{"id":3174,"date":"2013-07-24T00:01:00","date_gmt":"2013-07-24T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2013\/07\/24\/exploring-active-directory-data-types-with-powershell\/"},"modified":"2013-07-24T00:01:00","modified_gmt":"2013-07-24T00:01:00","slug":"exploring-active-directory-data-types-with-powershell","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/exploring-active-directory-data-types-with-powershell\/","title":{"rendered":"Exploring Active Directory Data Types with PowerShell"},"content":{"rendered":"

Summary<\/strong>: Microsoft Scripting Guy, Ed Wilson, talks about using Windows PowerShell to explore Active Directory data types.<\/span><\/p>\n

\"Hey, Hey, Scripting Guy! I need a way to see the data types of various Active Directory attributes. I know I can look up this information on MSDN, but I want to explore these on my own. Have you written an Active Directory schema browser?<\/p>\n

—AB<\/p>\n

\"Hey, Hello AB,<\/p>\n

Microsoft Scripting Guy, Ed Wilson, is here. You know, more than five years ago I wrote an Active Directory schema browser in Windows PowerShell. I just looked at it again, and I will be honest, I was not really impressed. It seems that I have learned a bit about Windows PowerShell in the intervening years. But one thing I did not remember, was how I actually accessed the Active Directory schema in the first place. So from that 116 line Windows PowerShell script, the following line of script is about all I really needed. Good thing I saved that script, or I might have been in trouble. As I recall, it is not something that is easily found.<\/p>\n

Use PowerShell to retrieve the Active Directory schema<\/h2>\n

I use the [DirectoryServices.ActiveDirectory.ActiveDirectorySchema] .NET Framework class and the GetCurrentSchema <\/strong>static to retrieve the current schema. I store the returned ActiveDirectorySchema<\/strong> object in a variable named $schema<\/strong>. This technique is shown here:<\/p>\n

$schema =[DirectoryServices.ActiveDirectory.ActiveDirectorySchema]::GetCurrentSchema()<\/p>\n

Now I look inside the $schema<\/strong> variable to see what I have obtained, as shown here:<\/p>\n

PS C:\\> $schema<\/p>\n

 <\/p>\n

SchemaRoleOwner                            Name<\/p>\n

—————                            —-<\/p>\n

dc1.iammred.net                            CN=Schema,CN=Configuration,DC=iammred,…<\/p>\n

I decide to use Get-Member<\/strong> to see what this object will enable me to do. Here is the command and the results:<\/p>\n

PS C:\\> $schema | Get-Member<\/p>\n

 <\/p>\n

   TypeName: System.DirectoryServices.ActiveDirectory.ActiveDirectorySchema<\/p>\n

 <\/p>\n

Name                     MemberType Definition<\/p>\n

—-                     ———- ———-<\/p>\n

Dispose                  Method     void Dispose(), void IDisposable.Dispose()<\/p>\n

Equals                   Method     bool Equals(System.Object obj)<\/p>\n

FindAllClasses           Method     System.DirectoryServices.ActiveDirectory.Read…<\/p>\n

FindAllDefunctClasses    Method     System.DirectoryServices.ActiveDirectory.Read…<\/p>\n

FindAllDefunctProperties Method     System.DirectoryServices.ActiveDirectory.Read…<\/p>\n

FindAllProperties        Method     System.DirectoryServices.ActiveDirectory.Read…<\/p>\n

FindClass                Method     System.DirectoryServices.ActiveDirectory.Acti…<\/p>\n

FindDefunctClass         Method     System.DirectoryServices.ActiveDirectory.Acti…<\/p>\n

FindDefunctProperty      Method     System.DirectoryServices.ActiveDirectory.Acti…<\/p>\n

FindProperty             Method     System.DirectoryServices.ActiveDirectory.Acti…<\/p>\n

GetDirectoryEntry        Method     adsi GetDirectoryEntry()<\/p>\n

GetHashCode              Method     int GetHashCode()<\/p>\n

GetType                  Method     type GetType()<\/p>\n

RefreshSchema            Method     void RefreshSchema()<\/p>\n

ToString                 Method     string ToString()<\/p>\n

Name                     Property   string Name {get;}<\/p>\n

SchemaRoleOwner          Property   System.DirectoryServices.ActiveDirectory.Dire…<\/p>\n

There were two properties displayed earlier when I examined the $schema<\/strong> variable. There are also a bunch of methods. These methods seem to be rather interesting. First, let me look at a User<\/strong> class:<\/p>\n

PS C:\\> $schema.FindClass(“user”)<\/p>\n

 <\/p>\n

Name                            : user<\/p>\n

CommonName                      : User<\/p>\n

Oid                             : 1.2.840.113556.1.5.9<\/p>\n

Description                     :<\/p>\n

IsDefunct                       : False<\/p>\n

PossibleSuperiors               : {msExchSystemObjectsContainer, builtinDomain,<\/p>\n

                                  organizationalUnit, domainDNS}<\/p>\n

PossibleInferiors               : {ms-net-ieee-80211-GroupPolicy,<\/p>\n

                                  msExchActiveSyncDevices,<\/p>\n

                                  ms-net-ieee-8023-GroupPolicy, classStore…}<\/p>\n

MandatoryProperties             : {cn, instanceType, nTSecurityDescriptor,<\/p>\n

                                  objectCategory…}<\/p>\n

OptionalProperties              : {accountExpires, accountNameHistory,<\/p>\n

                                  aCSPolicyName, adminCount…}<\/p>\n

AuxiliaryClasses                : {bootableDevice, samDomainBase,<\/p>\n

                                  simpleSecurityObject, ieee802Device…}<\/p>\n

SubClassOf                      : organizationalPerson<\/p>\n

Type                            : Structural<\/p>\n

SchemaGuid                      : bf967aba-0de6-11d0-a285-00aa003049e2<\/p>\n

DefaultObjectSecurityDescriptor : System.DirectoryServices.ActiveDirectorySecurity<\/p>\n

Now let me look at the required properties of a User<\/strong> class:<\/p>\n

$schema.FindClass(“user”).mandatoryproperties<\/p>\n

The command returns a lot of information, but it seems to be rather cluttered. Here is the output:<\/p>\n

\"Image<\/a><\/p>\n

I decide to pipe the output to the Out-GridView<\/strong> cmdlet. This provides me with a nice graphical tool and enables me to view the information more easily. Here is the command (ogv<\/strong> is an alias for the Out-GridView <\/strong>cmdlet):<\/p>\n

$schema.FindClass(“user”).mandatoryproperties | ogv<\/p>\n

The output from the previous command is represented in the following image:<\/p>\n

\"Image<\/a><\/p>\n

Now I want to look at the User<\/strong> class optional attributes. To do this, I use the following command:<\/p>\n

$schema.FindClass(“user”).optionalproperties | Out-GridView<\/span><\/p>\n

There are hundreds of optional attributes for the user class object. They all appear in the following Grid View. As you can see, there is also a great deal of useful information available here.<\/span><\/p>\n

\"Image<\/a><\/p>\n

The cool thing about using the Out-GridView<\/strong> tool is that I can easily filter the display to permit further discovery. The image that follows shows IsSingleValued <\/strong>equal to False (indicating multivalued attributes), IsInGlobalCatalog<\/strong> equal to True, IsIndexed <\/strong>equal to True, and it is sorted by Syntax<\/strong>.<\/p>\n

\"Image<\/a><\/p>\n

In addition to using Out-GridView<\/strong>, I can use normal Windows PowerShell commands. For example, I can use the following command to find all the different types of unique syntax:<\/p>\n

$schema.FindClass(“user”).optionalproperties | select syntax -Unique<\/p>\n

The command and associated output are shown here:<\/p>\n

\"Image<\/a><\/p>\n

AB, that is all there is to using Windows PowerShell to explore the Active Directory Schema. Join me tomorrow when I will talk about more cool Windows PowerShell stuff.<\/p>\n

I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/strong> <\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Microsoft Scripting Guy, Ed Wilson, talks about using Windows PowerShell to explore Active Directory data types.  Hey, Scripting Guy! I need a way to see the data types of various Active Directory attributes. I know I can look up this information on MSDN, but I want to explore these on my own. Have you […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,314,3,45],"class_list":["post-3174","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-schema","tag-scripting-guy","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Summary: Microsoft Scripting Guy, Ed Wilson, talks about using Windows PowerShell to explore Active Directory data types.  Hey, Scripting Guy! I need a way to see the data types of various Active Directory attributes. I know I can look up this information on MSDN, but I want to explore these on my own. Have you […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/3174","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=3174"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/3174\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=3174"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=3174"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=3174"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}