script for almost 2 weeks now. I’m still learning powershell and this got me motivated. One thing I had to correct was where it was adding the AD memberships from the existing employee to the new employee was where it said get-aduser -identity $name. It didn’t like it and said some error it couldn’t convert.

    Therefore it didn’t want to copy the groups. I looked at the script one more time and saw you have this variable for the existing user: $nameds
    Once I put that it, it successfully copied the groups over. It didn’t copy over the test home directory I setup for an existing user, but this is more than enough. Thanks again!


  2. Thanks For The Nice Script …
    I would love to see an export of data specially computers and users that would be great one stop script


  3. Thanks For The Nice Script …
    I would love to see an export of data specially computers and users that would be great one stop script


  4. Hi Patrick this script module looks great. In our Environment i cannot use it :
    Import-Module : File C:\Program Files\WindowsPowerShell\Modules\AD\AD.psm1 cannot be loaded. The file C:\Program
    Files\WindowsPowerShell\Modules\AD\AD.psm1 is not digitally signed. You cannot run this script on the current system.
    For more information about running scripts and setting execution policy, see about_Execution_Policies at

    How could i fix this ? or i should find a way to sign the psm1 file ?


  5. Hello Patrick,

    Love the script, another very handy resource…..thanks.

    I would however like to suggest an edit.

    Lines 733 & 747…..add -AutoSize to the format table. Without it, the table fields can be truncated.
    Just started a new role and using your script to assess the current state of the AD and the results were truncated
    (without the amendment)
    WIN-PA62JHO… WIN-PA62JHOF… 22/12/2017 13:43:58 22/12/2017 13:43:58
    (with the amendment)
    WIN-PA62JHOFK4A WIN-PA62JHOFK4A$ 22/12/2017 13:43:58 22/12/2017 13:43:58

    Hope that is helpful.

    Kind regards


    Liked by 1 person

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.