Each of the PowerShell Active Directory module cmdlets, like Get-ADUser and Get-ADComputer, displays a default set of properties for all objects retrieved. You can specify other properties with the -Properties parameter, but the default set will always be included. There is another set of extended properties that can be specified. In addition, any Active Directory attribute appropriate to the class of objects can be included by specifying the LDAPDisplayName of the attribute in the -Properties parameter.
Both the default and extended properties are really methods. They return values based on the actual Active Directory attributes of the objects, converted in many cases for display. This article defines the different types of properties and documents the default properties for many of the cmdlets that come with the Active Directory module in PowerShell Version 2.0. This article does not document the Active Directory attributes that apply to each class of object.
Most of the Get-AD* cmdlets support the -Properties parameter. If the -Properties parameter is not included, only the default properties are retrieved. With this parameter you can specify default properties, extended properties, or the LDAPDisplayName of any Active Directory attribute appropriate for the class of object. Many, but not all, of these properties and attributes can also be assigned values using the corresponding Set-AD* cmdlet.
↑ Return to Top
For convenience, the Active Directory Get-AD* cmdlets always return a default set of properties. In many cases these correspond to mandatory attributes so they will always have values. These property names do not always match the LDAPDisplayName of the corresponding Active Directory attribute. For example, the SID property is in the default set for Get-ADUser and Get-ADComputer, but there is no such attribute in Active Directory. The SID property will be the value of the objectSID attribute, which is a byte array, converted into the familiar string format.
Many Active Directory Get-AD* cmdlets also support extended properties. These are only retrieved if they are specified in the -Properties parameter of the cmdlet. Many extended properties can also be assigned values using the corresponding Set-AD* cmdlet. Again, the names of these properties may or may not match the LDAPDisplayName of the corresponding Active Directory attribute.
In addition, you can use the -Properties parameter to specify the LDAPDisplayName of any Active Directory attribute appropriate for the class of object. If the attribute value cannot be displayed, such as nTSecurityDescriptor, then the class definition is displayed. If you attempt to retrieve the tokenGroups attribute (a multi-valued operational attribute that is an array of group SID values) an error is raised. Also, if you request an Active Directory attribute, and the object retrieved has no value for that attribute, then the attribute will not be included in the results. This differs from the behavior when you request an extended property. In that case, if the object retrieved has no value assigned to the extended property, it will be shown with a blank (missing) value.
If you specify -Properties *, the Get-AD* cmdlets that support this parameter will retrieve all default and extended properties, whether or not they have values, plus all Active Directory attributes that have values, plus the isDeleted attribute. However, if you specify the isDeleted attribute in the -Properties parameter, this attribute is not included in the results unless it has a value. For this reason (and because the initial letter in the name is displayed in lower case), the author considers isDeleted to not be an extended property.
If you use a Get-AD* cmdlet with -Properties *, and retrieve more than one object, only the attributes where the first object in the results has a value will be included. For example, if the first object retrieved has no value for the pager attribute, then none of the objects will include this attribute, even if the attribute has a value.
When you specify -Properties * with any Get-AD* cmdlet, if the initial letter of any property name is upper case, it is either a default or extended property. If the initial letter is lower case, the property corresponds to an Active Directory attribute.
All of the Get-AD* and Search-AD* cmdlets also provide two base properties.
These two base properties are themselves not included in the count or collection of names. Base properties are original properties of the .NET Framework object, as defined for the object class. These two properties are not included when you display the object, but you can always retrieve their values explicitly.
The values of these two properties do not need to be the same for all objects retrieved by the cmdlet. As noted above, Active Directory attributes are only retrieved if they have a value assigned to the object in AD. Default and any extended properties requested in the -Properties parameter are always included in the collection. Finally, note that the Get-Member cmdlet does not reveal base properties unless you use the -Force parameter.
The default properties retrieved by the Get-ADUser cmdlet are documented below. The column labeled "R/RW" documents whether the property is Read-Only (R) or Read-Write (RW). The last column documents the Active Directory attribute that the property is based on.
The default and extended properties retrieved by the Get-ADUser cmdlet are documented in the following Wiki article:
Active Directory: Get-ADUser Default and Extended Properties
The default properties retrieved by the Get-ADComputer cmdlet are documented below. The column labeled "R/RW" documents whether the property is Read-Only (R) or Read-Write (RW). The last column documents the Active Directory attribute that the property is based on.
The default and extended properties retrieved by the Get-ADComputer cmdlet are documented in the following Wiki article:
Active Directory: Get-ADComputer Default and Extended Properties
The default properties retrieved by the Get-ADGroup cmdlet are documented below. The column labeled "R/RW" documents whether the property is Read-Only (R) or Read-Write (RW). The last column documents the Active Directory attribute that the property is based on.
The default and extended properties retrieved by the Get-ADGroup cmdlet are documented in the following Wiki article:
Active Directory: Get-ADGroup Default and Extended Properties
The default properties retrieved by the Get-ADObject cmdlet are documented below. The column labeled "R/RW" documents whether the property is Read-Only (R) or Read-Write (RW). The last column documents the Active Directory attribute that the property is based on.
The default and extended properties retrieved by the Get-ADObject cmdlet are documented in the following Wiki article:
Active Directory: Get-ADObject Default and Extended Properties
The default properties retrieved by the Get-ADOrganizationalUnit cmdlet are documented below. The column labeled "R/RW" documents whether the property is Read-Only (R) or Read-Write (RW). The last column documents the Active Directory attribute that the property is based on.
The default and extended properties retrieved by the Get-ADOrganizationalUnit cmdlet are documented in the following Wiki article:
Active Directory: Get-ADOrganizationalUnit Default and Extended Properties
The default properties retrieved by the Get-ADGroupMember cmdlet are documented below. The column labeled "R/RW" documents whether the property is Read-Only (R) or Read-Write (RW). The last column documents the Active Directory attribute that the property is based on.
The Get-ADGroupMember cmdlet does not expose any extended properties, and does not support the -Properties parameter.
The default properties retrieved by the Get-ADPrincipalGroupMembership cmdlet are documented below. The column labeled "R/RW" documents whether the property is Read-Only (R) or Read-Write (RW). The last column documents the Active Directory attribute that the property is based on.
The Get-ADPrincipalGroupMembership cmdlet does not expose any extended properties, and does not support the -Properties parameter.
? Return to Top
The default properties retrieved by the Get-ADForest cmdlet are documented below. The column labeled "R/RW" documents whether the property is Read-Only (R) or Read-Write (RW). The last column documents the Active Directory attribute that the property is based on, or how it is determined.
The Get-ADForest cmdlet does not expose any extended properties, and does not support the -Properties parameter.
The default properties retrieved by the Get-ADDomain cmdlet are documented below. The column labeled "R/RW" documents whether the property is Read-Only (R) or Read-Write (RW). The last column documents the Active Directory attribute that the property is based on, or how it is determined.
The Get-ADDomain cmdlet does not expose any extended properties, and does not support the -Properties parameter.
The default properties retrieved by the Get-ADDomainController cmdlet are documented below. The column labeled "R/RW" documents whether the property is Read-Only (R) or Read-Write (RW). The last column documents the Active Directory attribute that the property is based on, or how it is determined.
The Get-ADDomainController cmdlet does not expose any extended properties, and does not support the -Properties parameter. Also, there is no Set-ADDomainController cmdlet.
The default properties retrieved by the Get-ADRootDSE cmdlet are documented below. They are all attributes of the RootDSE object (or Root Directory Service Entry). The RootDSE object is required of all LDAP compliant directories and exposes properties characteristic of the directory. The column labeled "R/RW" documents whether the attribute is Read-Only (R) or Read-Write (RW). Two attributes are RW, but there is no Set-ADRootDSE cmdlet. The last column describes the attribute of the RootDSE object.
The Get-ADRootDSE cmdlet supports the -Properties parameter, but there is only one extended property. This is the supportedExtension attribute, a multi-valued (ADCollection) read-only attribute. The values are OID's for supported extensions.
The default properties retrieved by the Search-ADAccount cmdlet are documented below. The column labeled "R/RW" documents whether the property is Read-Only (R) or Read-Write (RW). The last column documents the Active Directory attribute that the property is based on.
The Search-ADAccount cmdlet does not expose any extended properties, and does not support the -Properties parameter.
The default properties retrieved by the Get-ADOptionalFeature cmdlet are documented below. The column labeled "R/RW" documents whether the property is Read-Only (R) or Read-Write (RW). The last column documents the Active Directory attribute that the property is based on. The attributes are those of the Optional Feature objects, for example "cn=Recycle Bin Feature". These are objects of class msDS-OptionalFeature located in the container "cn=Optional Features,cn=Directory Service, cn=Windows NT, cn=Services, cn=Configuration,dc=mydomain,dc=com", where the domain is mydomain.com.
The default and extended properties retrieved by the Get-ADOptionalFeature cmdlet are documented in the following Wiki article:
Active Directory: Get-ADOptionalFeature Default and Extended Properties
The default properties retrieved by the Get-ADDefaultDomainPasswordPolicy cmdlet are documented below. The column labeled "R/RW" documents whether the property is Read-Only (R) or Read-Write (RW). The last column documents the Active Directory attribute that the property is based on. The attributes are those of a domain object, with class domainDNS.
The Get-ADDefaultDomainPasswordPolicy cmdlet does not expose any extended properties, and does not support the -Properties parameter.
The help for the Set-ADDefaultDomainPasswordPolicy cmdlet has incorrect or misleading information about the following parameters: ComplexityEnabled, LockoutDuration, LockoutObservationWindow, LockoutThreshold, MinPasswordLength, PasswordHistoryCount, and RevsibleEncryptionEnabled. The information in the table above is correct. In some cases the help states that the parameter assigns a value to a property with an ldapDisplayName that begins with "msDS-". No attributes of domain objects have any such names. In other cases the help states that the parameter assigns a value to a property of a password policy, most likely referring to attributes of a Password Settings Object (PSO). The help is probably referring to similar parameters of the Set-ADFineGrainedPasswordPolicy cmdlet. The Set-ADDefaultDomainPasswordPolicy cmdlet only assigns values to attributes of domain objects, corresponding to the default domain password policy.
The default properties retrieved by the Get-ADFineGrainedPasswordPolicy cmdlet are documented below. The column labeled "R/RW" documents whether the property is Read-Only (R) or Read-Write (RW). The last column documents the Active Directory attribute of the Fine-Grained Password Policy object that the property is based on. These are objects of class msDS-PasswordSettings located in the container "cn=Password Settings Container,cn=System,dc=mydomain,dc=com", where the domain is mydomain.com.
The default and extended properties retrieved by the Get-ADFineGrainedPasswordPolicy cmdlet are documented in the following Wiki article:
Active Directory: Get-ADFineGrainedPasswordPolicy Default and Extended Properties
The default properties retrieved by the Get-ADServiceAccount cmdlet are documented below. The column labeled "R/RW" documents whether the property is Read-Only (R) or Read-Write (RW). The last column documents the Active Directory attribute of the Service Account object that the property is based on. These are objects of class msDS-ManagedServiceAccount located in the container "cn=Managed Service Accounts,dc=mydomain,dc=com", where the domain is mydomain.com.
The default and extended properties retrieved by the Get-ADServiceAccount cmdlet are documented in the following Wiki article:
Active Directory: Get-ADServiceAccount Default and Extended Properties