Get-ADUser cmdlet returns fewer properties because your workstation lacks the Active Directory module or has an outdated version of it. This is typically caused by missing Remote Server Administration Tools (RSAT) or a mismatch in PowerShell module versions between machines. Installing the correct RSAT package and verifying the module path resolves the discrepancy, ensuring both systems query the same schema definitions from the domain controller.
Verify Module Availability
The most common reason for this behavior is that the ActiveDirectory module is not loaded or available on your local machine. Your coworker likely has the full suite of administrative tools installed, while you might only have basic PowerShell features. To check if the module exists on your system, open PowerShell as an administrator and run the following command:
Get-Module -ListAvailable -Name ActiveDirectoryIf this command returns no results, the module is completely absent from your environment. If it returns a result but with a lower version number than your colleague's, you may have an older build installed. In either case, the cmdlet will fall back to default behaviors or fail to expand properties that require specific schema knowledge present only in newer or fully installed modules.
Install RSAT for Windows 10 and 11
For modern Windows client operating systems, the Active Directory module is part of the Remote Server Administration Tools (RSAT). Microsoft changed how these tools are delivered starting with Windows 10 version 1809. You must explicitly install them via the "Optional Features" menu rather than downloading a separate installer package.
- Open Settings and navigate to Apps > Optional features.
- Click on Add a feature or View features.
- Search for RSAT: Active Directory Domain Services and Lightweight Directory Access Protocol Services Tools.
- Select the checkbox and click Install.
Once installation completes, restart your PowerShell session. The Get-ADUser cmdlet should now be able to retrieve all standard properties. If you are using Windows 10 version 1709 or older, you need to download the specific MSU update package from the Microsoft Update Catalog corresponding to your OS architecture (x64 or x86).
Check PowerShell Profile and Auto-Loading
Sometimes the module is installed but not automatically imported when you type Get-ADUser. PowerShell relies on auto-loading mechanisms, but sometimes user profiles or group policies interfere with this process. Check your current session state by running:
Import-Module ActiveDirectory -VerboseIf this command succeeds without errors, try running Get-ADUser -Identity Administrator -Properties *. The verbose output will show exactly which DLLs are being loaded. If it fails, note the error message. Common issues include execution policy restrictions preventing the loading of signed modules or corrupted module manifests. Ensure your execution policy allows local scripts or unsigned modules if necessary, though this is rarely the cause for built-in RSAT modules.
Compare Schema Versions
If both machines have RSAT installed, the difference might stem from the domain functional level versus the client tool version. Newer versions of RSAT include support for newer AD attributes introduced in recent Windows Server updates. If your coworker’s PC has a more recent RSAT build, they can see attributes that your older build does not recognize. To fix this, ensure both workstations are updated to the latest cumulative updates for Windows.
You can verify the version of the AD module currently loaded in memory by checking the module manifest:
(Get-Module ActiveDirectory).ModuleBaseCompare this path with your coworker's. If the paths differ significantly in version numbers, updating your Windows features will align the capabilities.
Network and DNS Configuration
In rare cases, network segmentation or DNS misconfiguration can cause partial data retrieval. If your PC cannot resolve certain domain controllers or LDAP endpoints efficiently, it might receive truncated responses. However, this usually results in timeouts or errors rather than just fewer properties. Ensure that your primary DNS server points to your internal domain controllers, not an external resolver like Google DNS, as AD queries rely heavily on SRV records located in the internal DNS zone.
For more details on managing workstation configurations during migrations, you might find Delete Registry Keys, Values Containing String 'CMD' or 'PowerShell' for Workstation/PC Server Name Migration helpful for cleaning up old references that could interfere with new tool installations.
Frequently Asked Questions
Why does Get-ADUser return null for some properties?
Properties appear null when the user object does not have a value set for that attribute in Active Directory, or when the property requires specific permissions to read. Always use the -Properties parameter to explicitly request extended attributes, as the default view only includes a subset of common fields.
Can I use Get-ADUser without installing RSAT?
No, the Get-ADUser cmdlet is part of the ActiveDirectory module, which is exclusively included in RSAT. Without RSAT, you must use alternative methods such as System.DirectoryServices.AccountManagement (S.DS.AM) or third-party libraries like Quest AD Cmdlets, though these are deprecated or less supported.
How do I know if my RSAT version is outdated?
Run Get-Module ActiveDirectory and check the Version property. Compare this against the latest RSAT release notes from Microsoft for your specific Windows version. If your version is several months behind, it may lack support for newly added AD attributes.
What if the module loads but still shows limited info?
This often indicates a permission issue or a filtered view. Check if you are querying a Global Catalog vs. a standard Domain Controller. Some attributes are only replicated to the GC. Additionally, ensure you are not restricted by Fine-Grained Password Policies or ACLs that hide certain object properties from your security context.
Does Windows 11 require separate RSAT installation?
No, Windows 11 includes RSAT tools by default, but they are disabled. You must enable them via Settings > Apps > Optional Features, or via PowerShell using Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools*. They are not installed out-of-the-box like they were in Windows 7.