How to list Active Directory computer accounts with Get-ADComputer
Last updated on:
Each domain-joined device in a Windows environment is represented in AD as a computer object. As a domain grows, these AD computer accounts accumulate across containers and organizational units: workstations, servers, and other endpoints joined at different points in time. Listing them is a routine part of AD computer management, whether you need a complete AD computer-account inventory, want to track recently provisioned devices, or are working through stale account cleanup.
This guide covers how to list AD computer accounts using the Get-ADComputer PowerShell cmdlet, ADUC, and ManageEngine ADManager Plus, which provides predefined computer reports without any scripting.
PowerShell
ADUC
ADManager Plus
Native tools limitations
Why ADManager Plus
FAQs
Listing all Active Directory computer accounts using PowerShell
Prerequisites for listing Active Directory computer accounts via PowerShell
Permissions: A Domain Admins account, or an account with delegated read rights over computer objects in the target domain.
Tools:Remote Server Administration Tools (RSAT) delivers the ActiveDirectory module for Windows PowerShell on Windows 10 and 11. On domain controllers, both are available by default.
Setup: Import the module before running any commands:
Import-Module ActiveDirectory
Steps to list Active Directory computer accounts using PowerShell
Run the following command to retrieve all Active Directory computer accounts in the domain:
Get-ADComputer -Filter *
Example 1: List all computers with key attributes
Retrieves all computer accounts in the domain and displays their name, DNS hostname, operating system, and enabled status.
Specifies a query string to filter computer objects. Use * to retrieve all accounts, or apply property-based conditions such as OperatingSystem or Enabled.
-Identity
Retrieves a single computer account by its distinguished name, GUID, SID, or SAM account name.
-SearchBase
Restricts the search to a specific OU or container, specified as a distinguished name.
-SearchScope
Defines the search depth: Base (current object only), OneLevel (immediate children), or Subtree (default).
-Properties
Returns attributes beyond the default set. Specify names as a comma-separated list, or use * for all attributes.
-Server
Targets a specific domain controller or AD DS instance.
-Credential
Runs the command using an alternate set of credentials.
-LDAPFilter
Accepts a raw LDAP query string as an alternative to the -Filter parameter.
Limitations for listing Active Directory computer accounts via PowerShell
Get-ADComputer returns a limited default attribute set; attributes such as OperatingSystem, LastLogonDate, and IPv4Address must be explicitly requested with -Properties in every command.
Exporting results requires scripting with Export-Csv; there is no built-in export option.
Results cannot be acted on directly from the console; management actions require separate cmdlets.
Running queries requires the executing account to have sufficient AD read permissions; native PowerShell provides no built-in model for delegating that access to non-privileged accounts.
List the Active Directory computer accounts using ADUC
Prerequisites for listing Active Directory computer accounts via ADUC
Permissions: A Domain Admins account, or an account with delegated read rights over computer objects in the target domain.
Tools: Active Directory Users and Computers is included with RSAT on Windows 10 and 11. On domain controllers, it is available by default.
Steps to list the Active Directory computer accounts using ADUC
ADUC lets you browse and search for computer objects through a graphical console.
Open ADUC by pressing Win + R, typing dsa.msc, and pressing Enter, or launch it from Server Manager > Tools.
In the console tree, expand the domain node. Computer accounts added to the default Computers container are visible directly. Click any container or OU to view the objects it holds.
To find all computer accounts across the domain regardless of OU placement, select the domain node in the console tree, then click Action > Find, or press Ctrl+F.
In the Find dialog, select Computers from the Find dropdown.
Confirm the domain is selected in the In field, then click Find Now.
The results pane lists all computer accounts matching your criteria.
Note: To refine results further, use the fields on the Computers and Advanced tabs in the Find dialog before clicking Find Now. Right-clicking any result lets you open its properties or take management actions directly from the results list.
Limitations for listing Active Directory computer accounts via ADUC
ADUC displays objects within one container or OU at a time; retrieving a domain-wide list requires the Find dialog, and its results cannot be exported directly.
There is no way to take bulk management actions on results returned from the Find dialog.
How to list Active Directory computer accounts using ADManager Plus
ADManager Plus provides the All Computers report under Computer Reports, which returns all computer objects in the selected domain without any scripting. Additional predefined reports in the same section include All Workstations, Recently Created Computers, Recently Modified Computers, and Recently Deleted Computers.
Prerequisites for listing Active Directory computer accounts via ADManager Plus
Permissions: ADManager Plus account access to Reports and Computer Reports.
Domain configuration: The target domain must be added in ADManager Plus under Admin > Domain Settings, with connectivity to a domain controller confirmed.
Credentials: The service account ADManager Plus uses to connect to the domain needs at least read access to computer objects.
Steps to list Active Directory computer accounts using ADManager Plus
Log in to ADManager Plus and navigate to Reports > Computer Reports > General Reports.
Click All Computers.
Select the domain from the Select Domain dropdown. To narrow results to a specific OU, click Add OUs and select the organizational unit.
Click Generate.
To save the report, click Export As and select a format: CSV, PDF, HTML, XLSX, or CSVDE.
From the report view, you can enable, disable, delete, or move computer accounts using the built-in management options, without navigating to a separate console.
Troubleshooting
1. The term Get-ADComputer is not recognized as the name of a cmdlet.
The ActiveDirectory module is not loaded in the current session. Run Import-Module ActiveDirectory first. If the module is missing entirely, install RSAT for your Windows version, then import the module again.
2. Access is denied.
The account running the command lacks sufficient rights to query AD computer objects. Run PowerShell with an account in Domain Admins, or one with delegated read access to computer objects in the target domain.
3. Unable to contact the server. This may be because this server does not exist, it is currently down, or it does not have the Active Directory Web Services running.
The command cannot reach a domain controller. Check DNS resolution and network connectivity to the domain. If the default domain controller is unreachable, specify a reachable controller explicitly with -Server dc.corp.com.
4. Get-ADComputer returns no results when using -SearchBase.
An incorrect or mistyped distinguished name passed to -SearchBase silently returns no results rather than throwing an error. Verify the OU's distinguished name before using it in a query:
Limitations of using native tools to list Active Directory computer accounts
ADUC displays computer accounts within one container or OU at a time; viewing all accounts across the domain requires the Find dialog, and results from that dialog cannot be exported directly.
Get-ADComputer returns a limited default attribute set; attributes such as OperatingSystem, LastLogonDate, and IPv4Address must be explicitly requested with -Properties in every command.
Exporting results requires scripting with Export-Csv; neither ADUC nor the PowerShell console includes a built-in export option.
Running queries requires the executing account to have adequate AD privileges; there is no built-in delegation model in native tools for granting read-only access to computer reports without elevating native rights.
Neither ADUC nor PowerShell provides on-the-fly management actions alongside domain-wide list results; performing actions requires separate commands or additional console navigation.
How ADManager Plus helps you manage Active Directory computer accounts
Predefined computer reports: Generate the All Computers, All Workstations, Recently Created Computers, Recently Modified Computers, and other reports at a click, with no queries to write.
Export to multiple formats: Export any computer report to CSV, PDF, HTML, XLSX, or CSVDE directly from the report view.
Active Directory computer management: Enable, disable, delete, or move computer accounts directly from any report view, without switching consoles.
Schedule and auto-email reports: Configure reports to run on a recurring schedule and deliver automatically to the right stakeholders.
ADManager Plus provides a built-in export option that handles this in multiple formats without any scripting.
Finding inactive AD computer accounts involves filtering by LastLogonDate against a threshold date. Note that LastLogonDate derives from lastLogonTimestamp, which replicates across domain controllers but may lag by up to 9–14 days under default settings; it is not an exact last-logon time, so use a threshold long enough to account for that delay. ADManager Plus includes a dedicated Inactive Computers report under Computer Reports > Account Status Reports that handles this automatically across all selected domains.
By default, Get-ADComputer returns: DistinguishedName, DNSHostName, Enabled, Name, ObjectClass, ObjectGUID, SamAccountName, and SID. Attributes such as OperatingSystem, OperatingSystemVersion, LastLogonDate, IPv4Address, MemberOf, and Description are not in the default set and must be requested with -Properties.
Simplify AD bulk management and reporting with ADManager Plus
