{"id":4003,"date":"2013-03-19T00:01:00","date_gmt":"2013-03-19T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2013\/03\/19\/find-active-directory-user-info-with-the-powershell-provider\/"},"modified":"2013-03-19T00:01:00","modified_gmt":"2013-03-19T00:01:00","slug":"find-active-directory-user-info-with-the-powershell-provider","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/find-active-directory-user-info-with-the-powershell-provider\/","title":{"rendered":"Find Active Directory User Info with the PowerShell Provider"},"content":{"rendered":"

Summary<\/strong>: Microsoft Scripting Guy, Ed Wilson, talks about how to use the Windows PowerShell provider to find user information in Active Directory.<\/p>\n

\"Hey, Hey, Scripting Guy! I often need to find information in Active Directory, but I do not like having to write LDAP queries. To me, it is soooo last century—I mean, Fred Flintstone<\/a> used to write LDAP queries. I love the way that…<\/p>\n

—CH<\/p>\n

\"Hey, Hello CH,<\/p>\n

Microsoft Scripting Guy, Ed Wilson, is here. CH, I know what you mean. I loved my first computer, but I have no desire to go back to using the CPM operating system. Luckily, with the Active Directory module provider, I have direct access to an AD: drive. This makes it easy to use Windows PowerShell to explore. Because of the Active Directory module provider, and the way that Windows PowerShell providers work, I need no special Active Directory Domain Services (AD DS) knowledge. In fact, I can use the same commands that I would use if I was exploring the file system, the registry, the environmental variables, or even the variable drive. Windows PowerShell abstracts the underlying data and permits me to use a file system analogy to work with the data.<\/p>\n

Note<\/strong>   This is the second in a series of blogs about working with the Active Directory module provider. You should definitely read Playing with the AD: Drive for Fun and Profit<\/a> prior to reading today’s blog because I am going to build on everything that went before.<\/p>\n

Filtering by using the Where-Object cmdlet<\/h2>\n

The cool thing about the AD: drive is the ability to use standard Windows PowerShell cmdlets to find and to filter the AD DS data. In the example that follows, I import the Active Directory module, create a Windows PowerShell drive that exposes Charlotte organizational unit (OU) information, and filter out only the users from the OU. The commands is shown here (ipmo<\/strong> is an alias for Import-Module<\/strong>, sl is an alias for Set-Location<\/strong>, dir<\/strong> is an alias for Get-Childitem<\/strong>, and ?<\/strong> is an alias for Where-Object<\/strong>).<\/p>\n

ipmo activedirectory<\/p>\n

New-PSDrive -PSProvider activedirectory -Name charlotte -Root “AD:\\ou=Charlotte,DC=Iammred,DC=net”<\/p>\n

sl charlotte:<\/p>\n

dir<\/p>\n

dir | ? objectclass -eq user<\/p>\n

The commands and the output associated with the commands are shown in the image that follows.<\/p>\n

\"Image<\/a><\/p>\n

Finding a specific user<\/h2>\n

To find a specific user, I again use Where-Object<\/strong>. I have a couple of choices to use when filtering for the contact. I can use the Name<\/strong> <\/em>property or the DistinguishedName<\/strong> <\/em>property. Because the Name<\/strong> <\/em>property is shorter and requires less typing, I use that one as shown here.<\/p>\n

PS charlotte:\\> dir | ? name -match ‘ed wilson’<\/p>\n

 <\/p>\n

Name                 ObjectClass          DistinguishedName<\/p>\n

—-                 ———–          —————–<\/p>\n

ed wilson            user                 CN=ed wilson,OU=Charlotte,DC=iammred,DC…<\/p>\n

If I would like to directly access the user object instead of filtering to find the user object, I need to use the DistinguishedName <\/strong>attribute. But it is not as bad as it might sound. This is because the DistinguishedName<\/strong> property becomes the path to the object.<\/p>\n

I discovered this when I tried to use Get-Item<\/strong> to access the user object. Normally, a property such as Name<\/strong> <\/em>would what I would expect to use to find an object. In fact, that is what I did in my Where-Object<\/strong> command–I filtered on a value for the Name<\/strong> <\/em>attribute. When I use the name of the user in my Get-Item<\/strong> command to retrieve a user, an error message appears. This command and the message are shown here.<\/p>\n

PS charlotte:\\> Get-Item ‘ed wilson’<\/p>\n

Get-Item : Cannot find path ‘charlotte:\\ed wilson’ because it does not exist.<\/p>\n

At line:1 char:1<\/p>\n

+ Get-Item ‘ed wilson’<\/p>\n

+ ~~~~~~~~~~~~~~~~~~~~<\/p>\n

    + CategoryInfo          : ObjectNotFound: (charlotte:\\ed wilson:String) [Get-Item], ItemNotFoundException<\/p>\n

    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetItemCommand<\/p>\n

Note that the error message is ObjectNotFound, <\/em>and the FullyQualifiedErrorId <\/em>is PathNotFound. <\/em>Therefore, Get-Item<\/strong> is attempting to look for a path to an object and is not finding it. In fact, whenever I use Get-Item<\/strong>, I must specify a path to the object. For example, if I want to retrieve a log file, I specify the path. This is shown here.<\/p>\n

PS C:\\> Get-Item C:\\fso\\20110314.log<\/p>\n

If I am already in the C:\\fso folder, a period can be used to take the place of the C:\\fso portion of the path—but still, I must specify a path. This is shown here.<\/p>\n

PS C:\\fso> get-item .\\20110314.log<\/p>\n

If I think of OU=Charlotte, DC=Iammred, and DC=NET as folders (or directories), the file system analogy works. The DistinguishedName<\/strong> attribute is the full path to the object. Therefore, if I am in the OU=Charlotte folder, I only need to specify the last portion of the DistinguishedName<\/strong> attribute. This technique is shown here.<\/p>\n

PS charlotte:\\> Get-Item .\\’cn=ed wilson’<\/p>\n

 <\/p>\n

Name                 ObjectClass          DistinguishedName<\/p>\n

—-                 ———–          —————–<\/p>\n

ed wilson            user                 cn=ed wilson,ou=Charlotte,DC=Iammred,DC…<\/p>\n

Luckily, the Active Directory module provider does not require the .\\<\/strong>—therefore, I can drop it as shown in this example.<\/p>\n

PS charlotte:\\> Get-Item ‘cn=ed wilson’<\/p>\n

 <\/p>\n

Name                 ObjectClass          DistinguishedName<\/p>\n

—-                 ———–          —————–<\/p>\n

ed wilson            user                 cn=ed wilson,ou=Charlotte,DC=Iammred,DC…<\/p>\n

Filtering directly by using Get-Item<\/span><\/h2>\n

Because the Get-Item<\/strong> cmdlet supports the use of the Filter<\/strong> <\/em>parameter, I can easily create a filter to find a specific user. All I need to do is to specify a value for the Name<\/strong> <\/em>attribute and use a wildcard character for the path. This technique is shown here when I am on the Charlotte Windows PowerShell drive.<\/p>\n

PS charlotte:\\> Get-Item -Filter “name=ed wilson” -Path *<\/p>\n

 <\/p>\n

Name                 ObjectClass          DistinguishedName<\/p>\n

—-                 ———–          —————–<\/p>\n

ed wilson            user                 CN=ed wilson,ou=Charlotte,DC=Iammred,DC…<\/p>\n

The cool thing is that I can even filter for properties not normally returned. So for example, I can find users who have a city value of Charlotte (the lowercase <\/em>L is the LDAP<\/strong> attribute). <\/em>This technique is shown here.<\/p>\n

PS charlotte:\\> Get-Item -Filter “l=charlotte” -Path *<\/p>\n

 <\/p>\n

Name                 ObjectClass          DistinguishedName<\/p>\n

—-                 ———–          —————–<\/p>\n

ed wilson            user                 CN=ed wilson,ou=Charlotte,DC=Iammred,DC…<\/p>\n

Teresa Wilson        user                 CN=Teresa Wilson,ou=Charlotte,DC=Iammre…<\/p>\n

Performing a recursive search by using Get-ChildItem<\/span><\/h2>\n

Perhaps I want to search for users that have a city value of Charlotte, but I do not know in which OU they reside. To do this, I can use the Get-ChildItem<\/strong> cmdlet and use the Recurse<\/strong> <\/em>parameter.<\/p>\n

PS AD:\\dc=iammred,dc=net> Get-ChildItem -Filter “l=charlotte” -Path * -Recurse<\/p>\n

 <\/p>\n

Name                 ObjectClass          DistinguishedName<\/p>\n

—-                 ———–          —————–<\/p>\n

ed wilson            user                 CN=ed wilson,OU=Charlotte,dc=iammred,dc…<\/p>\n

Teresa Wilson        user                 CN=Teresa Wilson,OU=Charlotte,dc=iammre…<\/p>\n

MyNewUser            user                 CN=MyNewUser,OU=MyTestOU,dc=iammred,dc=net<\/p>\n

CH, that is all there is to using the Active Directory module provider in Windows PowerShell to find user information. Active Directory Week will continue tomorrow when I will talk about finding and modifying user information.<\/p>\n

I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/strong> <\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Microsoft Scripting Guy, Ed Wilson, talks about how to use the Windows PowerShell provider to find user information in Active Directory.  Hey, Scripting Guy! I often need to find information in Active Directory, but I do not like having to write LDAP queries. To me, it is soooo last century—I mean, Fred Flintstone used […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,415,3,4,8,45],"class_list":["post-4003","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-psproviders","tag-scripting-guy","tag-scripting-techniques","tag-searching-active-directory","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Summary: Microsoft Scripting Guy, Ed Wilson, talks about how to use the Windows PowerShell provider to find user information in Active Directory.  Hey, Scripting Guy! I often need to find information in Active Directory, but I do not like having to write LDAP queries. To me, it is soooo last century—I mean, Fred Flintstone used […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/4003","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=4003"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/4003\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=4003"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=4003"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=4003"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}