# Verify AD module is available
if (-not (Get-Module -ListAvailable ActiveDirectory)) {
    Write-Warning "ActiveDirectory module not installed. Install RSAT or run on a DC."
    # Alternative: Use ADSI queries
}
Import-Module ActiveDirectory -ErrorAction SilentlyContinue

# By name (partial match)
Get-ADUser -Filter "Name -like '*$searchTerm*'" -Properties DisplayName, EmailAddress, Enabled, LastLogonDate |
Select-Object SamAccountName, DisplayName, EmailAddress, Enabled, LastLogonDate

# By email
Get-ADUser -Filter "EmailAddress -eq '$email'" -Properties *

$user = Get-ADUser -Identity $username -Properties LockedOut, Enabled, PasswordExpired, LastLogonDate, PasswordLastSet
[PSCustomObject]@{
    User = $user.SamAccountName
    Enabled = $user.Enabled
    Locked = $user.LockedOut
    PasswordExpired = $user.PasswordExpired
    LastLogon = $user.LastLogonDate
    PasswordAge = (New-TimeSpan -Start $user.PasswordLastSet).Days
}

Unlock-ADAccount -Identity $username
# Verify
(Get-ADUser -Identity $username -Properties LockedOut).LockedOut

# User's groups
Get-ADPrincipalGroupMembership -Identity $username | Select-Object Name, GroupCategory

# Group's members
Get-ADGroupMember -Identity $groupName | Select-Object Name, ObjectClass

# Users not logged in for 90 days
$cutoff = (Get-Date).AddDays(-90)
Get-ADUser -Filter {LastLogonDate -lt $cutoff -and Enabled -eq $true} -Properties LastLogonDate |
Select-Object SamAccountName, LastLogonDate | Sort-Object LastLogonDate

# Find computer
Get-ADComputer -Filter "Name -like '*$hostname*'" -Properties OperatingSystem, LastLogonDate |
Select-Object Name, OperatingSystem, LastLogonDate, Enabled

# Stale computers (90 days)
Get-ADComputer -Filter {LastLogonDate -lt $cutoff} -Properties LastLogonDate |
Select-Object Name, LastLogonDate

# List OUs
Get-ADOrganizationalUnit -Filter * | Select-Object Name, DistinguishedName

# Objects in specific OU
Get-ADUser -SearchBase "OU=Sales,DC=contoso,DC=com" -Filter *

# Applied GPOs
gpresult /r

# Detailed GPO report
gpresult /h "$env:TEMP\gpo-report.html"

# Find user via ADSI
$searcher = [adsisearcher]"(samaccountname=$username)"
$searcher.FindOne().Properties

# Find all users in domain
$searcher = [adsisearcher]"(&(objectCategory=person)(objectClass=user))"
$searcher.FindAll() | ForEach-Object { $_.Properties.samaccountname }