{"id":16351,"date":"2010-12-01T00:01:00","date_gmt":"2010-12-01T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2010\/12\/01\/use-powershell-to-query-active-directory-from-the-console\/"},"modified":"2010-12-01T00:01:00","modified_gmt":"2010-12-01T00:01:00","slug":"use-powershell-to-query-active-directory-from-the-console","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/use-powershell-to-query-active-directory-from-the-console\/","title":{"rendered":"Use PowerShell to Query Active Directory from the Console"},"content":{"rendered":"

 <\/span> <\/span><\/p>\n

Summary:<\/span><\/b> Learn how to query Active Directory by using Windows PowerShell without writing a script.<\/span><\/p>\n

 <\/span><\/p>\n

\"Hey,<\/span><\/span><\/span>Hey, Scripting Guy! Occasionally I have to perform a quick query of Active Directory, but I do not want to write a complicated VBScript or Windows PowerShell script. Is there a way to use Windows PowerShell to query Active Directory that does not involve writing a convoluted script?<\/span><\/p>\n

— JW<\/span><\/p>\n

 <\/span><\/p>\n

\"Hey,<\/span><\/span><\/span>Hello JW, Microsoft Scripting Guy Ed Wilson here. There are in fact, several ways that you can query Active Directory Domain Services from Windows PowerShell that do not involve writing a convoluted script. For example, one tool that can be used is DSQuery. This is seen here where I list all users who have been inactive for 4 weeks. <\/span><\/p>\n

PS C:\\> dsquery user -inactive 4<\/span><\/span><\/p>\n

 <\/span><\/p>\n

Portions of today’s Hey, Scripting Guy! Blog post are adapted from material in my book Windows PowerShell 2.0 Best Practices<\/span><\/i><\/a> that was published by Microsoft Press in December 2009. <\/span><\/p>\n

With Windows PowerShell 1.0 if you wanted to query Active Directory, most network administrators felt they had to write a script. To a degree, this was a relic of the VBScript days, and a reliance of using the ActiveX Data Objects (ADO) technology to invoke a Lightweight Directory Access Protocol (LDAP) Dialect query against Active Directory. Although it was possible to use the System.DirectoryServices.DirectorySearcher<\/b> from a Windows PowerShell line, it was not very convenient. There were third-party cmdlets and providers that did make it possible to employ command line queries against Active Directory however, many network administrators are rightfully skeptical about installing unsupported community software on production servers. With Windows PowerShell 2.0 that situation has changed somewhat. By using the techniques seen here, an IT Pro now has a supportable command line solution to the problem of performing Active Directory queries. <\/span><\/p>\n

There are a couple of options available to you for querying Active Directory from the Windows PowerShell prompt. One is to use the [ADSISearcher]<\/b> type accelerator. The [ADSISearcher]<\/b> type accelerator is a shortcut to the System.DirectoryServices.DirectorySearcher<\/b> class. All the [ADSISearcher]<\/b> type accelerator does is save you a bit of typing. You still have to give it the appropriate constructor to create an instance of the class. If you did not use the [ADSISearcher]<\/b> you would need to use the New-Object<\/b> cmdlet to create the object. You can put the New-Object<\/b> command inside smooth parentheses to force the creation of the object first, and then call the FindAll <\/b>method from the DirectorySearcher<\/b> object. The resulting collection of DirectoryEntry<\/span><\/a><\/b> objects is pipelined to the Select-Object<\/b> cmdlet where the Path <\/b>property is returned.  <\/span>This is seen here.<\/span><\/p>\n

PS C:\\> (New-Object DirectoryServices.DirectorySearcher “ObjectClass=user”).Find
All() | Select path<\/p>\n

Path
—-
LDAP:\/\/CN=Administrator,CN=Users,DC=nwtraders,DC=com
LDAP:\/\/CN=Guest,CN=Users,DC=nwtraders,DC=com
LDAP:\/\/CN=BERLIN,OU=Domain Controllers,DC=nwtraders,DC=com
LDAP:\/\/CN=krbtgt,CN=Users,DC=nwtraders,DC=com
LDAP:\/\/CN=VISTA,CN=Computers,DC=nwtraders,DC=com
LDAP:\/\/CN=VistaAdmin,OU=Students,DC=nwtraders,DC=com
List Truncated –<\/span><\/span><\/p>\n

 <\/span><\/p>\n

To use the [ADSISearcher]<\/b> type accelerator, you still need to supply it with an appropriate constructor that in many cases will be the search filter expressed in LDAP Search Filter Syntax. LDAP Search Filter Syntax is defined in RFC 2254 and is represented by Unicode strings. The search filters enable you to specify search criteria in an efficient and effective manner. Some examples of using the LDAP Search Filter Syntax are seen in Table 1.<\/span><\/p>\n

 <\/span><\/p>\n

Table 1 LDAP Search Filter Examples<\/strong><\/span><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

Search Filter<\/strong><\/span><\/p>\n<\/td>\n

\n

Description<\/strong><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

ObjectClass=Computer<\/span><\/p>\n<\/td>\n

\n

All computer objects<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

ObjectClass=OrganizationalUnit<\/span><\/p>\n<\/td>\n

\n

All organizational unit objects<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

ObjectClass=User<\/span><\/p>\n<\/td>\n

\n

All user objects as well as all computer objects<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

ObjectCategory=User<\/span><\/p>\n<\/td>\n

\n

All User objects<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

(&(ObjectCategory=User)(ObjectClass=Person))<\/span><\/p>\n<\/td>\n

\n

All User objects<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

L=Berlin<\/span><\/p>\n<\/td>\n

\n

All objects with the location of Berlin<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

Name=*Berlin*<\/span><\/p>\n<\/td>\n

\n

All objects with a name that contains Berlin<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

(&(L=berlin)(ObjectCategory=OrganizationalUnit))<\/span><\/p>\n<\/td>\n

\n

All Organizational Units with the location of Berlin<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

(&(ObjectCategory=OrganizationalUnit)(Name=*Berlin*))<\/span><\/p>\n<\/td>\n

\n

All Organizational Units with a name that contains Berlin<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

(&(ObjectCategory=OrganizationalUnit)(Name=*Berlin*)(!L=Berlin))<\/span><\/p>\n<\/td>\n

\n

All Organizational Units with a name that contains Berlin, but do not have a location of Berlin<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

(&(ObjectCategory=OrganizationalUnit)(Name=*Berlin*)(!L=*))<\/span><\/p>\n<\/td>\n

\n

All organizational units with a name that contains Berlin, but do not have any location specified<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

(&(ObjectCategory=OrganizationalUnit)(|(L=Berlin)(L=Charlotte)))<\/span><\/p>\n<\/td>\n

\n

All Organizational Units with a location of either Berlin or Charlotte<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/span><\/p>\n

As seen in the examples in Table 1 there are two ways in which the search filter can be specified. The first method is a straight forward assignment filter. The attribute, the operator, and the value make up the filter. This is seen here. <\/span><\/p>\n

PS C:\\> ([ADSISearcher]”Name=Charlotte”).FindAll() | Select Path<\/p>\n

Path
—-
LDAP:\/\/OU=Charlotte,DC=nwtraders,DC=com<\/span><\/span><\/p>\n

 <\/span><\/p>\n

The second way to use the LDAP Search Filter is to combine multiple filters. The operator goes first. You will have the operator, then filter A<\/i> followed by filter B<\/i>. You can combine multiple filters and operators as seen in the syntax examples in Table 1. An example of a compound filter is seen here. (This is a single line command that I have broken to two lines to allow it to be displayed correctly on the blog. The backtick (or grave) character “`” is used for line continuation. You will not need the backtick character if you type the command on a single line. I have added it, in case you cut and paste it from the blog.)<\/span><\/p>\n

PS C:\\> ([ADSISearcher]”(|(Name=Charlotte)(Name=Atlanta))”).FindAll() | `<\/span><\/span><\/p>\n

Select Path<\/p>\n

Path
—-
LDAP:\/\/OU=Atlanta,DC=nwtraders,DC=com
LDAP:\/\/OU=Charlotte,DC=nwtraders,DC=com<\/span><\/span><\/p>\n

 <\/span><\/p>\n

The operators that you can use for either straight forward assignment filters, or compound search filters are listed in Table 2.<\/span><\/p>\n

 <\/span><\/p>\n

Table 2 LDAP Search Filter Logic Operators<\/strong><\/span><\/p>\n\n\n\n\n\n\n\n\n\n\n
\n

Logical operator <\/strong><\/span><\/p>\n<\/td>\n

\n

Description<\/strong> <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

= <\/span><\/p>\n<\/td>\n

\n

Equal to <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

~= <\/span><\/p>\n<\/td>\n

\n

Approximately equal to <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

<= <\/span><\/p>\n<\/td>\n

\n

Lexicographically less than or equal to <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

>= <\/span><\/p>\n<\/td>\n

\n

Lexicographically greater than or equal to <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

& <\/span><\/p>\n<\/td>\n

\n

AND <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

| <\/span><\/p>\n<\/td>\n

\n

OR <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

! <\/span><\/p>\n<\/td>\n

\n

NOT<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/span><\/p>\n

Table 3 lists special characters. If any of these special characters must appear in a search filter as a literal character, it must be replaced by the escape sequence. <\/span><\/p>\n

 <\/span><\/p>\n

Table 3 LDAP Search Filter Special Characters<\/strong><\/span><\/p>\n\n\n\n\n\n\n\n\n\n
\n

ASCII character <\/strong><\/span><\/p>\n<\/td>\n

\n

Escape sequence substitute<\/strong> <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

* <\/span><\/p>\n<\/td>\n

\n

\\2a <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

( <\/span><\/p>\n<\/td>\n

\n

\\28 <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

) <\/span><\/p>\n<\/td>\n

\n

\\29 <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

\\ <\/span><\/p>\n<\/td>\n

\n

\\5c <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

NUL<\/span><\/p>\n<\/td>\n

\n

 <\/span>\\00 <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

\/ <\/span><\/p>\n<\/td>\n

\n

\\2f <\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/span><\/p>\n

As seen in the following figure, special characters are allowed in organizational unit names in Active Directory. <\/span><\/p>\n

<\/span> <\/span><\/p>\n

 <\/span><\/p>\n

As seen in the figure, there is an organizational unit with the name *Atlanta. To retrieve this particular organizational unit, you would have to use the \\2a <\/i>character as seen here. <\/span><\/p>\n

PS C:\\> ([ADSISearcher]”name=\\2aAtlanta”).FindAll() | Select Path<\/p>\n

Path
—-
LDAP:\/\/OU=*Atlanta,DC=nwtraders,DC=com<\/span><\/span><\/p>\n

 <\/span><\/p>\n

To retrieve the organizational unit named (Berlin) you have to use the \\28<\/i> and the \\29 <\/i>escape sequences as documented in Table 3. This is seen here.<\/span><\/p>\n

PS C:\\> ([ADSISearcher]”name=\\28Berlin\\29″).FindAll() | Select Path<\/p>\n

Path
—-
LDAP:\/\/OU=(Berlin),DC=nwtraders,DC=com<\/span><\/span><\/p>\n

 <\/span><\/p>\n

There is also an organizational unit named \/Charlotte\\. The escape sequence substitute for the forward slash is \\2f<\/i>. The escape sequence substitute for the backward slash is \\5c<\/i>. To retrieve the organizational unit named \/Charlotte\\ using the LDAP Search Filter and the [ADSISearcher]<\/b> type accelerator, you can use a query that looks like the following.<\/span><\/p>\n

PS C:\\> ([ADSISearcher]”name=\\2fCharlotte\\5c”).FindAll() | Select Path<\/p>\n

Path
—-
LDAP:\/\/OU=\\\/Charlotte\\\\,DC=nwtraders,DC=com<\/span><\/span><\/p>\n

 <\/span><\/p>\n

I generally try to avoid using special characters in organizational unit names, user names, group names, computer names and the like. One reason is that I suspect not all applications know how to handle special characters, and I am always afraid that one might not work. Another reason is that, although you can escape the characters in searches, the process is never intuitive, and it costs time trying to figure out how to escape the special character. When you add in the fact the problem will usually occur at 2:00 AM on Saturday Morning (all network problems seem to occur at 2:00 AM on Saturday Morning) when you are likely to forget about escaping the special character, you have a recipe ripe for disaster. Just because something is permitted, does not mean that it is advisable. <\/span><\/p>\n

The LDAP Search Filter Special Characters and their associated escape sequence substitutes are documented in Table 3 that was seen earlier. <\/span><\/p>\n

By using the Invoke-Command<\/b> cmdlet, the [ADSISearcher]<\/b> can easily be used to query the Active Directory of an un-trusted forest or domain. When doing this, it is frequently important to provide the fully qualified domain name of the computer, because it is possible you may not have complete name resolution using only the NetBios name of the server. It is also best to submit the credentials in a user principal name (UPN) manner as well. When the command is run, the credential dialog box will appear and prompt for the password which must be typed in. The command is seen here (note this is a single line command that I split using the backtick character). <\/span><\/p>\n

PS C:\\> Invoke-Command -ComputerName Sydney.WoodBridgeBank.Com `<\/span><\/p>\n

-Credential administrator@WoodBridgeBank.com `<\/span><\/p>\n

-ScriptBlock {([ADSISearcher]”L=Berlin”).Findall()}<\/span><\/p>\n

 <\/span><\/p>\n

PSComputerName  <\/span>   <\/span>: sydney.woodbridgebank.com<\/span><\/p>\n

RunspaceId         <\/span>: 112f974a-00aa-417c-8a13-9033a49354bd<\/span><\/p>\n

PSShowComputerName : True<\/span><\/p>\n

Path               <\/span>: LDAP:\/\/OU=Berlin Bank,DC=woodbridgebank,DC=com<\/span><\/p>\n

Properties         <\/span>: {ou, dscorepropagationdata, whencreated, name…} <\/span><\/p>\n

 <\/span><\/p>\n

JW, that is all there is to using Windows PowerShell to query Active Directory from the console. To Script or Not to Script week will continue tomorrow when I will talk more about Active Directory. <\/span><\/p>\n

I invite you to follow me on Twitter<\/span><\/a> or Facebook<\/span><\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/span><\/a> or post them on the Official Scripting Guys Forum<\/span><\/a>. See you tomorrow. Until then, peace.<\/span><\/p>\n

 <\/span><\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/span><\/b><\/p>\n","protected":false},"excerpt":{"rendered":"

   Summary: Learn how to query Active Directory by using Windows PowerShell without writing a script.   Hey, Scripting Guy! Occasionally I have to perform a quick query of Active Directory, but I do not want to write a complicated VBScript or Windows PowerShell script. Is there a way to use Windows PowerShell to query […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,51,3,4,8,45],"class_list":["post-16351","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-getting-started","tag-scripting-guy","tag-scripting-techniques","tag-searching-active-directory","tag-windows-powershell"],"acf":[],"blog_post_summary":"

   Summary: Learn how to query Active Directory by using Windows PowerShell without writing a script.   Hey, Scripting Guy! Occasionally I have to perform a quick query of Active Directory, but I do not want to write a complicated VBScript or Windows PowerShell script. Is there a way to use Windows PowerShell to query […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/16351","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=16351"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/16351\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=16351"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=16351"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=16351"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}