Active Directory can hold near 2 billion objects. When the number of objects grows, the requirement for affective object filtering grows as well. Active Directory have several GUI options to search/filter specific objects. We also can filter objects using PowerShell.
In previous posts, we learned about Get-ADUser and Get-ADComputer cmdlets and how it can be used with other commands to filter out objects from Active directory and perform administrative tasks. It is also can use to retrieve specific attribute values from filtered objects.
Get-ADUser -Identity user1 -Properties *
In above command, it will list down all the attributes and its values associated with user1. This helps to find exact attributes names and common values which can use for further filtering.
I need to know values of Name, UserPrincipalName and Modified for all the users. Following command will create a table with attributes and its values.
Get-ADUser -Filter * -Properties Name,UserPrincipalName,Modified | ft Name,UserPrincipalName,Modified
I can see some accounts in the list which is service accounts and administrator account. I only want to see the accounts which is in Kingston office.
Get-ADUser -Filter {City -like "Kingston"} -Properties Name,UserPrincipalName,Modified | ft Name,UserPrincipalName,Modified
With above it filters it further based on the City value.
Now I have the list of data I needed, I like to export it to a CSV file for future use.
Get-ADUser -Filter {City -like "Kingston"} -Properties Name,UserPrincipalName,Modified | select-object Name,UserPrincipalName,Modified | Export-csv -path C:\ADUSerList.csv
So, above example shows how search query can build up from granular level to find the exact information needed from objects.
Search-ADAccount cmdlet can also use to search for the active directory objects based on account and password status. Full syntax for the cmdlet can retrieve using,
Get-Command Search-ADAccount -Syntax
As an example, it can use to filter the accounts which is locked out.
Search-ADAccount -LockedOut | FT Name,UserPrincipalName
Above command will list down all the lockout accounts with name and UPN.
Unlikely the graphical tools, Powershell queries can build to filter the exact objects and data from active directory.
This marks the end of this blog post. Hope this was useful. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.