{"id":51433,"date":"2010-02-01T00:01:00","date_gmt":"2010-02-01T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2010\/02\/01\/hey-scripting-guy-how-can-i-use-windows-powershell-to-search-active-directory\/"},"modified":"2010-02-01T00:01:00","modified_gmt":"2010-02-01T00:01:00","slug":"hey-scripting-guy-how-can-i-use-windows-powershell-to-search-active-directory","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/hey-scripting-guy-how-can-i-use-windows-powershell-to-search-active-directory\/","title":{"rendered":"Hey, Scripting Guy! How Can I Use Windows PowerShell to Search Active Directory?"},"content":{"rendered":"

 \"Bookmark<\/a><\/p>\n

 <\/p>\n

\"Hey,<\/p>\n

Hey, Scripting Guy! I often need to search Active Directory Domain Services (AD DS) to find information about various computers. I may need to identify all of the computers in a particular organizational unit or all the computers who happen to reside in a particular office. Whatever the reason, using Active X Data Objects (ADO) like I did in the old VBScript days is a major pain. When I learned how to use the Directory Searcher Object, it was a little better—in fact quite a bit better, but I am curious if the new Active Directory cmdlets have anything to make it easier to retrieve users?<\/p>\n

— NN<\/p>\n

\n

 <\/p>\n<\/p>\n

\"Hey,Hello NN, <\/p>\n

Microsoft Scripting Guy Ed Wilson here. Today is a special day because I finally received my copies of the Windows PowerShell 2.0 Best Practices book<\/a> that I spent 18 months of my life writing. For me, the big thing about writing books is the enjoyment I receive when people tell me they have read my book and it helped them. On Facebook this morning, I had two notes from people who stated they had enjoyed my books. Speaking of Facebook, send me a friend request<\/font><\/a>. I enjoy the interaction. In addition to the Best Practices book, the morning mail also showed up with a tin of Genmaicha tea<\/font><\/a>. This delicate green tea is best brewed for 3–<\/span>5 minutes, and tastes great with a cinnamon stick in it. The beautiful blue sky, cool temperature, a special pot of green tea, and an excellent Windows PowerShell book make a wonderful way to spend the day. But I also need to check the e-mail sent to scripter@microsoft.com<\/font><\/a>. <\/p>\n

It is a bit damp outside today, but the sky is clear. It reminds me of Lima, Peru, when I was down there teaching a VBScript class a few years ago. My friend Omar took me around, and I was able to take some great pictures such as the following one.<\/p>\n

\"Image<\/a><\/p>\n

\n

 <\/p>\n<\/p>\n

NN, I agree with you completely. Using the Directory Searcher<\/b> .NET Framework classes is easier to use than the old fashioned ADO or even new fangled ADO.NET scripts. In the end I feel it is a best practice to use what you are comfortable with, and to use what will be easiest for you to modify, to troubleshoot, and to maintain. <\/p>\n

An example of using ADO to query AD DS is the QueryAD.Ps1 script I wrote several years ago. <\/p>\n

QueryAD.ps1<\/p>\n

<\/strong><\/p>\n

param(
      <\/span>$ou,
      <\/span>$domain,
      <\/span>$query,
      <\/span>[switch]$help
     <\/span>)<\/p>\n

function funHelp()
{
 <\/span>$helpText=@”
 <\/span>DESCRIPTION:
 <\/span>NAME: QueryAD.ps1
 <\/span>Queries Active Directory  <\/span>on a local or remote machine. <\/p>\n

 <\/span>PARAMETERS:
 <\/span>-ou        <\/span>the organizational unit to query
 <\/span>-domain    <\/span>the domain to query
 <\/span>-query     <\/span>the query to use. Queries for objects such as:
            <\/span>< User, Group, Computer, OrganizationalUnit,
              <\/span>printqueue, grouppolicycontainer, ipsecpolicy,
              <\/span>pkicertificatetemplate, sitelink, subnet, site >
 <\/span>-help      <\/span>prints help file<\/p>\n

 <\/span>SYNTAX:
 <\/span>QueryAD.ps1 <\/p>\n

 <\/span>Generates message of missing parameter and displays help<\/p>\n

 <\/span>QueryAD.ps1 -domain “nwtraders.com” -ou “mytestou” -query computer<\/p>\n

 <\/span>Displays a listing of every computer object in the mytestou organizational
 <\/span>unit of the nwtraders.com domain<\/p>\n

 <\/span>
 <\/span>QueryAD.ps1 -help<\/p>\n

 <\/span>Prints the help topic for the script
“@
  <\/span>$helpText
  <\/span>exit
} #end funHelp<\/p>\n

Function funQueryAD()
{
 <\/span>$domain = $domain -replace(“^”,”dc=”)    <\/span>#replace first character
 <\/span>$domain = $domain -replace(“.”,”,dc=”) #replace the period<\/p>\n

 <\/span>if(!$ou)
  <\/span>{
   <\/span>if(!$query)
    <\/span>{
     <\/span>$strQuery = “<LDAP:\/\/$domain>;;name;subtree”
    <\/span>}
   <\/span>ELSE
    <\/span>{
     <\/span>$strQuery = “<LDAP:\/\/$domain>;(objectcategory=$query);name;subtree”
    <\/span>}
  <\/span>}
 <\/span>ELSE
  <\/span>{
   <\/span>$ou = $ou -replace(“^”,”ou=”)    <\/span>  <\/span>#replace first character
   <\/span>$ou = $ou -replace(“,”,”,ou=”) #replace a comma
   <\/span>if(!$query)
    <\/span>{
     <\/span>$strQuery = “<LDAP:\/\/$ou,$domain>;;name;subtree”
    <\/span>}
   <\/span>ELSE
    <\/span>{
     <\/span>$strQuery = “<LDAP:\/\/$ou,$domain>;(objectcategory=$query);name;subtree”
    <\/span>}
  <\/span>}<\/p>\n

 <\/span>$objConnection = New-Object -comObject “ADODB.Connection”
 <\/span>$objCommand = New-Object -comObject “ADODB.Command”
 <\/span>$objConnection.Open(“Provider=ADsDSOObject;”)
 <\/span>$objCommand.ActiveConnection = $objConnection
 <\/span>$objCommand.CommandText = $strQuery
 <\/span>$objRecordSet = $objCommand.Execute() <\/p>\n

 <\/span>Do
 <\/span>{
     <\/span>$objRecordSet.Fields.item(“name”) |Select-Object name,Value
     <\/span>$objRecordSet.MoveNext()
 <\/span>}
 <\/span>Until ($objRecordSet.eof) <\/p>\n

 <\/span>$objConnection.Close()
} #end funQueryAD<\/p>\n

if($help) { “calling help …” ; funhelp }
if(!$domain) { “missing the domain name” ; funhelp }
if(!$domain -or !$ou -or !$query) { “a parameter is required” ; funhelp }
funqueryAD<\/p>\n

<\/font><\/font><\/p>\n

By using the Directory Searcher<\/b> object, you can reduce significantly the amount of work that is involved in querying Active Directory. The SearchAllComputersInDomain.ps1 script was used for a Hey, Scripting Guy! Blog post in March 2009<\/font><\/a> when we spent a week talking about searching Active Directory. <\/p>\n

SearchAllComputersInDomain.ps1<\/p>\n

<\/strong><\/p>\n

$Filter = “ObjectCategory=computer”
$Searcher = New-Object System.DirectoryServices.DirectorySearcher($Filter)
$Searcher.Findall() |
Foreach-Object `
  <\/span>-Begin { “Results of $Filter query: ” } `
  <\/span>-Process { $_.properties ; “`r”} `
  <\/span>-End { [string]$Searcher.FindAll().Count + ” $Filter results were found”<\/p>\n

<\/font><\/font><\/p>\n

In Windows PowerShell 2.0, you can shorten the script a bit by using the [adsisearcher]<\/b> type accelerator. The [adsisearcher]<\/b> type accelerator saves you the trouble of creating an instance of the DirectoryServices.DirectorySearcher<\/b> .NET Framework class. This is seen here. <\/p>\n

SearchComputersUseAdsiSearcher.ps1<\/p>\n

<\/strong><\/p>\n

$Filter = “ObjectCategory=computer”
$Searcher = [adsiSearcher]($Filter)
$Searcher.Findall() |
Foreach-Object `
  <\/span>-Begin { “Results of $Filter query: ” } `
  <\/span>-Process { $_.properties ; “`r”} `
  <\/span>-End { [string]$Searcher.FindAll().Count + ” $Filter results were found” }<\/p>\n

<\/font><\/font><\/p>\n

If you have at least one Windows Server 2008 R2 domain controller and the Remote Server Administration Tools for Windows 7 (RSAT) tools<\/a> installed, you can use the Get-ADComputer<\/b> cmdlet to retrieve information about a computer account in AD DS. The –identity<\/b> parameter will accept the samAccountName<\/b>, the DistinguishedName<\/b>, the security identifier (SID), or the object GUID:<\/p>\n

PS C:> Get-ADComputer -Identity hyperv<\/p>\n

DistinguishedName : CN=HYPERV,OU=Domain Controllers,DC=NWTraders,DC=Com
DNSHostName       <\/span>: HyperV.NWTraders.Com
Enabled           <\/span>: True
Name              <\/span>: HYPERV
ObjectClass       <\/span>: computer
ObjectGUID        <\/span>: 2a76b1bd-80cb-4546-a8f2-ea46d474e06a
SamAccountName    <\/span>: HYPERV$
SID               <\/span>: S-1-5-21-3746122405-834892460-3960030898-1000
UserPrincipalName :<\/p>\n

PS C:> Get-ADComputer -Identity ‘CN=HYPERV,OU=Domain Controllers,DC=NWTraders,DC=Com’<\/p>\n

DistinguishedName : CN=HYPERV,OU=Domain Controllers,DC=NWTraders,DC=Com
DNSHostName       <\/span>: HyperV.NWTraders.Com
Enabled           <\/span>: True
Name              <\/span>: HYPERV
ObjectClass       <\/span>: computer
ObjectGUID        <\/span>: 2a76b1bd-80cb-4546-a8f2-ea46d474e06a
SamAccountName&nbs\np;   <\/span>: HYPERV$
SID               <\/span>: S-1-5-21-3746122405-834892460-3960030898-1000
UserPrincipalName :<\/p>\n

PS C:> Get-ADComputer -Identity S-1-5-21-3746122405-834892460-3960030898-1000<\/p>\n

DistinguishedName : CN=HYPERV,OU=Domain Controllers,DC=NWTraders,DC=Com
DNSHostName       <\/span>: HyperV.NWTraders.Com
Enabled           <\/span>: True
Name              <\/span>: HYPERV
ObjectClass       <\/span>: computer
ObjectGUID        <\/span>: 2a76b1bd-80cb-4546-a8f2-ea46d474e06a
SamAccountName    <\/span>: HYPERV$
SID               <\/span>: S-1-5-21-3746122405-834892460-3960030898-1000
UserPrincipalName :<\/p>\n

PS C:> Get-ADComputer -Identity 2a76b1bd-80cb-4546-a8f2-ea46d474e06a<\/p>\n

DistinguishedName : CN=HYPERV,OU=Domain Controllers,DC=NWTraders,DC=Com
DNSHostName       <\/span>: HyperV.NWTraders.Com
Enabled           <\/span>: True
Name              <\/span>: HYPERV
ObjectClass       <\/span>: computer
ObjectGUID        <\/span>: 2a76b1bd-80cb-4546-a8f2-ea46d474e06a
SamAccountName    <\/span>: HYPERV$
SID               <\/span>: S-1-5-21-3746122405-834892460-3960030898-1000
UserPrincipalName :<\/p>\n

<\/font><\/font><\/p>\n

Because the identity<\/b> parameter is the default parameter for Get-ADComputer<\/b>, you can leave it out and just supply the name of the computer you wish to query. This is seen here:<\/p>\n

PS C:> Get-ADComputer win7-pc<\/p>\n

DistinguishedName : CN=WIN7-PC,CN=Computers,DC=NWTraders,DC=Com
DNSHostName       <\/span>: WIN7-PC.NWTraders.Com
Enabled           <\/span>: True
Name              <\/span>: WIN7-PC
ObjectClass       <\/span>: computer
ObjectGUID        <\/span>: 3e802bb2-702a-4039-90dd-d7b624c97440
SamAccountName    <\/span>: WIN7-PC$
SID               <\/span>: S-1-5-21-3746122405-834892460-3960030898-1103
UserPrincipalName :<\/p>\n

<\/font><\/font><\/p>\n

One strange thing is the use of the property<\/b> parameter from the Get-ADComputer<\/b> cmdlet. You would expect that piping the computer<\/b> object that is returned by the cmdlet to the Format-List<\/b> cmdlet would provide you the opportunity to work with computer object properties. When working with other objects, you can use the wildcard character “*” and the force<\/b> switch with the Format-List<\/b> cmdlet and retrieve all properties and values of an object. As seen here, when working with the Get-ADComputer<\/b> cmdlet, that is not the case:<\/p>\n

PS C:> Get-ADComputer win7-pc | format-list * -Force<\/p>\n

DistinguishedName : CN=WIN7-PC,CN=Computers,DC=NWTraders,DC=Com
DNSHostName       <\/span>: WIN7-PC.NWTraders.Com
Enabled           <\/span>: True
Name              <\/span>: WIN7-PC
ObjectClass       <\/span>: computer
ObjectGUID        <\/span>: 3e802bb2-702a-4039-90dd-d7b624c97440
SamAccountName    <\/span>: WIN7-PC$
SID               <\/span>: S-1-5-21-3746122405-834892460-3960030898-1103
UserPrincipalName :
PropertyNames     <\/span>: {DistinguishedName, DNSHostName, Enabled, Name…}
PropertyCount     <\/span>: 9<\/p>\n

PS C:><\/p>\n

<\/font><\/font><\/p>\n

To obtain all of the information available from a computer object, you must use the property<\/b> parameter from the Get-ADComputer<\/b> cmdlet, as seen here:<\/p>\n

PS C:> Get-ADComputer -Identity win7-pc -Properties *<\/p>\n

AccountExpirationDate              <\/span>:
accountExpires                     <\/span>: 9223372036854775807
AccountLockoutTime                 <\/span>:
AccountNotDelegated                <\/span>: False
AllowReversiblePasswordEncryption  <\/span>: False
BadLogonCount                      <\/span>: 0
badPasswordTime                    <\/span>: 0
badPwdCount                        <\/span>: 0
CannotChangePassword        &nb\nsp;      <\/span>: False
CanonicalName                      <\/span>: NWTraders.Com\/Computers\/WIN7-PC
Certificates                       <\/span>: {}
CN                          <\/span>       <\/span>: WIN7-PC
codePage                           <\/span>: 0
countryCode                        <\/span>: 0
Created                            <\/span>: 9\/8\/2009 9:48:38 PM
createTimeStamp                    <\/span>: 9\/8\/2009 9:48:38 PM
Deleted                            <\/span>:
Description                        <\/span>:
DisplayName                        <\/span>:
DistinguishedName                  <\/span>: CN=WIN7-PC,CN=Computers,DC=NWTraders,DC=Com
DNSHostName                        <\/span>: WIN7-PC.NWTraders.Com
DoesNotRequirePreAuth              <\/span>: False
dSCorePropagationData              <\/span>: {12\/3\/2009 6:32:30 PM, 12\/3\/2009 6:32:29 PM, 12\/2\/2009 7:18:22 AM, 12\/2\/2009 7:18:
                                     <\/span>22 AM…}
Enabled                            <\/span>: True
HomedirRequired                    <\/span>: False
HomePage     <\/span>                      <\/span>:
instanceType                       <\/span>: 4
IPv4Address                        <\/span>: 192.168.1.110
IPv6Address                        <\/span>:
isCriticalSystemObject             <\/span>: False
isDeleted                          <\/span>:
LastBadPasswordAttempt   <\/span>          <\/span>:
LastKnownParent                    <\/span>:
lastLogoff                         <\/span>: 0
lastLogon                          <\/span>: 129084954052650603
LastLogonDate                      <\/span>: 1\/15\/2010 12:28:29 PM
lastLogonTimestamp                 <\/span>: 129080501096745399
localPolicyFlags                   <\/span>: 0
Location                           <\/span>:
LockedOut                          <\/span>: False
logonCount                         <\/span>: 255
ManagedBy                          <\/span>:
MemberOf                           <\/span>: {}
MNSLogonAccount <\/span><\/font><\/font><\/p>\n","protected":false},"excerpt":{"rendered":"

    Hey, Scripting Guy! I often need to search Active Directory Domain Services (AD DS) to find information about various computers. I may need to identify all of the computers in a particular organizational unit or all the computers who happen to reside in a particular office. Whatever the reason, using Active X Data […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,3,8,45],"class_list":["post-51433","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-scripting-guy","tag-searching-active-directory","tag-windows-powershell"],"acf":[],"blog_post_summary":"

    Hey, Scripting Guy! I often need to search Active Directory Domain Services (AD DS) to find information about various computers. I may need to identify all of the computers in a particular organizational unit or all the computers who happen to reside in a particular office. Whatever the reason, using Active X Data […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/51433","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=51433"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/51433\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=51433"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=51433"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=51433"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}