Remove-ADObject: remove adobject with rollback checks
Microsoft states: “You can use this cmdlet to remove any type of Active Directory object.”
Read the checklistDSE security knowledge hubMicrosoft 365 & Identity
Microsoft 365 & Identity
Knowledge
Page 20 of the DSE Microsoft 365 & Identity knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide Microsoft 365 & Identity knowledge center
Clear guidance for Microsoft 365, Entra identity, account protection, collaboration, endpoint policy, and lifecycle changes.
DSE post stream
760 articlesMicrosoft 365 & Identity
Remove-ADPrincipalGroupMembership: remove adprincipal group membership against recorded identity and DNS state
Microsoft states: “Removes a member from one or more Active Directory groups.”
Read the explainer
Move-ADDirectoryServerOperationMasterRole: move addirectory server operation master role with before-and-after evidence
Microsoft states: “Moves operation master roles to an Active Directory directory server.”
Read the guide
Set-ADAccountExpiration: change adaccount expiration with bounded evidence
Microsoft states: “The Set-ADAccountExpiration cmdlet sets the expiration time for a user, computer, or service account.”
Read the playbook
Set-ADAccountPassword: change adaccount password under AD/DNS change control
Microsoft states: “The Set-ADAccountPassword cmdlet sets the password for a user, computer, or service account.”
Read the briefing
Set-ADResourceProperty: change adresource property with rollback checks
Microsoft states: “The Set-ADResourceProperty cmdlet can be used to modify a resource property in Active Directory.”
Read the checklist
Unlock-ADAccount: unlock adaccount against recorded identity and DNS state
Microsoft states: “The Unlock-ADAccount cmdlet restores Active Directory Domain Services (AD DS) access for an account that is locked.”
Read the explainer
Remove-ADComputerServiceAccount: remove adcomputer service account with before-and-after evidence
Microsoft states: “The Remove-ADComputerServiceAccount cmdlet removes service accounts from an Active Directory computer.”
Read the guide
Get-ADGroupMember: inventory adgroup member with bounded evidence
Microsoft states: “The Get-ADGroupMember cmdlet gets the members of an Active Directory group.”
Read the playbook
Clear-ADAccountExpiration: clear adaccount expiration under AD/DNS change control
Microsoft states: “The Clear-ADAccountExpiration cmdlet clears the expiration date for an Active Directory user or computer account.”
Read the briefing