Managing Active Directory users and groups from PowerShell without scanning the whole directory

Goal

Read, create, and unblock Active Directory user and group objects from PowerShell using the ActiveDirectory module, scoped so a call against a large directory does not become an unbounded scan.

Prerequisites

The ActiveDirectory PowerShell module (from RSAT or installed on a domain controller); rights to read the target OU, and Account Operators or delegated write rights to create or unlock accounts.

Steps

1. Query with a real filter and only the properties needed: Get-ADUser -Filter "Department -eq 'Finance'" -Properties Mail,Title -SearchBase "OU=Users,DC=contoso,DC=com". The module's own reference shows Get-ADUser -Filter * as the everything-matches form — useful for a small OU, but on a directory with tens of thousands of objects it pulls every user object and every default property across the wire; always add -SearchBase and a specific -Filter, or -LDAPFilter for complex conditions.
2. Create an account non-interactively with the password supplied as a SecureString: $pw = ConvertTo-SecureString "TempP@ssw0rd!" -AsPlainText -Force; New-ADUser -Name "Jane Doe" -SamAccountName jdoe -UserPrincipalName jdoe@contoso.com -AccountPassword $pw -Enabled $true -ChangePasswordAtLogon $true. The literal is for illustration only — it lands in history and transcripts; in real runs read it from a secret store. Do not name the variable $pwd, which is PowerShell's automatic current-location variable. If the password violates the domain policy, the account is created but left disabled.
3. Add the new account to a group: Add-ADGroupMember -Identity "Finance Team" -Members jdoe.
4. Find locked-out or stale accounts across the domain: Search-ADAccount -LockedOut and Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly; both accept -SearchBase to scope the search. Inactivity is judged from the replicated lastLogonTimestamp, which can lag real logons by up to about two weeks.
5. Clear a lockout: Unlock-ADAccount -Identity jdoe.

Expected result

Get-ADUser returns only the scoped result set; the new account authenticates and is prompted to change its password at first logon; Search-ADAccount -LockedOut no longer lists the account after Unlock-ADAccount.

Limits and test basis

-AccountPassword on New-ADUser is documented to take a SecureString, not a plain string — passing plain text fails the parameter binding. To undo account creation, Remove-ADUser -Identity jdoe -Confirm:$false. A deleted account can only be brought back with its SID and memberships through Restore-ADObject when the AD Recycle Bin was enabled before the deletion; an Export-Clixml dump of its attributes is only a reference — recreating from it yields a new SID. None of these operations require a reboot; changes must first replicate to the domain controller the client uses, and group membership changes reach a user's access token only at the next sign-in (or, for network resources, after the Kerberos tickets are purged and reacquired), not in an already-open session.