Remove-ADPrincipalGroupMembership: remove adprincipal group membership against recorded identity and DNS state
Microsoft states: “Removes a member from one or more Active Directory groups.”
Read the explainerDSE security knowledge hubSecurity knowledge,
Security knowledge,
without the noise.
Page 178 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
DSE-authoredOfficial sourcesReviewed guidance
Search the library DSE post stream
3,000 articlesGuidance and analysis from DSE
Move-ADDirectoryServerOperationMasterRole: move addirectory server operation master role with before-and-after evidence
Microsoft states: “Moves operation master roles to an Active Directory directory server.”
Read the guide
Set-ADAccountExpiration: change adaccount expiration with bounded evidence
Microsoft states: “The Set-ADAccountExpiration cmdlet sets the expiration time for a user, computer, or service account.”
Read the playbook
Set-ADAccountPassword: change adaccount password under AD/DNS change control
Microsoft states: “The Set-ADAccountPassword cmdlet sets the password for a user, computer, or service account.”
Read the briefing
Set-ADResourceProperty: change adresource property with rollback checks
Microsoft states: “The Set-ADResourceProperty cmdlet can be used to modify a resource property in Active Directory.”
Read the checklist
Unlock-ADAccount: unlock adaccount against recorded identity and DNS state
Microsoft states: “The Unlock-ADAccount cmdlet restores Active Directory Domain Services (AD DS) access for an account that is locked.”
Read the explainer
Remove-ADComputerServiceAccount: remove adcomputer service account with before-and-after evidence
Microsoft states: “The Remove-ADComputerServiceAccount cmdlet removes service accounts from an Active Directory computer.”
Read the guide
Get-ADGroupMember: inventory adgroup member with bounded evidence
Microsoft states: “The Get-ADGroupMember cmdlet gets the members of an Active Directory group.”
Read the playbook
Clear-ADAccountExpiration: clear adaccount expiration under AD/DNS change control
Microsoft states: “The Clear-ADAccountExpiration cmdlet clears the expiration date for an Active Directory user or computer account.”
Read the briefing
Add-ADComputerServiceAccount: stage additions to adcomputer service account with rollback checks
Microsoft states: “Adds one or more service accounts to an Active Directory computer.”
Read the checklist