Check if AD User Exists in PowerShell

In PowerShell, we must import the ActiveDirectory module to use the Get-ADUser cmdlet. If you have imported it already, you can jump to the Checking If AD User Exists in PowerShell section; otherwise, let’s continue with us step-by-step below.

Installing the ActiveDirectory Module

To import the ActiveDirectory module, we first need to install it. So, for that, we need to go through the following steps:

Install Remote Server Administration Tool (RSAT)

We need to install it if we use Windows’ workstation variant; otherwise, we will get an error saying Get-AD* is not recognized. However, it is not required for the server variant because it is already accessible there. The RSAT package installation varies based on Windows 10 version.

RSAT For Windows Variant

We need to manually download RSAT from here and install it if we are using Microsoft Windows 10 pre-build 1809. But first, choose the correct version for your operating system and architecture (32-bit or 64-bit).

Once it is installed, follow the below steps to verify:

1. Open Control Panel.
2. Go to Programs and Features.
3. Hit Turn Windows Features on or off; you can see it on the left side of the Programs and Features window opened in the previous step.
4. In the Windows Features window, expand Remote Server Administration Tools -> Role Administration Tools -> AD DS and AD LDS Tools and ensure that the Active Directory Module for Windows PowerShell is checked; by default, it is selected.

On the other hand, for Microsoft Windows 10 post-build 1809, we don’t need to download it externally because they are available as optional features. Instead, we need to run the Add-WindowsCapability cmdlet, as shown below, to enable these optional features.

We are now ready to import the ActiveDirectory module for this version of Windows OS. In case you don’t know the Windows version, then press Windows + R key from the keyboard, type winver, and hit Enter; you will find the version of Window Operating System.

RSAT For Windows Server 2008R2 and Latest

Execute the following commands to use RSAT-AD-PowerShell in PowerShell.

Ensure you run the above commands on the server; otherwise, you will get an error saying the target of a specified cmdlet cannot be the Windows client-based operating system. You can follow this link to download Windows Server.

It is better to restart the machine after installing RSAT, whether installed on the Windows or server variants.

Import ActiveDirectory Module

Use the following command to import the active directory module in PowerShell.

If everything is in its place, you will not get any error for executing the above command. So now, you can use AD commands in PowerShell. After importing the active directory module, don’t forget to join your Windows PC to a domain controller and log in as an AD user account. Remember, you can use the systeminfo command to find your Domain.

Checking If AD User Exists in PowerShell

Use the Get-ADUser cmdlet with the -Identity parameter in PowerShell.

Use Get-ADUser with -Identity and -Properties parameters to get all the properties of the specified AD user in PowerShell.

Use the Get-ADUser cmdlet with the -Filter parameter to get multiple user objects in PowerShell.

In this section’s above examples, we used the Get-ADUser cmdlet to retrieve a particular user object or search for multiple user objects. The -Identity parameter was used to specify the AD user (Active Directory User) to get. Note that we can identify a user via different things, including DistinguishedName (DN), ObjectGUID, SamAccountName (SAM, security account manager), and SID (security identifier). Note that we can pass a particular user object via pipeline to the -Identity parameter or set it to a user object variable; for instance, -Identity $yourLocalUserObjectName.

To get multiple user objects, we used the -Filter parameter for all the user objects where the Name property’s value matched the specified pattern, which was *ser* (* wildcard character denotes any number of characters). Alternatively, we can use the -LDAPFilter parameter to retrieve multiple user objects.

If -Filter and -LDAPFilter retrieve multiple user objects, what is the difference between them? The -Filter uses the PowerShell Expression Language to specify query strings for AD (Active Directory); however, the -LDAPFilter is used if you have Lightweight Directory Access Protocol (LDAP) installed. You can visit this page for additional details.

Use the Get-ADUser cmdlet with the try-catch block to handle exceptions if any occur. See the following example.

Note that you can use the array operator to create an array of usernames and then use the foreach loop to iterate over this array. For every array element, check whether it exists in the active directory.

Further reading:

Get AD User description in PowerShell

Read more →

Get Logged users in PowerShell

Read more →

Some Important Points

Following are a few points that you may need while checking if an AD user exits in PowerShell:

Can’t Run Get-ADUser in PowerShell

You may not be able to run this cmdlet if any of the following problems occur:

• Active Directory module is not loaded. Note that the Get-ADUser is part of the ActiveDirectory module, which is not loaded in PowerShell by default. It would be best if you imported this module as Import-Module ActiveDirectory to load it.
• You are not running PowerShell as an Administration.
• You may have specified incorrect parameters or used incorrect syntax.

ActiveDirectory Wasn’t Loaded Because No Valid Module File Was Found

For this, you need to ensure the following:

• You have downloaded and installed the correct version of Remote Server Administration Tools (RSAT).
• Once RSAT is installed, enable the ActiveDirectory module by importing it via the Import-Module cmdlet.
• Restart your machine and rerun the command if you still have the same issue.
• Still facing this problem, re-check the PowerShell execution policy and ensure you have installed the correct version of RSAT.

Unable to Find the Default Server with ADWS Running

You may encounter this if:

• Your Active Directory Web Services (ADWS) service is not running on the domain controller. To check it, open services.msc on the domain controller and ensure the Status is Running for the Active Directory Web Services.

• You are not connected to a network.

• If your DNS settings are incorrect. Confirm that the DNS settings of your computer are configured correctly and that the hostname of the domain controller is resolving to the correct IP address.

• If you have not specified the correct domain controller. This can happen if you are working with multiple domain controllers. Re-check and confirm that you have used the following command correctly:

  Use Get-ADUser Cmdlet

  Get-ADUser -Server <domain controller name or ip address> -Identity <username> </username></domain>

  1 2 3 4

  Get-ADUser -Server <domain controller name or ip address> -Identity <username> </username></domain>

You can use the systeminfo command on PowerShell to check your domain.

Active Directory Web Services Service Not Found in services.msc

Active Directory Web Services (ADWS) is not included in all versions of Windows Server because it is not installed by default. If it is not installed on your domain controller or server, you cannot locate it in services.msc. To fix this:

• Open Server Manager by searching it on Windows Search Bar.
• Add the AD DS and AD LDS tools feature in Server Manager. To do this:
  • Click Manage and choose Add Roles and Features. Then, click Next in the opened wizard until you see the Features section.
  • Expand Remote Server Administration Tools -> Role Administration Tools. Then, check the AD DS and AD LDS Tools check box and hit Next to install it.
• Now, confirm that ADWS is available in services.msc; if the issue persists, restart the server or domain controller.

Can’t Find Server Manager Console

You may not be able to find the Server Manager console if it isn’t installed on your Windows Server OS. So, for this case, you need the AD DS and AD LDS Tools feature, which includes the ADWS feature. To do this:

• Open PowerShell as an administrator, and run the Install-WindowsFeature RSAT-AD-Tools command to install AD DS and AD LDS Tools feature.
• Running the above command will install the RSAT feature containing the AD DS and AD LDS tools features.
• Now, open the services.msc and verify that ADWS is successfully installed. If unable to locate ADWS, restart the domain controller or server.

That’s all about how to check if AD users exists in PowerShell.