ADx

Fast, cross-platform Active Directory collection over raw LDAP.

ADx is AD + x. A drop-in, substantially faster alternative to RSAT's ActiveDirectory module — Get-ADxUser for Get-ADUser, Get-ADxGroup for Get-ADGroup — so existing scripts port by search-replacing the command name. The RSAT -Filter syntax, identity forms, parameter names, output property names and default property sets all match.

Get-ADxUser jdoe
Get-ADxUser -Filter "Enabled -eq $true -and Department -eq 'Sales'" -Properties EmailAddress
Get-ADxGroup -Filter "GroupScope -eq 'Universal'"
Get-ADxComputer -Filter "OperatingSystem -like '*Server*'" -Properties OperatingSystem

Requirements

PowerShell 7.5+. No RSAT, no domain join, no ADWS.

System.DirectoryServices.Protocols ships with PowerShell itself, so there is nothing to install and no third-party runtime dependencies.

Install

Import-Module ./module/adx.psd1

Cmdlets

Cmdlet	Replaces	Purpose
Get-ADxUser	Get-ADUser	Users, RSAT -Filter/-LDAPFilter/-Identity/-Properties
Get-ADxGroup	Get-ADGroup	Groups, with GroupScope/GroupCategory filterable server-side
Get-ADxComputer	Get-ADComputer	Computers, $-suffix identity handled automatically
Get-ADxObject	Get-ADObject	Any object class; DN/GUID identities
Get-ADxGroupMember	Get-ADGroupMember	Members (incl. primary-group), -Recursive, immune to MaxValRange
Get-ADxGroupNested	—	Every group nested inside a group, flattened
Get-ADxPrincipalGroupMembership	Get-ADPrincipalGroupMembership	Groups a principal belongs to (incl. primary-group), immune to MaxValRange
Get-ADxOrganizationalUnit	Get-ADOrganizationalUnit	OUs; LinkedGroupPolicyObjects from gPLink, DN/GUID identity
Get-ADxDefaultDomainPasswordPolicy	Get-ADDefaultDomainPasswordPolicy	Domain password/lockout policy; ages as TimeSpan
Get-ADxDomain	Get-ADDomain	Domain identity, FSMO holders, containers, replica DCs
Get-ADxForest	Get-ADForest	Forest mode, schema/naming masters, domains, GCs, sites
Get-ADxDomainController	Get-ADDomainController	Connected DC, one by -Identity, or all by -Filter *
Get-ADxServiceAccount	Get-ADServiceAccount	Standalone and group-managed service accounts (gMSA/sMSA)
Get-ADxFineGrainedPasswordPolicy	Get-ADFineGrainedPasswordPolicy	PSO objects; ages as TimeSpan, AppliesTo DN list
Search-ADxAccount	Search-ADAccount	Accounts by state: disabled/expired/expiring/inactive/locked/pwd-expired
Get-ADxRootDse	Get-ADRootDSE	Probe a DC: naming contexts, functional level, supported controls
Search-ADxObject	—	Generic LDAP search with paging, -All streaming, range retrieval

A filter or property list that cannot be honoured faithfully is a terminating error with an explanation, never a silent approximation — Active Directory answers a structurally valid but wrong filter with zero rows and a success code, and that is worse than any error message.

Usage

# What am I talking to?
Get-ADxRootDse -Server dc01.corp.contoso.com

# Enabled users, naming attributes explicitly - the single biggest performance lever
Search-ADxObject '(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))' `
    -Property sAMAccountName, displayName, mail, lastLogonTimestamp -All

# Groups, including ones large enough to need range retrieval
Search-ADxObject '(objectCategory=group)' -Property name, member -All

Naming attributes with -Property matters more than anything else here: without it the DC serialises every populated attribute on every entry.

Building

pwsh -NoProfile -File ./build.ps1 -Configuration Release

MIT