PowerShell Active Directory: Get-ADUser Examples

Find all users who haven’t logged in for 90 days, pull every account in a specific OU, or export a directory to CSV for an audit — all of it starts with a single cmdlet. PowerShell Get-ADUser is the foundation of Active Directory automation, giving you structured objects for every user account in your domain with filterable properties, custom attribute retrieval, and pipeline compatibility. This post covers the most common patterns with working examples.

Get a Single User by Username

Use the -Identity parameter to retrieve a specific user. You can pass a SAM account name, UPN, SID, or distinguished name. Basic properties are returned by default — use -Properties * or list specific properties to get more detail.

# Get a user by SAM account name
Get-ADUser -Identity "jsmith"

DistinguishedName : CN=John Smith,OU=Staff,DC=corp,DC=example,DC=com
Enabled           : True
GivenName         : John
Name              : John Smith
SamAccountName    : jsmith
SID               : S-1-5-21-...
Surname           : Smith
UserPrincipalName : [email protected]

# Get a user and display specific properties
Get-ADUser -Identity "jsmith" -Properties Title, Department, LastLogonDate |
    Select-Object Name, SamAccountName, Title, Department, LastLogonDate

Search Users with -Filter

The -Filter parameter accepts Active Directory filter syntax — similar to but not identical to PowerShell’s comparison operators. String values must be quoted inside the filter string. Use * to return all users.

# All enabled users in the domain
Get-ADUser -Filter { Enabled -eq $true } | Measure-Object

# Users in a specific department
Get-ADUser -Filter { Department -eq "Engineering" } -Properties Department |
    Select-Object Name, SamAccountName, Department

# Users whose display name starts with "A"
Get-ADUser -Filter "Name -like 'A*'" | Select-Object Name, SamAccountName

# All users (use carefully on large domains)
Get-ADUser -Filter *

Get All Users in an OU

Combine -SearchBase with an OU distinguished name to scope the query. Add -SearchScope Subtree (the default) to include nested OUs, or use OneLevel for direct children only.

# All users in a specific OU
$ouPath = "OU=Staff,DC=corp,DC=example,DC=com"
Get-ADUser -Filter * -SearchBase $ouPath |
    Select-Object Name, SamAccountName, Enabled

# Direct children only (not nested OUs)
Get-ADUser -Filter * -SearchBase $ouPath -SearchScope OneLevel

Retrieve Specific Properties with -Properties

Get-ADUser only returns a default set of properties unless you request more. Always specify exactly which extra properties you need — requesting -Properties * is expensive on large domains because it loads every attribute for every user.

# Get common extended properties
Get-ADUser -Filter { Enabled -eq $true } `
    -Properties LastLogonDate, PasswordLastSet, PasswordExpired, EmailAddress, Title, Manager |
    Select-Object Name, SamAccountName, EmailAddress, LastLogonDate, PasswordLastSet, Title

Find Disabled and Locked Accounts

Search-ADAccount provides purpose-built filters for common account states, making it more readable than equivalent Get-ADUser -Filter expressions.

# All disabled user accounts
Search-ADAccount -AccountDisabled -UsersOnly |
    Select-Object Name, SamAccountName, DistinguishedName

# All locked out accounts
Search-ADAccount -LockedOut -UsersOnly |
    Select-Object Name, SamAccountName

# Accounts with expired passwords
Search-ADAccount -PasswordExpired -UsersOnly | Select-Object Name, SamAccountName

Export Users to CSV

Exporting an AD user report to CSV is a standard task for audits, license reviews, and HR requests. Select the properties you need and pipe directly to Export-Csv.

$outputPath = "C:\Logs\ad-users-$(Get-Date -Format yyyyMMdd).csv"

Get-ADUser -Filter * `
    -Properties LastLogonDate, PasswordLastSet, EmailAddress, Department, Title, Enabled |
    Select-Object Name, SamAccountName, UserPrincipalName, EmailAddress,
        Department, Title, Enabled, LastLogonDate, PasswordLastSet |
    Export-Csv -Path $outputPath -NoTypeInformation

Write-Output "Exported to $outputPath"

Common Errors and Fixes

• ActiveDirectory module requires RSAT installation: Get-ADUser requires the Active Directory module, which is part of Remote Server Administration Tools (RSAT). On Windows 10/11, install it with: Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0". On older systems, download RSAT from Microsoft. The module is available by default on domain controllers without any extra steps.
• -Filter syntax differs from PowerShell: AD filter syntax uses -eq, -like, and -ne like PowerShell, but the values must be strings (not typed). { Enabled -eq $true } works, but complex expressions may need to be passed as strings: -Filter "Enabled -eq 'True'". If a filter fails silently or returns unexpected results, try converting it to a string-based filter.

Related Cmdlets / See Also

• PowerShell Active Directory User Management: Create and Modify
• PowerShell AD Groups: Add and Remove Members

Wrapping Up

Get-ADUser with the right -Filter and -Properties combination answers nearly any AD user query in seconds. As a next step, schedule a weekly CSV export of all enabled users with LastLogonDate populated so you always have a fresh snapshot for compliance reporting without manual effort.