{"id":5127,"date":"2012-08-14T00:01:00","date_gmt":"2012-08-14T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2012\/08\/14\/the-ins-and-outs-of-using-dsquery-with-windows-powershell\/"},"modified":"2012-08-14T00:01:00","modified_gmt":"2012-08-14T00:01:00","slug":"the-ins-and-outs-of-using-dsquery-with-windows-powershell","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/the-ins-and-outs-of-using-dsquery-with-windows-powershell\/","title":{"rendered":"The Ins and Outs of Using DSQuery with Windows PowerShell"},"content":{"rendered":"

Summary<\/b>: Microsoft Scripting Guy, Ed Wilson, talks about using DSQuery to return results for use in Windows PowerShell.<\/p>\n

\"Hey, Hey, Scripting Guy!  I like using the DSQuery tool to search Active Directory Domain Services (AD DS). Can I use that tool with Windows PowerShell?<\/p>\n

<\/span>—WS<\/p>\n

\"Hey, Hello WS,<\/p>\n

Microsoft Scripting Guy, Ed Wilson, is here. Yes, it is possible, but I think that there are problems with using the DSQuery tool from within Windows PowerShell. The problems come from the nature of the DSQuery tool itself, and not from within Windows PowerShell. If you are good at using DSQuery<\/b> and DSGet<\/b>, you might not have any problems, but personally, I think there are easier methods. I wrote a Hey, Scripting Guy! Blog called Query Active Directory Without Writing a Script<\/a>; and in that blog, I discuss different methods of querying AD DS. You can refer to that blog for additional information about the tools.<\/p>\n

The bad thing about DSQuery<\/h2>\n

The bad thing about it is not so much a limitation of DSQuery<\/b>, as it is a limitation of all such command-line utilities. It returns strings; therefore, if the output is not exactly to my liking, I have to do string manipulation—and personally, I hate string manipulation. I have always hated string manipulation—from the VBScript days, and even back into the days of CPM. String manipulation simply is not “my thing.”<\/p>\n

Another bad thing about DSQuery<\/b> is that it is not installed by default, and the only way to get it on my laptop running Windows 8 is to download and to install the Remote Server Administration Tools (RSAT), which is yet to be released. A bad thing about the RSAT is that it is version specific, and even service pack specific. In Windows 7, I had to uninstall the RSAT, install Service Pack 1, then reinstall the RSAT. Of course, I did not find that out until after the service pack installation failed. So, I am always a little leery of installing extra stuff that I really do not need on my computers.<\/p>\n

Of course, by using Windows PowerShell remoting, I do not need to install the RSAT on my computer only to use DSQuery<\/b>. I can easily use the Invoke-Command<\/b> cmdlet to perform the remote query on a server (by default all domain controllers will have DSQuery<\/b> installed with their admin tools). I first store the credentials that I need in a variable I call $cred<\/b>. I use the Get-Credential<\/b> cmdlet to obtain the credential<\/b> object. Next, I use the Invoke-Command<\/b> cmdlet to specify the remote server from which to process the query, and I pass the credentials. I store the returned array of strings in the $computers<\/b> variable, and I then display the strings. The commands are shown here.<\/p>\n

$cred = get-credential iammred\\administrator<\/p>\n

$computers = invoke-command -cn dc3 {dsquery computer} -cred $cred<\/p>\n

$computers<\/p>\n

The commands and the associated output are shown in the image that follows.<\/p>\n

\"Image<\/a><\/p>\n

The strings are included in the output. To obtain only the computer name itself requires further processing. One way to get the computer name would be to use a regular expression and pick out the stuff following the first CN=<\/b> that occurs before a comma. That would work, but I like regular expressions even less than I like string manipulation.<\/p>\n

Therefore, I can turn the returned strings into ADSPath<\/b> and supply that to the [adsi]<\/b> type accelerator. To do that is not to horribly complicated. First, I need to get the output into a fashion I can pass to the [adsi]<\/b> type accelerator. This is a two-step operation. First I replace the first CN=<\/b> <\/i>with LDAP:\/\/CN=<\/b> and store the results back into a variable. This command is shown here.<\/p>\n

$ads = $computers -replace ‘^”CN=’, ‘”LDAP:\/\/CN=’<\/p>\n

For some reason, it does not seem to like the quotation marks when I pass it to [adsi]<\/b>, so I need to remove them. Here is the command that I use for that.<\/p>\n

$ads = $ads | % {$_ -replace ‘”‘, “”}<\/p>\n

Now, I can use ADSPath <\/b>to create a DirectoryEntry<\/b> object and retrieve the CN<\/b> property (the basic computer name). This command is shown here.<\/p>\n

$ads | Foreach-Object  {([adsi]$_).cn}<\/p>\n

The nice thing about objects<\/h2>\n

The nice thing about objects is that they make it easy to access different parts of information. For example, when I use the [adsisearcher]<\/b> type accelerator to find computers from inside AD DS, it returns a SearchResult<\/b> object. This object contains a number of methods, but it also contains two properties. The first property is the Path<\/b> <\/i>property, which is a string. The second property, the Properties<\/b> <\/i>property contains an additional object. The output from the Get-Member<\/b> cmdlet displays this information.<\/p>\n

[dc3]: PS C:\\> ([adsisearcher]”objectcategory=computer”).findall() | get-member<\/p>\n

 <\/p>\n

   TypeName: System.DirectoryServices.SearchResult<\/p>\n

 <\/p>\n

Name              MemberType Definition<\/p>\n

—-              ———- ———-<\/p>\n

Equals            Method     bool Equals(System.Object obj)<\/p>\n

GetDirectoryEntry Method     adsi GetDirectoryEntry()<\/p>\n

GetHashCode       Method     int GetHashCode()<\/p>\n

GetType           Method     type GetType()<\/p>\n

ToString          Method     string ToString()<\/p>\n

Path              Property   System.String Path {get;}<\/p>\n

Properties        Property   System.DirectoryServices.ResultPropertyCollection Pr…<\/p>\n

The cool thing about the Properties<\/b> <\/i>property is that it contains a collection of default properties and their associated values. The following command stores the Properties<\/b> <\/i>collection into a variable.<\/p>\n

$a = ([adsisearcher]”objectcategory=computer”).findall() | ForEach-Object {$_.properties}<\/p>\n

To obtain only the computer names in Windows PowerShell 2.0, I can use the GetEnumerator<\/b> <\/i>method and then select only the CN<\/b> <\/i>property. In addition, I can create a custom object that contains only the properties I want. First, here is the code to select only the computer names.<\/p>\n

$a.GetEnumerator() | select { $_.cn}<\/p>\n

Note<\/b>   I talked about using the GetEnumerator<\/b> <\/i>method when working with hash tables in a blog called Dealing with PowerShell Hash Table Quirks<\/a>.<\/i><\/p>\n

I can sort the information, and return a custom object. This command is shown here.<\/p>\n

$a.GetEnumerator() | sort {$_.operatingsystem} | select {$_.cn, $_.operatingsystem}<\/p>\n

Because I am working with Windows PowerShell objects, I can do anything I want to do to them. For example, I can sort and group the output as shown here.<\/p>\n

PS C:\\> $a.GetEnumerator() | sort {$_.operatingsystem} |<\/p>\n

group {$_.operatingsystem} -NoElement | sort count<\/p>\n

 <\/p>\n

Count Name<\/p>\n

—– —-<\/p>\n

    1 OnTap<\/p>\n

    1 Windows 7 Enterprise<\/p>\n

    1 Windows 8 Consumer Pre…<\/p>\n

    1 Windows 8 Pro N<\/p>\n

    1 Windows 8 Release Preview<\/p>\n

    1 Windows Server 2012 Da…<\/p>\n

    1 Windows Server 2012 Re…<\/p>\n

    1 Windows Vista™ Enterprise<\/p>\n

    2 Windows 8 Enterprise E…<\/p>\n

    2 Windows 8 Pro<\/p>\n

    2 Windows Server 8 Beta …<\/p>\n

    3 Windows Server® 2008 E…<\/p>\n

    8 Windows 7 Ultimate<\/p>\n

   11 Windows Server 2008 R2…<\/p>\n

WS, that is all there is to using DSQuery<\/b> to search Active Directory Domain Services. Join me tomorrow for more cool Windows PowerShell stuff.<\/p>\n

I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/b> <\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Microsoft Scripting Guy, Ed Wilson, talks about using DSQuery to return results for use in Windows PowerShell.  Hey, Scripting Guy!  I like using the DSQuery tool to search Active Directory Domain Services (AD DS). Can I use that tool with Windows PowerShell? —WS  Hello WS, Microsoft Scripting Guy, Ed Wilson, is here. Yes, it […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,3,8,45],"class_list":["post-5127","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-scripting-guy","tag-searching-active-directory","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Summary: Microsoft Scripting Guy, Ed Wilson, talks about using DSQuery to return results for use in Windows PowerShell.  Hey, Scripting Guy!  I like using the DSQuery tool to search Active Directory Domain Services (AD DS). Can I use that tool with Windows PowerShell? —WS  Hello WS, Microsoft Scripting Guy, Ed Wilson, is here. Yes, it […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/5127","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=5127"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/5127\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=5127"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=5127"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=5127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}