{"id":12491,"date":"2011-10-05T00:01:00","date_gmt":"2011-10-05T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2011\/10\/05\/search-active-directory-for-user-and-office-locations\/"},"modified":"2011-10-05T00:01:00","modified_gmt":"2011-10-05T00:01:00","slug":"search-active-directory-for-user-and-office-locations","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/search-active-directory-for-user-and-office-locations\/","title":{"rendered":"Search Active Directory for User and Office Locations"},"content":{"rendered":"

Summary:<\/strong> Search Active Directory for user and office locations by using Windows PowerShell and no scripting.<\/p>\n

 <\/p>\n

\"Hey,Hey, Scripting Guy! I am looking for an easy way to search Active Directory. For example, I need to find information out about users. We are moving offices in our city, and I need to find users who are in specific offices in specific cities. As soon as I know this information, I will be able to update the users to reflect the new office locations. I know this is probably too much to be asking, but hey, I am busy.<\/p>\n

—AC<\/p>\n

 <\/p>\n

\"Hey,Hello AC,<\/p>\n

Microsoft Scripting Guy Ed Wilson here. I am completely at home with busy. Luckily, the Scripting Wife is very understanding, and shares my interest in Windows PowerShell and community. Windows PowerShell is a very powerful tool, but it can also be extremely fun to use.<\/p>\n

When I am working from my local computer, I like to use Windows PowerShell remoting to make a connection to the domain controller. In this way, I do not have to install the Remote Server Administrator Tools (RSAT) on my Windows 7 desktop. The first thing I do is enter a Windows PowerShell session on my remote computer by using the Enter-PSSession<\/b> cmdlet. Next, I set my location to the C: drive so that I free up some command-line space. The final thing to do is to import the ActiveDirectory<\/b> module. This is done using the Import-Module<\/b> cmdlet, and using a wildcard character to shorten the module name. The commands I type to do all this are shown here:<\/p>\n

PS C:\\Users\\Administrator.NWTRADERS> Enter-PSSession dc1<\/p>\n

[dc1]: PS C:\\Users\\Administrator\\Documents> sl c:\\<\/p>\n

[dc1]: PS C:\\> Import-Module act*<\/p>\n

After I have connected to my domain controller and loaded the ActiveDirectory<\/b> module, I decide I want to find users who have an office in Charlotte. To do this, I use the Get-ADUser<\/b> cmdlet and I specify the LDAPFilter <\/i>parameter and provide an LDAP dialect query to the cmdlet. The advantage of the LDAP dialect queries is that it was commonly used with VBScript and Windows PowerShell 1.0 scripts to search Active Directory. There are thousands of scripts on the Internet providing samples of query syntax. After I type my query, nothing is returned. The command is shown here:<\/p>\n

[dc1]: PS C:\\> Get-ADUser -LDAPFilter “(office=charlotte)”<\/p>\n

The command and associated output are shown in the following figure.<\/p>\n

\"Image<\/a><\/p>\n

I use ADSI Edit to check the attribute name. As shown in the following figure, the actual name of the attribute is PhysicalDeliveryOfficeName<\/b>, and not office<\/b>. The attribute page from ADSI Edit is shown in the following figure.<\/p>\n

\"Image<\/a><\/p>\n

When I have the actual user attribute name, the LDAPFilter is easy to use. I use the syntax attribute = value<\/b>. <\/i>The key is that there must be no space between the attribute name and the equal sign. It is okay to have a space between the equal sign and the value, but I do not do this because it looks funny, and it is a bad habit to add spaces when not needed in LDAPFilters. The command and associated output are shown here:<\/p>\n

[dc1]: PS C:\\> Get-ADUser -LDAPFilter “(PhysicalDeliveryOfficeName=charlotte)”<\/p>\n

 <\/p>\n

DistinguishedName : CN=Test1User1,OU=test1,DC=nwtraders,DC=com<\/p>\n

Enabled           : False<\/p>\n

GivenName         : test1<\/p>\n

Name              : Test1User1<\/p>\n

ObjectClass       : user<\/p>\n

ObjectGUID        : 21c7a4d1-74a7-4f4e-a132-8f2b3e2f91ca<\/p>\n

SamAccountName    : Test1User1<\/p>\n

SID               : S-1-5-21-909705514-2746778377-2082649206-3717<\/p>\n

Surname           : user1<\/p>\n

UserPrincipalName :<\/p>\n

 <\/p>\n

DistinguishedName : CN=Test1User2,OU=test1,DC=nwtraders,DC=com<\/p>\n

Enabled           : False<\/p>\n

GivenName         :<\/p>\n

Name              : Test1User2<\/p>\n

ObjectClass       : user<\/p>\n

ObjectGUID        : a4818269-9630-42f3-83a8-4052b7630b01<\/p>\n

SamAccountName    : Test1User2<\/p>\n

SID               : S-1-5-21-909705514-2746778377-2082649206-3718<\/p>\n

Surname           :<\/p>\n

UserPrincipalName :<\/p>\n

 <\/p>\n

Suppose I want to find users in the city of Atlanta. The ADSI attribute for city is the letter L<\/b>. The following command shows how to find users in the city of Atlanta:<\/p>\n

[dc1]: PS C:\\> Get-ADUser -LDAPFilter “(L=Atlanta)”<\/p>\n

 <\/p>\n

DistinguishedName : CN=Test1User7,OU=test1,DC=nwtraders,DC=com<\/p>\n

Enabled           : False<\/p>\n

GivenName         : test1<\/p>\n

Name              : Test1User7<\/p>\n

ObjectClass       : user<\/p>\n

ObjectGUID        : ef4ef5b1-21c9-46ec-82fa-5754e11db1e5<\/p>\n

SamAccountName    : Test1User7<\/p>\n

SID               : S-1-5-21-909705514-2746778377-2082649206-3723<\/p>\n

Surname           : user7<\/p>\n

UserPrincipalName :<\/p>\n

 <\/p>\n

DistinguishedName : CN=Test1User8,OU=test1,DC=nwtraders,DC=com<\/p>\n

Enabled           : False<\/p>\n

GivenName         : Test1<\/p>\n

Name              : Test1User8<\/p>\n

ObjectClass       : user<\/p>\n

ObjectGUID        : f45123e7-9cad-49cc-830f-138c6d5b3c02<\/p>\n

SamAccountName    : Test1User8<\/p>\n

SID               : S-1-5-21-909705514-2746778377-2082649206-3724<\/p>\n

Surname           : User8<\/p>\n

UserPrincipalName :<\/p>\n

 <\/p>\n

DistinguishedName : CN=Test1User9,OU=test1,DC=nwtraders,DC=com<\/p>\n

Enabled           : False<\/p>\n

GivenName         : Test1<\/p>\n

Name              : Test1User9<\/p>\n

ObjectClass       : user<\/p>\n

ObjectGUID        : b688c597-3b1b-4a73-9e67-36b671db9774<\/p>\n

SamAccountName    : Test1User9<\/p>\n

SID               : S-1-5-21-909705514-2746778377-2082649206-3725<\/p>\n

Surname           : User9<\/p>\n

UserPrincipalName :<\/p>\n

 <\/p>\n

I do not want all the output from my command to find users in Atlanta. I only want to see user names, the city, and their physical office locations. To do this, I decide to pipe the command output to the Select-Object<\/b> cmdlet and choose the desired attributes. As shown in the following output, the city is not shown:<\/p>\n

[dc1]: PS C:\\> Get-ADUser -LDAPFilter “(L=Atlanta)” -Properties PhysicalDeliveryOfficeName | select name, PhysicalDeliveryOfficeName, L<\/p>\n

 <\/p>\n

Name<\/span>                           PhysicalDeliveryOfficeName<\/span>                    L<\/p>\n

Test1User7                    alpharetta<\/p>\n

Test1User8                    Duluth<\/p>\n

Test1User9                    Alpharetta<\/p>\n

The problem is I did not add the L<\/b> attribute to the list of properties I wanted to return from Active Directory. I must add the attribute to the properties I choose to return, even if I use the attribute in my LDAPFilter.<\/p>\n

[dc1]: PS C:\\> Get-ADUser -LDAPFilter “(L=Atlanta)” -Properties PhysicalDeliveryOfficeName, l | select name, PhysicalDeliveryOfficeName, l<\/p>\n

 <\/p>\n

Name<\/span>                                       PhysicalDeliveryOfficeName<\/span>                    l<\/span><\/p>\n

Test1User7                                alpharetta                                             Atlanta<\/p>\n

Test1User8                                Duluth                                                   Atlanta<\/p>\n

Test1User9                                Alpharetta                                             Atlanta<\/p>\n

I can change my query to return only users who have the city of Atlanta and their office in Duluth. To do this, I need to create a compound LDAP filter. As shown earlier, each attribute equals value<\/b> pairing is placed inside a pair of parentheses. When I add another attribute equals value<\/b> <\/i>pair, I must also put that inside a pair of parentheses. To state I want to look for one attribute value pair and<\/i> another attribute value pair, I use an ampersand before the first pair, and surround the entire set with another pair of parentheses. The following query illustrates this technique:<\/p>\n

[dc1]: PS C:\\> Get-ADUser -LDAPFilter “(&(L=Atlanta)(PhysicalDeliveryOfficeName=Duluth))”<\/p>\n

DistinguishedName : CN=Test1User8,OU=test1,DC=nwtraders,DC=com<\/p>\n

Enabled           : False<\/p>\n

GivenName         : Test1<\/p>\n

Name              : Test1User8<\/p>\n

ObjectClass       : user<\/p>\n

ObjectGUID        : f45123e7-9cad-49cc-830f-138c6d5b3c02<\/p>\n

SamAccountName    : Test1User8<\/p>\n

SID               : S-1-5-21-909705514-2746778377-2082649206-3724<\/p>\n

Surname           : User8<\/p>\n

UserPrincipalName :<\/p>\n

 <\/p>\n

I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/b><\/p>\n

 <\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Search Active Directory for user and office locations by using Windows PowerShell and no scripting.   Hey, Scripting Guy! I am looking for an easy way to search Active Directory. For example, I need to find information out about users. We are moving offices in our city, and I need to find users who […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,3,8,45],"class_list":["post-12491","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-scripting-guy","tag-searching-active-directory","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Summary: Search Active Directory for user and office locations by using Windows PowerShell and no scripting.   Hey, Scripting Guy! I am looking for an easy way to search Active Directory. For example, I need to find information out about users. We are moving offices in our city, and I need to find users who […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/12491","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=12491"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/12491\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=12491"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=12491"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=12491"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}