A computer object in Active Directory (AD) stores the account details for a domain-joined device, including its name, security identifier (SID), and trust relationship with the domain. When a computer object is disabled, the device can no longer be authenticated via Kerberos and loses access to domain resources—this commonly happens after a machine is re-imaged, decommissioned, or removed from the domain and later rejoined.
Enabling a disabled computer object restores the device's ability to be authenticated against the domain. The account's enabled or disabled state is stored in the underlying userAccountControl attribute in AD. This page covers how to enable a computer object using PowerShell's Enable-ADAccount cmdlet, Active Directory Users and Computers (ADUC), Active Directory Administrative Center (ADAC), and ADManager Plus.
Import-Module ActiveDirectory
Import-Module ActiveDirectory
Enable-ADAccount -Identity "JohnS-1001"
This identifies the target computer account by its full LDAP path rather than the sAMAccountName:
Enable-ADAccount -Identity "CN=JohnS-1001,OU=Workstations,DC=example,DC=com"
This retrieves all disabled computers in a specific OU and passes them through the pipeline to Enable-ADAccount:
Get-ADComputer -Filter {Enabled -eq $false} -SearchBase "OU=Workstations,DC=example,DC=com" | Enable-ADAccount
This reads a CSV file containing a sAMAccountName column and enables each listed computer account:
Import-Csv -Path "C:\computers.csv" | ForEach-Object { Enable-ADAccount -Identity $_.sAMAccountName }
This runs the operation in simulation mode using -WhatIf to show which accounts would be affected without making any changes:
Get-ADComputer -Filter {Enabled -eq $false} -SearchBase "OU=Workstations,DC=example,DC=com" | Enable-ADAccount -WhatIf
This uses the -Server parameter to target a domain controller (DC) in a remote domain, with alternate credentials supplied via -Credential:
Enable-ADAccount -Identity "JohnS-1001" -Server "dc01.remotedomain.com" -Credential (Get-Credential)
| Parameter | Description |
|---|---|
| -Identity | Specifies the computer account to enable—accepts the sAMAccountName, DN, GUID, or SID |
| -Credential | Runs the cmdlet under alternate credentials when the current account lacks sufficient permissions |
| -Server | Specifies a DC or Active Directory Domain Services instance to connect to—useful when targeting a specific DC or a remote domain |
| -PassThru | Returns the enabled account object so you can verify it or pipe the result to another command |
| -WhatIf | Simulates the operation and shows which accounts would be affected without making any changes |
Note: The Enable Account option appears in the context menu only when the selected computer account is currently disabled.
Note: ADAC enables one computer account at a time through this path. There is no bulk selection or bulk enablement option available in ADAC.
ADManager Plus displays a change summary and the status of each operation after the action is completed.
The value passed to -Identity does not match any account in the directory. Verify the computer's sAMAccountName by running Get-ADComputer -Filter {Name -eq "ComputerName"}. Computer sAMAccountNames in AD include a trailing dollar sign (for example, JohnS-1001$), though Enable-ADAccount also accepts the name without it.
The account running the cmdlet does not have Write permissions on the target computer object. Run PowerShell as an account with Domain Admin or Account Operator privileges, or confirm that delegated rights have been granted for the relevant OU.
PowerShell cannot reach a DC. Verify network connectivity and DNS resolution and confirm that Active Directory Web Services is running on the target DC. If needed, specify an available DC using the -Server parameter.
The AD module is not loaded in the current session. Run Import-Module ActiveDirectory before using the cmdlet. If the module is unavailable, install RSAT for your Windows version first.
Run the following:
Get-ADComputer -Identity "JohnS-1001" -Properties Enabled
Check the current state. If it still shows as Enabled: False, confirm that AD replication has been completed across DCs and check whether any ACL restriction is blocking the modification on the target object.
ADManager Plus makes AD management easier and faster through a single, intuitive console. Here’s why it’s a better choice for IT teams:
Both achieve the same result by updating the userAccountControl attribute on the computer object. Enable-ADAccount works across all AD account types—users, computers, and service accounts—using the same syntax. Set-ADComputer is specific to computer objects. Both approaches are valid; Enable-ADAccount is typically shorter and more portable when working across mixed account types.
Yes. Use the -Server parameter to specify a DC in the target domain, then provide alternate credentials with -Credential if the current account does not have rights in that domain:
Enable-ADAccount -Identity "JohnS-1001" -Server "dc01.remotedomain.com" -Credential (Get-Credential)
Run the following command and check the Enabled property in the output. A value of True confirms the account is active.
Get-ADComputer -Identity "JohnS-1001" -Properties Enabled
You need Write permissions on the userAccountControl attribute of the computer object. Domain Admins and Account Operators have this by default. In delegated environments, help desk staff can be granted this specific right over an OU without needing to join either group. ADManager Plus simplifies this delegation through role-based assignment.
Not automatically. Enabling the account in AD restores the account's ability to be authenticated into the domain, but if the device's machine password is out of sync (for example, after re-imaging), the device may also need to be rejoined to the domain to reestablish the trust relationship.
Yes. ADManager Plus lets administrators delegate the enable and disable tasks to help desk technicians through role-based access control. Technicians can enable computer accounts from the ADManager Plus console without holding elevated AD privileges.