Get-ADUser: Find Active Directory user information with PowerShell | Windows OS Hub (2023)

OGet ADUserThe PowerShell cmdlet allows you to get information about an Active Directory user, their attributes, and search across domain users. It is one of the most popular PowerShell cmdlets for getting information from AD. With the Get-ADUser cmdlet, you can get the value of any attribute from an AD user account, list domain users with attributes, export user reports to CSV files, and use various criteria to select and filter domain users.

Cmdlet Get-ADUser uden PowerShell-modul hasta Active Directory

OGet ADUserThe cmdlet is included in a special module to interact with Active Directory -Active Directory-módulo hasta Windows PowerShell. The RSAT-AD-PowerShell module cmdlets allow you to perform various operations on AD objects.

Observation. Previously, to get information about AD user account attributes, you had to use different tools:bringconsole (includedYou save your AD requests), VBS scripts, dsquery, etc. All of these tools can be easily replaced with the Get-ADUser cmdlet.

In this example, we show you how to use the Get-ADUser PowerShell cmdlet to get information about the last time a user's password was changed whenpassword expiresand the properties of other users.

To use the RSAT-AD-PowerShell module, run the elevated PowerShell console and import the module with the command:

Importmodul ActiveDirectory

ORSAT-AD-PowerShell module is installedby default on Windows Server 2012 (and later) after you deploy the Active Directory Domain Services (AD DS) role. To install the module on a domain member Windows Server host, run the command:

Installer windows function-Navegación "RSAT-AD-PowerShell" -IncludeAllSubFeature

To use the Get-ADUser cmdlet on the Windows 10/11 desktop, install the appropriate version ofRSAT. You can activate RSAT throughsettings->Applications->optional resources->add a resource->RSAT: Active Directory Domain Services and Lightweight Directory Services Tools.

You can install the RSAT AD module on Windows 10 and 11 using PowerShell:

Add-WindowsCapability –online –Nombre "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0"

If the RSAT-AD-PowerShell module is not installed on the computer, an error appears when you run the Get-ADUser command:

Get-ADUser: The term 'get-aduser' is not recognized as the name of a cmdlet, function, script file, or executable program. Please check the spelling of the name or, if a path was included, confirm that the path is correct and try again.

Make sure the module is installed and, if necessary, import it into your PowerShell session:

Importmodul ActiveDirectory

A complete list of all arguments to the Get-ADUser cmdlet can be obtained as follows:

ajuda Get-ADUser

How to find AD user and list properties with Get-ADUser?

To use the Get-ADUser cmdlet, you do not need to run it under a domain administrator account ordelegatepermissions Any authorized AD domain user can run PowerShell commands to get the values ​​of most AD object attributes (except sensitive ones, see example in articleLocal Admin Password Solution - LAPS). If you need to run the Get-ADUser command under a different account, use:Credentialsparameter.

To display the list of all user accounts in the domain, run this command:

Get-ADUser-filter *

Important. It is not recommended to run this command in Active Directory domains with a large number of user accounts. This can overwhelm the domain controller that is providing the AD information.

To view the properties of a particular user, use-Identityparameter. The identity can be a username, login (SAMAccountName), DN (Distinguished Name), SID, or GUID.

The following PowerShell commands return the same output for the same AD user account:

Get-ADUser – Identidad b.smith
Get-ADUser –Identity "CN=Brian Smith,OU=Brugere,OU=Berlin,DC=woshub,DC=loc"
Get-ADUser – Identidade "Brian Smith"

By default, the Get-ADUser cmdlet returns only 10 basic user attributes (out of more than 120 user account properties): DistinguishedName, SamAccountName, Name,S.I.D.,UserPrincipalName, ObjectClass, AccountStatus (Enabled: True/False according toAD attribute of UserAccountControl), etc. In this case, the output of the cmdlet does not contain information about the time oflast user password change.

To display detailed information about all available user attributes, run this command:

Get-ADUser -user-identity -properties *

El cmdlet Get-ADUserProperties *switch shows all AD user attributes and their values ​​(including empty). A similar list of user attributes is available in the Active Directory Users and Computers graphical snap-in (dsa.msc) lowattribute editor guide.

Next, we move on to formatting the output of Get-ADUser to display the required user attributes. For example, you want to display the values ​​of the following user properties:

• password expired
• Last Password Setting
• The password never expires
• LastLogonTimestamp

Run the command:

Get-ADUser martes propiedades PasswordExpired, PasswordLastSet, PasswordNeverExpires, lastlogontimestamp

Now in the user data there is information about the status of the account password (Expired: True/False), the date of the last password change and the time of the last login of the user to the domain (last timestampattribute). To display this information in a more convenient table view and remove all unnecessary attributes, useSelect Object – Propertymiformat table:

Get-ADUser -filter * -egenskaber PasswordExpired, PasswordLastSet, PasswordNeverExpires | Nombre de usuario, PasswordExpired, PasswordLastSet, PasswordNeverExpires

Get-ADUser -SearchBase: retrieval of users from specific organizational units

To only display users from a specific domain container (organizational unit), use:research basisparameter:

Get-ADUser -SearchBase 'OU=London,DC=woshub,DC=loc' -filter * -egenskaber PasswordExpired, PasswordLastSet, PasswordNeverExpires | Nombre de usuario, PasswordExpired, PasswordLastSet, PasswordNeverExpires

To select users from multiple organizational units at once, use the following PowerShell script:

$OU = "OU=NY,DC=woshub,DC=com","OU=LA,DC=woshub,DC=com","OU=MA,DC=woshub,DC=com"
$OU | foreach {Get-ADUser -SearchBase $_ -Filter * |select name, enabled}

How to get an AD user's email address using PowerShell?

The user's email address is one of the attributes of the user object in Active Directory. To specify users' email addresses, addEmail addressfield for the Get-ADUser cmdlet properties.

Get-ADUser -filter * -properties EmailAddress -SearchBase 'OU=Paris,OU-Fr,DC=woshub,DC=com'| name of the selected object, email address

The list of activated user accounts with email addresses:

Get-ADUser -Filter {(mail -ne "null") -and (Enabled -eq "true")} -Properties LastName,FirstName,mail | Select the first name, last name, first name, email of the object | format table

To get the list of Active Directory users without an email address:

Get-ADUser -Filter * -Properties email address | where -Property Email Address -eq $null

The following example allows you to export a company's email list from AD to a CSV file. Later you can import this CSVmailing listin desktop email clients such as Outlook or Mozilla Thunderbird:

Get-ADUser -Filter {(mail -ne "null") -and (Enabled -eq "true")} -Properties LastName,FirstName,mail | Select the first name, last name, first name, email of the object | Export-Csv -NoTypeInformation -utf8 encoding -delimiter "," $env:temp\adress_list.csv

Get-ADUser: exporte usuarios de Active Directory a CSV con PowerShell

The resulting list of domain users with attributes can be exported to a text file:

Get-ADUser -filter * -egenskaber PasswordExpired, PasswordLastSet, PasswordNeverExpires | ft Name, PasswordExpired, PasswordLastSet, PasswordNeverExpires > C:\temp\users.txt

Or you can export AD user list to CSV file:

Get-ADUser -filter * -egenskaber PasswordExpired, PasswordLastSet, PasswordNeverExpires | onde {$_.nombre –como "*Dmitry*"} | objeto de clasificación PasswordLastSet | nombre del objeto select, PasswordExpired, PasswordLastSet, PasswordNeverExpires | Export-csv -path c:\tmp\user-passwords-expires.csv -Append -Codificación UTF8

Examples of Get-ADUser filter

User-Filterchange, you can filter the list of user accounts by one or more attributes. this is usefulto fetch AD userswhose attributes match the specified criteria. Values ​​for specific attributes of Active Directory users can be supplied as arguments to this parameter. when you use-Filterparameter, the Get-ADUser cmdlet will only display users that match the filter criteria.

For example, I want to specify active (enabled) user accounts whose name contains "Dmitri”. The following example uses multiple filters; You can combine conditions using PowerShell's logical comparison operators. In this example, the user attributes must satisfy both filter conditions (-mi):

Get-AdUser -Filter "(Name -like '*Dmitry*') -e (Enabled -eq 'True')" -Properties * |select name,habilitado

All PowerShell logical operators can be used to select values ​​for user attributes (-eq,- Es,-gt,-ge,-lt,- o,-as,- Interesting,-mi,-o, etc.)

Also, you can sort the resulting list of users by a specific user attribute withorder the objectcmdlet. you can also usewhere objectcmdlet to specify multiple filter criteria at once.

Get-ADUser -filter * -properties PasswordExpired, PasswordLastSet, PasswordNeverExpires -SearchBase 'OU=NY,DC=woshub,DC=com'| malvado {$_.name –like "*Dmitry*" -e $_.Enabled -eq $true} | objeto de clasificación PasswordLastSet | el nombre debe seleccionar, PasswordExpired, PasswordLastSet, PasswordNeverExpires

So you can get a list of users with all the necessary attributes from Active Directory.

To search for users by multiple attributes at once (inheritedExchangeDN, proxyAddresses, SAMAAccountName, LastName, DisplayName, SamAccountName, PhysicalDeliveryOfficeName, RDN, and msExchMailNickname), you can use ambiguous name resolution (ANR) resource:

Get-ADUser -Filter {anr -eq 'John'} | select name

Advice. When searching for Active Directory users using Get-ADUser, from a performance perspective, specify the criteria usingFilterThe attribute is preferable to using the pipeline forwhere objectcmdlet. In this case, filtering of the selection results will be done on the domain controller and a smaller set of data will be transferred to your computer over the network.

You can use an LDAP filter in Get-ADUser queries. An LDAP filter is specified using–LdapFiltroattribute.

Get-ADUser -LDAPFilter '(&(department=it)(title=sysops))'

Get-ADUser Examples for PowerShell

Let's show some more useful PowerShell command examples for querying Active Directory users with different filters. You can combine them to get the necessary list of AD user objects:

Show AD users whose name starts withJosé:

Get-ADUser -filter {name -like "Joe*"}

You can use PowerShell to calculate the total number of user accounts in Active Directory:

Get-ADUser -Filter {SamAccountName -like "*"} | Medida-objeto

Find disabled Active Directory user accounts:

Get-ADUser -Filter {Enabled -eq "False"} | Select object SamAccountName,FirstName,LastName,FirstName | format table

You can check the active directorycreating a user accountdate with the command:

get-aduser -Filter * -Name of the properties when they are created | Choose the name when it is created

You can get the list of recently added Active Directoryusers created in the last 24 hours:


$last day = ((Get-Date).AddDays(-1))
Get-ADUser -filter {(when created -ge $lastday)}

List accounts with an expired password (you can configure password expiration settings indomain password policy):

Get-ADUser -filter {Enabled -eq $True} -properties name,passwordDeprecated| where {$_.PasswordExpired}|selection name,password expired

Task: For the list of user accounts stored in a text file (one account per line), get the user's company name from AD and save it to a CSV file (you canimport this csv file to excel).

Import-Csv c:\ps\users_list.csv | for each {
Get-ADUser -Identity $_.user -Properties Nombre, Empresa |
Select Name, Company |
Export CSVc:\ps\users_ad_list.csv -Add -UTF8 encoding
}

Users who have not changed their domain passwords in the last 90 days:

$90_Days = (Get-Date).adddays(-90)
Get-ADUser -filter {(passwordlastset -le $90_days)}

Meetinactive user accounts(not connected to the domain for more than 180 days). The LastLogonTimestamp attribute is used toget user login historyfor the domain:

$LastLogonDate= (Get-Date).AddDays(-180)
Get-ADUser -Properties LastLogonTimeStamp -Filter {LastLogonTimeStamp -lt $LastLogonDate } | ?{$_.Activeret –eq $Verdadero} | Orden LastLogonTimeStamp| Nombre de FT, @{N='lastlogontimestamp'; E={[DateTime]::FromFileTime($_.lastlogontimestamp)}} -AutoSize

to get oneactive directory user imageand save it to a jpg file, run the following commands:

$usr = Get-ADUser view -Properties thumbnailPhoto
$usr.thumbnailPhoto | Set-Content sjoe.jpg -Byte encoding

How to get a list of AD groups that the user account is a member of:

Get-AdUser sjoe -Member Properties | select member of -expand property member of

Specify the OU users who are members of a specific domain security group:

Get-ADUser -SearchBase 'OU=Rome,OU=Italy,DC=woshub,DC=com' -Filter * -Properties member of | Where-Object {($_.memberof -like "*CEO*")}

Specify the OU users who are members of a specific domain security group:

Get-ADUser -SearchBase 'OU=Rome,OU=Italy,DC=woshub,DC=com' -Filter * -Properties member of | Where-Object {($_.memberof -like "*CEO*")}

List of all OU users except members of a specific group:

$Users = Get-ADUser -filter * -SearchBase 'OU=Berlin,DC=woshub,DC=com' -memberOf properties
ForEach($user i $users)
{
$Grupos = -join @($User.memberOf)
If ($Groups -notlike '*Domain Admins*')
{
$User.Name
}
}

Export a list of AD users with OU name toOut-GridViewlow hill:

get-aduser -filter * -Propriedades cn,canonicalname | seleccionar nombre, usuario principal,@{Name="OU";expression={$_.Canonicalname.substring(0,$_.canonicalname.length-$_.cn.length)}}| Out-GridView

Check if the AD user account exists:
$SamAccountName='jbrown'
if (@(Get-ADUser -Filter { SamAccountName -eq $SamAccountName }).Count -eq 0)
{Write-host "User $SamAccountName does not exist"}

List the computers in the domain that the user can log in to (Login Restriction viaLogon workstationsAttributed to AD).

Get-ADUser jbrown -Properties LogonWorkstations | Logon Workstation Name List Format

Advice. OGet AD ComputerThe cmdlet is used to retrieve computer properties or search multiple computers in Active Directory.