I'm an IT intern tasked with performing an audit of users on our domain and I'm having some trouble finding the info I need without all of the extra stuff. Is there a way to pull all of this info in one command? If not, can you recommend commands to pull users, usernames, and login info separately in a manner that I can copy-paste in the format I need?
I previously used get-adgroup -filter * and wrote to a file. Are there some options I can add for this filter? I also used a script to get all users, and all groups and their user permissions on separate occasions.
You could try something like:
Get-ADGroup -Filter "Name -like '*Accounting*'" |
Get-ADGroupMember |
Select-Object name, SamAccountName
Or if you need more fields from the user object, then try something like:
Get-ADGroup -Filter "Name -like '*Accounting*'" |
Get-ADGroupMember |
Get-ADUser -Properties Enabled |
Select-Object Name, SamAccountName, UserPrincipalName, Enabled
You'll probably want to export to a spreadsheet, so use Export-Csv for that.
Related
I need to do an AD export with the info below:
- all enable users NOT present in a specific group
- email address
- account name
and export everything into a csv file
Can u help me please?
Thanks!!!!
You could do something like the following:
$group = 'my group name'
$GroupMembers = Get-ADGroupMember $group -Recursive
Get-ADUser -Filter "Enabled -eq '$true'" -Properties Mail |
Where-Object { $_.SamAccountName -notin $GroupMembers.SamAccountName } |
Select-Object SamAccountName,Mail |
Export-Csv Output.csv -NoType
Get-ADGroupMember with the -Recursive switch will recursively retrieve AD objects that are a member of $group.
Get-ADUser utilizes a filter to only query enabled users. Notice that you must add the Mail property because email address attributes are not in the default display. You can tweak this filter to make the query faster. If you are willing to add a little complexity and do performance testing, it may be faster to build separate Get-ADUser -Filter ... queries than relying on Where-Object. Performance will depend on your AD size and how many members are in the target group.
We have users with minor but annoying differences in naming standards that are loosely followed making scripting a pain. The company has been around a while and depending on who was working in IT when the employee was hired the account could follow any naming convention if followed at all.
In one forest we have accounts that start with a-, the manager attribute of that account is the DN of the account owners other/main account without many other common attributes populated. I then need to look up the managers account and grab their SamAccountName. Then I need to add s- to the SamAccountName and do search for that to see if it exists.
Then I need to write the original SamAccountName, the second SamAccountName and the s-SamAccountName and something like a check box if its a valid account name all to a CSV.
without rewriting the script and passing everything to/from a var and then processing that I dont see a way to do it. This script looks up roughly 800 users and processes that three time, so it already takes a while to run without slowing it down with a bunch of var transfers.
$test = get-aduser -ldapFilter "(SamAccountName=a-*)" -Server XXX.int:3268 -Properties manager |
Select -ExpandProperty manager | Get-ADUser -Server XXX.int:3268 |
Select -ExpandProperty samaccountname
$test
You can do something like this to get you started.
$test = get-aduser -ldapFilter "(SamAccountName=a-*)" -Server XXX.int:3268 -Properties manager |
Select-Object SamAccountName,
#{n='Manager';e={Get-ADUser $_.Manager -Server XXX.int:3268 | Select -Expand SamAccountName}},
#{n='s-Manager';e={Get-ADUser "s-$($_.Manager)" -Server XXX.int:3268 | Select -Expand SamAccountName}}
$test
I am not clear if you need to add s- to the manager's or the original account's SamAccountName. The script above adds s- to the manager's SamAccountName.
In scripts where multiple AD lookups are required, sometimes it is best to do one larger lookup and then filter that result for what you need.
Explanation:
The main technique of the script makes use of delayed-script binding with the Select-Object command. Each user object found by the original Get-ADUser command is piped into Select-Object and is accessible by the pipeline variable $_. The hash table select can be updated fairly easily to meet your needs.
I have a PowerShell script that compares the contents of a CSV file with Active Directory. The CSV file contains a list of demographic information of people already in AD. One of the columns is "emplid". The values in this field correspond to the values of the "employeeID" attribute of user objects in AD. So, I currently use this "emplid" property to cross reference AD and find the corresponding user accounts. To do this I use a line similar to this:
$UserAccounts = $ListOfEmloyeeIDs | ForEach-Object {Get-ADUser -Properties * -Filter {employeeID -Eq $_}}
I then use this to add those user accounts to a security group:
$UserAccounts.SamAccountName | ForEach-Object {Add-ADGroupMember -Identity SpecialSecurityGroup -Members $_}
The problem is with the first line. There are thousands of user accounts and the script can take hours to run. This has also led to complaints from the AD admins. What I would like to do is load all active AD users into a variable (which takes less than 2 minutes to run) using:
$ADPeopleActive = Get-ADUser -SearchBase "OU=People,DC=MyAD,DC=com" -Properties EmployeeID -Filter {Enabled -Eq $True}
Then I would like to do my cross reference against this array and build a list of SamAccountNames to feed to something like my second line to populate my security group.
My problem is I can't figure out a way to do this cross reference against an array that I've built the same way I can cross reference with AD using Get-ADuser. Can anyone help?
Something like
$UserAccounts = $ADPeopleActive| Where-Object { $ListOfEmloyeeIDs -contains $_.EmployeeID }
?
I need to retrieve a list of Distribution groups with their x400 and x500 addresses. I have determined the attributes are proxyaddresses and TextEncodedORAddress. We are running Exchange 2013. When I look at a high level searchbase like "OU=Exchange,OU=company,DC=company,DC=com" and use Get-ADUser it returns the user accounts, however I need Distribution Groups.
Using the following returns the users with the attributes I need, but I need distribution groups, not users.
Get-ADUser -SearchBase "OU=Exchange,OU=company,DC=company,DC=com" `
-Filter * -Properties * | Select * |
FT CN,distinguishedName,proxyaddresses,textEncodedORAddress
I tried Get-Mailbox, Get-DistributionGroup, but I get an error saying it's not a cmdlet. I also tried using the attribute groupType to filter, but it didn't work. I'm not sure if I'm able to use Get-ADObject as I'm not quite sure how I'd use that cmdlet. Any help would be appreciated.
Because there are multiple values in that proxyaddresses, I was receiving Microsoft.ActiveDirectory.Management.ADPropertyValueCollection, therefore I had to use the following.
Get-ADGroup -SearchBase "OU=Exchange,OU=Company,DC=company,DC=com" `
-Filter * -Properties proxyAddresses | Select CN,distinguishedName,textEncodedORAddress,`
#{L=’ProxyAddress_1′; E={$_.proxyaddresses[0]}},
#{L=’ProxyAddress_2′; E={$_.ProxyAddresses[1]}},
#{L=’ProxyAddress_3′; E={$_.proxyaddresses[2]}},
#{L=’ProxyAddress_4′; E={$_.proxyaddresses[3]}},
#{L=’ProxyAddress_5′; E={$_.proxyaddresses[4]}}|
Export-CSV C:\temp\x500_Export.csv
The only thing I can't figure out for the output, is why I see the various proxyaddresses and the distinguishedname, however it won't show CN, or displayname. Those are blank.
get-adgroup -filter "GroupCategory -eq 'Distribution'"
As a process to disable users, I have a CSV where users are identified by employeeID and not username. I need to loop through and compare the CSV to AD users, and any AD user not in the CSV needs to be disabled. This is what I have so far, but it's not working. I'll admit I'm still fairly new to powershell scripting, so any help would be much appreciated.
Import-Module ActiveDirectory
Import-Csv -Path c:\ADTerm.csv | foreach {Get-ADUser -filter * -SearchBase "ou=Test,ou=Logins,dc=domain,dc=com" -Identity $_.employeeID} | Where {$_ -ne $null} | Disable-ADAccount -Identity $_.employeeID
I cant really fit this all in a comment without it looking horrible so lets start with this.
You are combining -Filter and -Identity which most likely wont net the results you are looking for. Use Identity to get one specific user or filter to get one to many. Looking at TechNet for Get-AdUser you will see Identity only matches values to:
DistinguishedName
objectGUID
objectSid
sAMAccountName
In that regard I see you have a column for EmployeeID. I'm guessing that those are not SamAccountName which is one of the values that -Identity supports. I feel that you could do with the following changes.
$IDs = Import-Csv -Path c:\ADTerm.csv | Select-object -ExpandProperty EmployeeID
Get-ADUser -filter * -SearchBase "ou=Test,ou=Logins,dc=domain,dc=com" -Properties EmployeeID |
Where-Object{$_.EmployeeID -and ($IDs -notcontains $_.EmployeeID)} | Disable-ADAccount
Update the get-aduser to get all users in that OU. Get-Aduser does not return the EmployeeID by default so we use -Properties to specify it. Filter all those users that have employeeID but not one in the list. Disable-ADAccount will take the output of Get-AdUser nicely so there is not need to specify the account again.
Depending you might be storing this value as EmployeeNumber in AD. This is also dependent on your having a csv file with a column for EmployeeNumber