PowerShell - Get-DomainUser
Today one of my IT coworkers, in another department, sent a couple of emails to the Ops to get the username (SamAccount) from a couple of Active Directory users accounts. This guy, which is not familiar with AD, had only the DisplayName properties information.
I wrote him back that he could just request RSAT(Remote Server Administration Tools) to be installed on his workstation or just use this small PowerShell that I just wrote in minutes. Since Active Directory does not require any specific permission to access this kind of information. Here is the code, nothing advanced, but it does the work ;-)
###
function Get-DomainUser {
PARAM($DisplayName)
$Search = [adsisearcher]"(&(objectCategory=person)(objectClass=User)(displayname=$DisplayName))"
foreach ($user in $($Search.FindAll())){
New-Object</b> -TypeName PSObject -Property @{
"DisplayName" = $user.properties.displayname
"UserName" = $user.properties.samaccountname
"Description" = $user.properties.description}
}
}
###
### Result
```
PS C:\> Get-DomainUser -DisplayName "jonathan*" | Format-List
```
```
UserName : {JonathanD}
Description : {Account of Jonathan Delpiero}
DisplayName : {Jonathan Delpiero}
UserName : {DumoulinJ}
Description : {Account of Jonathan Dumoulin}
DisplayName : {Jonathan Dumoulin}
```
### [AdsiSearcher] Accelerator
I'm using the Windows PowerShell [AdsiSearcher] type accelerator to search Active Directory Domain Services (AD DS).
Using ADSI/LDAP Query is kind of confusing and I had to make some research to really understand how it actually works.
Let's take a look at this object and its members.
I start bycreating an instance of the System.DirectoryServices.DirectorySearcher class by supplying empty strings.
```
PS C:\> [adsisearcher]""
```
```
CacheResults : True
ClientTimeout : -00:00:01
PropertyNamesOnly : False
Filter :
PageSize : 0
PropertiesToLoad : {}
ReferralChasing : External
SearchScope : Subtree
ServerPageTimeLimit : -00:00:01
ServerTimeLimit : -00:00:01
SizeLimit : 0
SearchRoot : System.DirectoryServices.DirectoryEntry
Sort : System.DirectoryServices.SortOption
Asynchronous : False
Tombstone : False
AttributeScopeQuery :
DerefAlias : Never
SecurityMasks : None
ExtendedDN : None
DirectorySynchronization :
VirtualListView :
Site :
Container :
```
```
PS C:\> [adsisearcher]"" | get-member
```
```
TypeName: System.DirectoryServices.DirectorySearcher
Name MemberType Definition
---- ---------- ----------
Disposed Event System.EventHandler Disposed(System.Object, System.EventArgs)
CreateObjRef Method System.Runtime.Remoting.ObjRef CreateObjRef(type requestedType)
Dispose Method void Dispose(), void IDisposable.Dispose()
Equals Method bool Equals(System.Object obj)
FindAll Method System.DirectoryServices.SearchResultCollection FindAll()
FindOne Method System.DirectoryServices.SearchResult FindOne()
GetHashCode Method int GetHashCode()
GetLifetimeService Method System.Object GetLifetimeService()
GetType Method type GetType()
InitializeLifetimeService Method System.Object InitializeLifetimeService()
ToString Method string ToString()
Asynchronous Property bool Asynchronous {get;set;}
AttributeScopeQuery Property string AttributeScopeQuery {get;set;}
CacheResults Property bool CacheResults {get;set;}
ClientTimeout Property timespan ClientTimeout {get;set;}
Container Property System.ComponentModel.IContainer Container {get;}
DerefAlias Property System.DirectoryServices.DereferenceAlias DerefAlias {get;set;}
DirectorySynchronization Property System.DirectoryServices.DirectorySynchronization DirectorySynchronization {get;set;}
ExtendedDN Property System.DirectoryServices.ExtendedDN ExtendedDN {get;set;}
Filter Property string Filter {get;set;}
PageSize Property int PageSize {get;set;}
PropertiesToLoad Property System.Collections.Specialized.StringCollection PropertiesToLoad {get;}
PropertyNamesOnly Property bool PropertyNamesOnly {get;set;}
ReferralChasing Property System.DirectoryServices.ReferralChasingOption ReferralChasing {get;set;}
SearchRoot Property adsi SearchRoot {get;set;}
SearchScope Property System.DirectoryServices.SearchScope SearchScope {get;set;}
SecurityMasks Property System.DirectoryServices.SecurityMasks SecurityMasks {get;set;}
ServerPageTimeLimit Property timespan ServerPageTimeLimit {get;set;}
ServerTimeLimit Property timespan ServerTimeLimit {get;set;}
Site Property System.ComponentModel.ISite Site {get;set;}
SizeLimit Property int SizeLimit {get;set;}
Sort Property System.DirectoryServices.SortOption Sort {get;set;}
Tombstone Property bool Tombstone {get;set;}
VirtualListView Property System.DirectoryServices.DirectoryVirtualListView VirtualListView {get;set;}
```
Here we will be interested by theFindOne() and FindAll() methods to perform our searches, the problem is... how to filter the result, we just have thousands of objects with different object types.
After some search I found a list of the different Logical Operators and main Filters available for LDAP Search Filtering.
Logical Operators
Logical operator</td> Description</td> </tr> =</td> Equal to</td> </tr> ~=</td> Approximately equal to</td> </tr> <=</td> Lexicographically less than or equal to</td> </tr> >=</td> Lexicographically greater than or equal to</td> </tr> &</td> AND</td> </tr> |</td> OR</td> </tr> !</td> NOT</td> </tr></tbody></table>
Filters on objectCategory and objectClass
|
Leave a comment