This simple command allows you to get the GPO GUID in your Active Directory domain. Since Windows 2012, you can use the cmdlet get-gpo to play with Group policies get-gpo -all | select id Reference Get-GPO Gets one GPO or

You can retrieve the Active Directory forest functional level with the powershell cmdlet Get-ADForest import-module activedirectory Get-ADForest | select forestmode For the domain functional level, you can use the powershell cmdlet Get-ADDomain Get-ADDomain | select domainmode Reference Get-ADForest Syntax Get-ADForest

These commands get all the empty groups (no members) in an Active Directory domain. The output lists distinguished name (DN) of these groups. Script (with Microsoft Active Directory module loaded : import-module activedirectory) : Get-ADGroup -Filter * | Where-Object {@(Get-ADGroupMember

With the cmdlet Get-ADObject you will be able to list the deleted objects in your Active Directory domain Pre-requesite : import-module activedirectory Script : Get-ADObject -Filter ‘isdeleted -eq $TRUE -and name -ne “Deleted Objects”‘ -IncludeDeletedObjects -Properties * | ` Format-List

You will find below two methods to dump the user object DACL permissions in an Active Directory domain. Script (with Microsoft Active Directory module loaded : import-module activedirectory) : import-module activedirectory $pw = read-host “Enter password” -AsSecureString $cred = New-Object