Specify a server name and port number for an Active Directory cmdlet

Summary

Many cmdlets in the Windows PowerShell Active Directory module include a -Server parameter that lets you target operations to a specific domain controller (DC) and port. This article describes the common ports you can use together with Active Directory cmdlets and provides a reference list of all cmdlets that support the -Server parameter.

Introduction

Many of the cmdlets in the Windows PowerShell Active Directory module support a -Server parameter. If you use these cmdlets to manage Active Directory Domain Services (AD DS), you can use the parameter together with a service or server name and port number. In this manner, you can target operations to a particular service on a particular DC. For example, in the following cmdlet, the -Server option uses a fully qualified domain name (FQDN) and the global catalog service port (port 3268) to target a specific global catalog server (GC):

Get-ADCentralAccessRule -Filter * -Server dc01.contoso.com:3268

More Information

The following table lists the most common ports that you can use to connect to particular services, and describes how to use them.

Port	Comments
Port 389	The default port that the Active Directory cmdlets use to connect to specific servers.
Port 3268	The global catalog (GC) port. Use this port to optimize searches, to search all domains in a forest, and to search the whole forest. The GC is read-only.
Ports 636 and 3269	The ports for secure Lightweight Directory Access Protocol (LDAP) connections to DCs and GCs. Use the Simple Authentication and Security Layer (SASL) protocol when you use these ports to connect. Don't use Transport Layer Security (TLS). Important Active Directory Web Services (ADWS) doesn't recognize TLS. ADWS is a service that most of the AD module cmdlets use.1
Custom port for Lightweight Directory Service (LDS) instances	Use the port number to identify the instance to connect to. Each instance can have a different schema and has a different set of naming contexts. These LDS instances are writable. Important: If LDS uses a custom service account, Active Directory PowerShell provider uses NTLM to authenticate any cmdlets that access the LDS instance.2
Custom port for mounted AD DS snapshots	Use the port number to specify which mounted snapshot instance to connect to. Each mounted snapshot instance can have a different schema and has a different set of naming contexts. Mounted snapshots are set as read-only.

¹ The cmdlets in the Active Directory PowerShell module don't connect directly to a particular server and port. Instead, they connect to ADWS on port 9389. ADWS connects to the local Active Directory instance on behalf of the cmdlet.

² If LDS runs in the context of a custom service account, Active Directory PowerShell provider uses NTLM to authenticate requests instead of Kerberos. The Active Directory PowerShell provider uses the service principal name (SPN) that's registered to the custom service account (in this case, the LDAP service SPN). However, the ADWS endpoint that the provider connect to runs in the context of the computer account. If the provider tries to use Kerberos authentication in this situation, ADWS responds by sending error code 0x29 (KRB_AP_ERR_MODIFIED).

References

• Service overview and network port requirements
• AD DS: Database Mounting Tool (Snapshot Viewer or Snapshot Browser)
• Active Directory Snapshot

The following table provides an index of the Active Directory module cmdlets that support the -Server parameter.

Note

Some of these cmdlets might not use ADWS. To be certain, you can check the "Notes" section of the cmdlet reference article. "Notes" lists whether the cmdlet requires ADWS.

Cmdlet	Description
Add-ADCentralAccessPolicyMember	Adds central access rules to a central access policy in Active Directory.
Add-ADComputerServiceAccount	Adds one or more service accounts to an Active Directory computer.
Add-ADDomainControllerPasswordReplicationPolicy	Adds users, computers, and groups to the allowed or denied list of a read-only DC password replication policy.
Add-ADFineGrainedPasswordPolicySubject	Applies a fine-grained password policy to one or more users and groups.
Add-ADGroupMember	Adds one or more members to an Active Directory group.
Add-ADPrincipalGroupMembership	Adds a member to one or more Active Directory groups.
Add-ADResourcePropertyListMember	Adds one or more resource properties to a resource property list in Active Directory.
Clear-ADAccountExpiration	Clears the expiration date for an Active Directory account.
Clear-ADClaimTransformLink	Removes a claims transformation from being applied to one or more cross-forest trust relationships in Active Directory.
Complete-ADServiceAccountMigration	Completes the migration process and supersedes a normal user account to a delegated managed service account.
Disable-ADAccount	Disables an Active Directory account.
Disable-ADOptionalFeature	Disables an Active Directory optional feature.
Enable-ADAccount	Enables an Active Directory account.
Enable-ADOptionalFeature	Enables an Active Directory optional feature.
Get-ADAccountAuthorizationGroup	Gets the account's token group information.
Get-ADAccountResultantPasswordReplicationPolicy	Gets the resultant password replication policy for an Active Directory account.
Get-ADAuthenticationPolicy	Gets one or more Active Directory Domain Services authentication policies.
Get-ADAuthenticationPolicySilo	Gets one or more Active Directory Domain Services authentication policy silos.
Get-ADCentralAccessPolicy	Retrieves central access policies from Active Directory.
Get-ADCentralAccessRule	Retrieves central access rules from Active Directory.
Get-ADClaimTransformPolicy	Returns one or more Active Directory claim transform objects based on a specified filter.
Get-ADClaimType	Returns a claim type from Active Directory.
Get-ADComputer	Gets one or more Active Directory computers.
Get-ADComputerServiceAccount	Gets the service accounts that are hosted by a computer.
Get-ADDefaultDomainPasswordPolicy	Gets the default password policy for an Active Directory domain.
Get-ADDomain	Gets an Active Directory domain.
Get-ADDomainController	Gets one or more Active Directory DCs by using discoverable services criteria or search parameters, or by providing a DC identifier, such as the NetBIOS name.
Get-ADDomainControllerPasswordReplicationPolicy	Gets the members of the allowed list or denied list of a read-only domain controller's password replication policy.
Get-ADDomainControllerPasswordReplicationPolicyUsage	Gets the Active Directory accounts that are authenticated by a read-only DC or that are in the revealed list of the DC.
Get-ADFineGrainedPasswordPolicy	Gets one or more Active Directory fine-grained password policies.
Get-ADFineGrainedPasswordPolicySubject	Gets the users and groups to which a fine-grained password policy is applied.
Get-ADForest	Gets an Active Directory forest.
Get-ADGroup	Gets one or more Active Directory groups.
Get-ADGroupMember	Gets the members of an Active Directory group.
Get-ADObject	Gets one or more Active Directory objects.
Get-ADOptionalFeature	Gets one or more Active Directory optional features.
Get-ADOrganizationalUnit	Gets one or more Active Directory organizational units.
Get-ADPrincipalGroupMembership	Gets the Active Directory groups that have a specified user, computer, group, or service account.
Get-ADReplicationAttributeMetadata	Gets the replication metadata for one or more Active Directory replication partners.
Get-ADReplicationConnection	Returns a specific Active Directory replication connection or a set of AD replication connection objects based on a specified filter.
Get-ADReplicationPartnerMetadata	Returns the replication metadata for a set of one or more replication partners.
Get-ADReplicationSite	Returns a specific Active Directory replication site or a set of replication site objects based on a specified filter.
Get-ADReplicationSiteLink	Returns a specific Active Directory site link or a set of site links based on a specified filter.
Get-ADReplicationSiteLinkBridge	Gets a specific Active Directory site link bridge or a set of site link bridge objects based on a specified filter.
Get-ADReplicationSubnet	Gets one or more Active Directory subnets.
Get-ADResourceProperty	Gets one or more resource properties.
Get-ADResourcePropertyList	Gets resource property lists from Active Directory.
Get-ADResourcePropertyValueType	Gets a resource property value type from Active Directory.
Get-ADRootDSE	Gets the root of a directory server information tree.
Get-ADServiceAccount	Gets one or more Active Directory managed service accounts or group managed service accounts.
Get-ADTrust	Gets all trusted domain objects in the directory.
Get-ADUser	Gets one or more Active Directory users.
Get-ADUserResultantPasswordPolicy	Gets the resultant password policy for a user.
Grant-ADAuthenticationPolicySiloAccess	Grants permission to join an authentication policy silo.
Move-ADDirectoryServer	Moves a directory server in Active Directory to a new site.
Move-ADDirectoryServerOperationMasterRole	Moves operation master roles to an Active Directory directory server.
Move-ADObject	Moves an Active Directory object or a container of objects to a different container or domain.
New-ADAuthenticationPolicy	Creates an AD DS authentication policy object.
New-ADAuthenticationPolicySilo	Creates an AD DS authentication policy silo object.
New-ADCentralAccessPolicy	Creates a new central access policy in Active Directory that contains a set of central access rules.
New-ADCentralAccessRule	Creates a central access rule in Active Directory.
New-ADClaimTransformPolicy	Creates a new claim transformation policy object in Active Directory.
New-ADClaimType	Creates a new claim type in Active Directory.
New-ADComputer	Creates a new Active Directory computer object.
New-ADFineGrainedPasswordPolicy	Creates a new Active Directory fine-grained password policy.
New-ADGroup	Creates an Active Directory group.
New-ADObject	Creates an Active Directory object.
New-ADOrganizationalUnit	Creates an Active Directory organizational unit (OU).
New-ADReplicationSite	Creates an Active Directory replication site in the directory.
New-ADReplicationSiteLink	Creates a new Active Directory site link to manage replication.
New-ADReplicationSiteLinkBridge	Creates a site link bridge in Active Directory for replication.
New-ADReplicationSubnet	Creates an Active Directory replication subnet object.
New-ADResourceProperty	Creates a resource property in Active Directory.
New-ADResourcePropertyList	Creates a resource property list in Active Directory.
New-ADServiceAccount	Creates a new Active Directory managed service account or group managed service account object.
New-ADUser	Creates an Active Directory user.
Remove-ADAuthenticationPolicy	Removes an AD DS authentication policy object.
Remove-ADAuthenticationPolicySilo	Removes an AD DS authentication policy silo object.
Remove-ADCentralAccessPolicy	Removes a central access policy from Active Directory.
Remove-ADCentralAccessPolicyMember	Removes central access rules from a central access policy in Active Directory.
Remove-ADCentralAccessRule	Removes a central access rule from Active Directory.
Remove-ADClaimTransformPolicy	Removes a claim transformation policy object from Active Directory.
Remove-ADClaimType	Removes a claim type from Active Directory.
Remove-ADComputer	Removes an Active Directory computer.
Remove-ADComputerServiceAccount	Removes one or more service accounts from a computer.
Remove-ADDomainControllerPasswordReplicationPolicy	Removes users, computers, and groups from the allowed or denied list of a read-only DC password replication policy.
Remove-ADFineGrainedPasswordPolicy	Removes an Active Directory fine-grained password policy.
Remove-ADFineGrainedPasswordPolicySubject	Removes one or more users from a fine-grained password policy.
Remove-ADGroup	Removes an Active Directory group.
Remove-ADGroupMember	Removes one or more members from an Active Directory group.
Remove-ADObject	Removes an Active Directory object.
Remove-ADOrganizationalUnit	Removes an Active Directory organizational unit.
Remove-ADPrincipalGroupMembership	Removes a member from one or more Active Directory groups.
Remove-ADReplicationSite	Deletes the specified replication site object from Active Directory.
Remove-ADReplicationSiteLink	Deletes an Active Directory site link used to manage replication.
Remove-ADReplicationSiteLinkBridge	Deletes a replication site link bridge from Active Directory.
Remove-ADReplicationSubnet	Deletes the specified Active Directory replication subnet object from the directory.
Remove-ADResourceProperty	Removes a resource property from Active Directory.
Remove-ADResourcePropertyList	Removes one or more resource property lists from Active Directory.
Remove-ADResourcePropertyListMember	Removes one or more resource properties from a resource property list in Active Directory.
Remove-ADServiceAccount	Removes an Active Directory managed service account or group managed service account object.
Remove-ADUser	Removes an Active Directory user.
Rename-ADObject	Changes the name of an Active Directory object.
Reset-ADServiceAccountMigration	Resets the state of a migration to a delegated managed service account, and unlinks the delegated managed service account from the user account.
Restore-ADObject	Restores an Active Directory object.
Revoke-ADAuthenticationPolicySiloAccess	Revokes membership in an authentication policy silo for the specified account.
Search-ADAccount	Gets Active Directory user, computer, or service accounts.
Set-ADAccountAuthenticationPolicySilo	Modifies the authentication policy or authentication policy silo of an account.
Set-ADAccountControl	Modifies user account control (UAC) values for an Active Directory account.
Set-ADAccountExpiration	Sets the expiration date for an Active Directory account.
Set-ADAccountPassword	Modifies the password of an Active Directory account.
Set-ADAuthenticationPolicy	Modifies an AD DS authentication policy object.
Set-ADAuthenticationPolicySilo	Modifies an AD DS authentication policy silo object.
Set-ADCentralAccessPolicy	Modifies a central access policy in Active Directory.
Set-ADCentralAccessRule	Modifies a central access rule in Active Directory.
Set-ADClaimTransformLink	Applies a claims transformation to one or more cross-forest trust relationships in Active Directory.
Set-ADClaimTransformPolicy	Sets the properties of a claims transformation policy in Active Directory.
Set-ADClaimType	Modify a claim type in Active Directory.
Set-ADComputer	Modifies an Active Directory computer object.
Set-ADDefaultDomainPasswordPolicy	Modifies the default password policy for an Active Directory domain.
Set-ADDomain	Modifies an Active Directory domain.
Set-ADDomainMode	Sets the domain mode for an Active Directory domain.
Set-ADFineGrainedPasswordPolicy	Modifies an Active Directory fine-grained password policy.
Set-ADForest	Modifies an Active Directory forest.
Set-ADForestMode	Sets the forest mode for an Active Directory forest.
Set-ADGroup	Modifies an Active Directory group.
Set-ADObject	Modifies an Active Directory object.
Set-ADOrganizationalUnit	Modifies an Active Directory OU.
Set-ADReplicationConnection	Sets properties on Active Directory replication connections.
Set-ADReplicationSite	Sets the replication properties for an Active Directory site.
Set-ADReplicationSiteLink	Sets the properties for an Active Directory site link.
Set-ADReplicationSiteLinkBridge	Sets the properties of a replication site link bridge in Active Directory.
Set-ADReplicationSubnet	Sets the properties of an Active Directory replication subnet object.
Set-ADResourceProperty	Modifies a resource property in Active Directory.
Set-ADResourcePropertyList	Modifies a resource property list in Active Directory.
Set-ADServiceAccount	Modifies an Active Directory managed service account or group managed service account object.
Set-ADUser	Modifies an Active Directory user.
Show-ADAuthenticationPolicyExpression	Creates or modifies an security descriptor definition language (SDDL) security descriptor by using the Edit Access Control Conditions window.
Start-ADServiceAccountMigration	Starts the migration process by linking a normal user account to a delegated managed service account.
Undo-ADServiceAccountMigration	Reverts the previous migration phase of a migration to a delegated managed service account. If the migration process is currently in the start phase, the accounts are unlinked from each other. If the migration is in the completed phase, it reverts to the state in the start phase.
Unlock-ADAccount	Unlocks an Active Directory account.