{"id":54173,"date":"2009-03-17T14:54:00","date_gmt":"2009-03-17T14:54:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2009\/03\/17\/hey-scripting-guy-how-can-i-search-active-directory-from-within-windows-powershell\/"},"modified":"2009-03-17T14:54:00","modified_gmt":"2009-03-17T14:54:00","slug":"hey-scripting-guy-how-can-i-search-active-directory-from-within-windows-powershell","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/hey-scripting-guy-how-can-i-search-active-directory-from-within-windows-powershell\/","title":{"rendered":"Hey, Scripting Guy! How Can I Search Active Directory from Within Windows PowerShell?"},"content":{"rendered":"

\"Hey,<\/span><\/font><\/span><\/p>\n

\n
\n

Hey Scripting Guy! It seems that searching Active Directory from within Windows PowerShell is rather easy. But what I do not get is the syntax for the query. In the past I used something that looked more like SQL that the examples you show. What gives?<\/p>\n

<\/font><\/span><\/p>\n

– RH<\/p>\n<\/blockquote>\n<\/blockquote>\n

\"Spacer\"\"Hey,<\/p>\n

<\/font><\/p>\n

Hi PS,<\/font><\/p>\n

<\/font><\/span><\/p>\n

I was watching the <\/font>Ninja bear<\/font><\/span><\/a> on MSN Video pretty cool actually. I don’t think I would want to fight him (or her … never can tell with bears). We are finally digging out from underneath the big Charlotte, North Carolina, USA snow storm and the sun if shining, there are birds singing … more like a normal southern winter … around 60 degrees or so outside (15.5 degrees Celsius using my handy <\/font>temperature conversion HTA<\/font><\/span><\/a>).  <\/span>So I thought what is there better to do than to watch a Ninja bear and check my <\/font>scripter@Microsoft.Com<\/font><\/span><\/a> email. Let’s take a look at the LDAP dialect that is used to query Active Directory. Also since this is sort of a weather holiday here in Charlotte (I mean we are digging out from under a massive snow blizzard) we will not be writing a script. However, with Windows PowerShell there are lots of things that do not require scripts. <\/p>\n

<\/font><\/span><\/p>\n

This week we are talking about searching Active Directory. The Active Directory Script Center Hub is seen <\/font>here<\/font><\/span><\/a>. It has links to a number of resources related to working with Active Directory. There is a good collection of scripts that illustrate searching Active Directory in <\/font>this section<\/font><\/span><\/a> of the Script Center Script Repository. There are several scripts in the <\/font>Community Submitted Scripts Center<\/font><\/span><\/a> that also illustrate searching Active Directory. The Hey Scripting Guy! <\/font>active directory archive<\/font><\/span><\/a> is also an excellent source of information for searching Active Directory. <\/p>\n

<\/font><\/span><\/p>\n

There are a couple of options available to us when it comes to querying Active Directory from the PowerShell prompt. One is to use the [ADSISearcher] type accelerator that is available in Windows PowerShell 2.0 (currently in beta). The [ADSISearcher] type accelerator is a shortcut to the System.DirectoryServices.DirectorySearcher class. All the [ADSISearcher] type accelerator does is save us a little bit of typing. We still need to give it the appropriate constructor to actually create an instance of the class. <\/p>\n

<\/font><\/span><\/p>\n

If we do not use the [ADSISearcher] we need to use the New-Object cmdlet to create the object. We can put the New-Object command inside smooth parentheses to force the creation of the object first, and then call the FindAll<\/i> method from the DirectorySearcher object. The resulting collection of DirectoryEntry<\/i> objects is pipelined to the Select-Object cmdlet where the Path<\/i> property is returned.  <\/span>This is seen here.<\/p>\n

<\/font><\/span><\/p>\n

PS C:> (New-Object DirectoryServices.DirectorySearcher “ObjectClass=user”).FindAll() | <\/p>\n

<\/font><\/span><\/p>\n

Select-object -property path<\/p>\n

Path
—-
LDAP:\/\/CN=Administrator,CN=Users,DC=nwtraders,DC=com
LDAP:\/\/CN=Guest,CN=Users,DC=nwtraders,DC=com
LDAP:\/\/CN=BERLIN,OU=Domain Controllers,DC=nwtraders,DC=com
LDAP:\/\/CN=krbtgt,CN=Users,DC=nwtraders,DC=com
LDAP:\/\/CN=VISTA,CN=Computers,DC=nwtraders,DC=com
LDAP:\/\/CN=VistaAdmin,OU=Students,DC=nwtraders,DC=com
List Truncated –<\/p>\n

<\/font><\/span><\/p>\n

To use the [ADSISearcher] type accelerator, we still need to supply it with an appropriate constructor, which in many cases will be the search filter expressed in LDAP Search Filter Syntax. LDAP Search Filter Syntax is defined in the Internet Request For Comment RFC 2254 and is represented by Unicode strings. The search filters allow us to specify search criteria in an efficient and effective manner. Some examples of using the LDAP Search Filter Syntax are seen in Table 1.<\/p>\n

<\/font><\/span><\/p>\n

LDAP Search Filter Examples<\/font><\/span><\/b> <\/span><\/b>Table 1<\/p>\n

<\/font><\/span><\/b><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

Search Filter<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n

\n

Description<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

ObjectClass=Computer<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n

\n

All computer objects<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

ObjectClass=OrganizationalUnit<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n

\n

All Organizational Unit objects<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

ObjectClass=User<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n

\n

All user objects as well as all computer objects<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

ObjectCategory=User<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n

\n

All User objects<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

(&(ObjectCategory=User)(ObjectClass=Person))<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n

\n

All User objects<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

L=Berlin<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n

\n

All objects with the location of Berlin<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

Name=*Berlin*<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n

\n

All objects with a name that contains Berlin<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

(&(L=berlin)(ObjectCategory=OrganizationalUnit))<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n

\n

All Organizational Units with the location of Berlin<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

(&(ObjectCategory=OrganizationalUnit)(Name=*Berlin*))<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n

\n

All Organizational Units with a name that contains Berlin<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

(&(ObjectCategory=OrganizationalUnit)(Name=*Berlin*)(!L=Berlin))<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n

\n

All Organizational Units with a name that contains Berlin, but do not have a location of Berlin<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

(&(ObjectCategory=OrganizationalUnit)(Name=*Berlin*)(!L=*))<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n

\n

All Organizational Units with a name that contains Berlin, but do not have any location specified<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

(&(ObjectCategory=OrganizationalUnit)(|(L=Berlin)(L=Charlotte)))<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n

\n

All Organizational Units with a location of either Berlin or Charlotte<\/p>\n

<\/font><\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

<\/p>\n

 <\/font><\/p>\n

<\/span><\/p>\n

As seen in the examples in Table 1 there are two ways in which the search filter can be specified. The first method is a straight forward assignment filter. The attribute, the operator, and the value make up the filter. This is seen here. <\/p>\n

<\/font><\/span><\/p>\n

PS C:> ([ADSISearcher]”Name=Charlotte”).FindAll() | Select Path<\/p>\n

Path
—-
LDAP:\/\/OU=Charlotte,DC=nwtraders,DC=com<\/p>\n

<\/font><\/span><\/p>\n

If we were going to do the same thing without using the [ADSISearcher] the code we would need to use would first need to create the DirectoryServices.DirectorySearcher object and store it in a variable. We will call the variable $adsiSearcher. We then assign our filter to the filter property and call then we call the FindAll method. It would look like the following:<\/p>\n

<\/font><\/span><\/p>\n

PS C:> $adsiSearcher = New-Object DirectoryServices.DirectorySearcher<\/p>\n

<\/font><\/span><\/p>\n

PS C:> $adsiSearcher.Filter = “Name=Charlotte”<\/p>\n

<\/font><\/span><\/p>\n

PS C:> $adsiSearcher.FindAll() | Select path<\/p>\n

<\/font><\/span><\/p>\n

<\/p>\n

 <\/font><\/p>\n

<\/span><\/p>\n

Path<\/p>\n

<\/font><\/span><\/p>\n

—-<\/p>\n

<\/font><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Hey Scripting Guy! It seems that searching Active Directory from within Windows PowerShell is rather easy. But what I do not get is the syntax for the query. In the past I used something that looked more like SQL that the examples you show. What gives? – RH Hi PS, I was watching the Ninja […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,3,8,45],"class_list":["post-54173","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-scripting-guy","tag-searching-active-directory","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Hey Scripting Guy! It seems that searching Active Directory from within Windows PowerShell is rather easy. But what I do not get is the syntax for the query. In the past I used something that looked more like SQL that the examples you show. What gives? – RH Hi PS, I was watching the Ninja […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/54173","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=54173"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/54173\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=54173"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=54173"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=54173"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}