Essential PowerShell Scripts for Active Directory User and Group Management

PowerShell Recipes for Active Directory User and Group Tasks

Managing users and groups in Active Directory can feel repetitive. PowerShell makes it simple and fast. Below are four handy scripts you can run or save as .ps1 files to handle common AD scenarios.

1. Remove a User from a Group

This script asks for a username and a group name, then removes that user without asking you to confirm each step.

powershellImport-Module ActiveDirectory

$userName = Read-Host "Enter the username to remove"
$groupName = Read-Host "Enter the group name"

try {
  Remove-ADGroupMember -Identity $groupName `
    -Members $userName -Confirm:$false -ErrorAction Stop
  Write-Host "User $userName successfully removed from group $groupName" -ForegroundColor Green
} catch {
  Write-Host "Error: $($_.Exception.Message)" -ForegroundColor Red
}

How it works:

• Loads the AD module.
• Prompts you for user and group.
• Runs Remove-ADGroupMember quietly.
• Shows a green success message or a red error.

2. Export All User Details to CSV

Quickly dump user info into a spreadsheet. Customize the properties list as needed.

powershellImport-Module ActiveDirectory

$outputPath = "C:\ADUserExport.csv"
$properties = @("Name", "SamAccountName", "UserPrincipalName", "Enabled", "EmailAddress", "Department", "Title")

Get-ADUser -Filter * -Properties $properties |
  Select-Object $properties |
  Export-Csv -Path $outputPath -NoTypeInformation

Write-Host "AD user details exported to $outputPath" -ForegroundColor Green

How it works:

• Defines which fields you want.
• Retrieves all users with those fields.
• Exports the data to C:\ADUserExport.csv.
• Notifies you when it’s done.

3. Import Users from a CSV

Add many users at once. Your CSV must have headers matching the script’s fields (Name, SamAccountName, UserPrincipalName, EmailAddress, Password).

powershellImport-Module ActiveDirectory

$csvPath = Read-Host "Enter the path to the CSV file"
$users   = Import-Csv -Path $csvPath

foreach ($user in $users) {
  $securePassword = ConvertTo-SecureString $user.Password -AsPlainText -Force

  try {
    New-ADUser `
      -Name $user.Name `
      -SamAccountName $user.SamAccountName `
      -UserPrincipalName $user.UserPrincipalName `
      -EmailAddress $user.EmailAddress `
      -Enabled $true `
      -AccountPassword $securePassword `
      -ChangePasswordAtLogon $true `
      -ErrorAction Stop

    Write-Host "User $($user.Name) created successfully" -ForegroundColor Green
  } catch {
    Write-Host "Error creating user $($user.Name): $($_.Exception.Message)" -ForegroundColor Red
  }
}

How it works:

• Asks for your CSV file path.
• Reads each row.
• Converts the plain-text password to secure text.
• Creates the user with default settings.
• Reports success or failure per user.

4. Automate Standard User Creation

Create a function you can call with four parameters—first name, last name, department, and title—to generate a user with a consistent format.

powershellImport-Module ActiveDirectory

function New-StandardADUser {
  param(
    [Parameter(Mandatory=$true)][string]$FirstName,
    [Parameter(Mandatory=$true)][string]$LastName,
    [Parameter(Mandatory=$true)][string]$Department,
    [Parameter(Mandatory=$true)][string]$Title
  )

  $username = ($FirstName.Substring(0,1) + $LastName).ToLower()
  $upn      = "$username@yourdomain.com"
  $email    = $upn
  $ou       = "OU=$Department,OU=Users,DC=yourdomain,DC=com"
  $securePassword = ConvertTo-SecureString "ChangeMe123!" -AsPlainText -Force

  try {
    New-ADUser `
      -Name "$FirstName $LastName" `
      -GivenName $FirstName `
      -Surname $LastName `
      -SamAccountName $username `
      -UserPrincipalName $upn `
      -EmailAddress $email `
      -Title $Title `
      -Department $Department `
      -Path $ou `
      -Enabled $true `
      -AccountPassword $securePassword `
      -ChangePasswordAtLogon $true `
      -ErrorAction Stop

    Write-Host "User $username created successfully" -ForegroundColor Green
  } catch {
    Write-Host "Error creating user $username: $($_.Exception.Message)" -ForegroundColor Red
  }
}

# Example usage:
New-StandardADUser -FirstName "John" -LastName "Doe" -Department "IT" -Title "Systems Administrator"

How it works:

• Defines a reusable function with clear parameters.
• Builds username, UPN, and email automatically.
• Places the user in the department’s OU.
• Sets a default password and forces change at first logon.
• Catches errors and shows a message.

---

These scripts help you remove users from groups, export data, import bulk users, and set up new accounts with one command. Save them as .ps1 files, tweak them for your domain, and watch your AD tasks get done in seconds instead of minutes.