wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Windows AD information in command line ======

<cli prompt='>'>
C:\Users\myuser1>gpresult /r | find "OU"
    CN=MYUSER1,OU=ALL Users,OU=NDS,DC=xxx,DC=xxx,DC=lu
        GPOUSER_ScreenSaver30m
</cli>

List all groups of a user:
<cli prompt='>'>
C:\Users\myuser1> (GET-ADUSER –Identity myuser1 –Properties MemberOf | Select-Object MemberOf).MemberOf
</cli>

Get the extensionAttribute attribute value for all Active Directory users using PowerShell

How do I return the sAMAccountName and a particular attribute – in this case extensionAttribute1 for all Active Directory users in PowerShell
<cli prompt='>'>
Get-ADUser username -Properties * | Select *
</cli>

<cli prompt='>'>
Get-ADUser -Properties extensionAttribute1 -Filter * | Select sAMAccountName, extensionAttribute1 | export-csv c:\temp\extensionattribute1.csv
</cli>

Using PowerShell to List All AD User Attributes

Per the previous section you need to examine the following to get the full list of potential attributes for any class definition:

    Find a list of all classes inherited by the class (inheritance chain)
    Find a list of all supplemental (auxiliary) classes for the classes found in the previous step
    Find all attribute lists in the four mustContain/mayContain attributes of the classes found in the two previous (don’t forget the class itself)

<code>
Import-Module ActiveDirectory
$Loop = $True
$ClassName = "User"
$ClassArray = [System.Collections.ArrayList]@()
$UserAttributes = [System.Collections.ArrayList]@()
# Retrieve the User class and any parent classes
While ($Loop) {
  $Class = Get-ADObject -SearchBase (Get-ADRootDSE).SchemaNamingContext -Filter { ldapDisplayName -Like $ClassName } -Properties AuxiliaryClass, SystemAuxiliaryClass, mayContain, mustContain, systemMayContain, systemMustContain, subClassOf, ldapDisplayName
  If ($Class.ldapDisplayName -eq $Class.subClassOf) {
    $Loop = $False
  }
  $ClassArray.Add($Class)
  $ClassName = $Class.subClassOf
}
# Loop through all the classes and get all auxiliary class attributes and direct attributes
$ClassArray | % {
  # Get Auxiliary class attributes
  $Aux = $_.AuxiliaryClass | % { Get-ADObject -SearchBase (Get-ADRootDSE).SchemaNamingContext -Filter { ldapDisplayName -like $_ } -Properties mayContain, mustContain, systemMayContain, systemMustContain } |
  Select-Object @{n = "Attributes"; e = { $_.mayContain + $_.mustContain + $_.systemMaycontain + $_.systemMustContain } } |
  Select-Object -ExpandProperty Attributes
  # Get SystemAuxiliary class attributes
  $SysAux = $_.SystemAuxiliaryClass | % { Get-ADObject -SearchBase (Get-ADRootDSE).SchemaNamingContext -Filter { ldapDisplayName -like $_ } -Properties MayContain, SystemMayContain, systemMustContain } |
  Select-Object @{n = "Attributes"; e = { $_.maycontain + $_.systemmaycontain + $_.systemMustContain } } |
  Select-Object -ExpandProperty Attributes
  # Get direct attributes
  $UserAttributes += $Aux + $SysAux + $_.mayContain + $_.mustContain + $_.systemMayContain + $_.systemMustContain
}
$UserAttributes | Sort-Object | Get-Unique
</code>

<code>
accountExpires
accountNameHistory
aCSPolicyName
adminCount
adminDescription
adminDisplayName
...
c
canonicalName
carLicense
cn
co
codePage
comment
company
controlAccessRights
countryCode
...
enabledProtocols
expirationTime
extensionAttribute1
...
extensionData
extensionName
facsimileTelephoneNumber
flags
folderPathname
formData
forwardingAddress
fromEntry
frsComputerReferenceBL
fRSMemberReferenceBL
fSMORoleOwner
garbageCollPeriod
gecos
generationQualifier
gidNumber
givenName
groupMembershipSAM
groupPriority
groupsToIgnore
heuristics
homeDirectory
homeDrive
homeMDB
homeMTA
homePhone
homePostalAddress
houseIdentifier
importedFrom
info
initials
instanceType
internationalISDNNumber
internetEncoding
ipPhone
isCriticalSystemObject
isDeleted
isPrivilegeHolder
isRecycled
jpegPhoto
kMServer
l
labeledURI
language
languageCode
lastKnownParent
lastLogoff
lastLogon
lastLogonTimestamp
legacyExchangeDN
lmPwdHistory
localeID
lockoutTime
loginShell
logonCount
logonHours
logonWorkstation
mail
mailNickname
managedObjects
manager
mAPIRecipient
masteredBy
maxStorage
mDBOverHardQuotaLimit
mDBOverQuotaLimit
mDBStorageQuota
mDBUseDefaults
memberOf
mhsORAddress
middleName
mobile
modifyTimeStamp
msCOM-PartitionSetLink
msCOM-UserLink
...
msDS-UserPasswordExpiryTimeComputed
msDS-ValueTypeReferenceBL
msExchADCGlobalNames
...
msNPSavedCallingStationID
msOrg-LeadersBL
msPKIAccountCredentials
...
msRADIUSServiceType
msRASSavedCallbackNumber
msRASSavedFramedIPAddress
msRASSavedFramedRoute
msSFU30Name
msSFU30NisDomain
msSFU30PosixMemberOf
msTSAllowLogon
...
name
netbootSCPBL
networkAddress
nonSecurityMemberBL
ntPwdHistory
nTSecurityDescriptor
o
objectCategory
objectClass
objectGUID
objectSid
objectVersion
...
ou
ownerBL
...
postOfficeBox
preferredDeliveryMethod
preferredLanguage
preferredOU
primaryGroupID
primaryInternationalISDNNumber
...
pwdLastSet
...
repsFrom
repsTo
revision
rid
roomNumber
sAMAccountName
sAMAccountType
scriptPath
sDRightsEffective
secretary
securityIdentifier
securityProtocol
seeAlso
serialNumber
serverReferenceBL
servicePrincipalName
shadowExpire
shadowFlag
shadowInactive
shadowLastChange
shadowMax
shadowMin
shadowWarning
showInAddressBook
showInAdvancedViewOnly
sIDHistory
siteObjectBL
sn
st
street
...
title
tokenGroups
tokenGroupsGlobalAndUniversal
tokenGroupsNoGCAcceptable
uid
uidNumber
unauthOrig
unauthOrigBL
unicodePwd
unixHomeDirectory
unixUserPassword
unmergedAtts
url
userAccountControl
userCert
userCertificate
userParameters
userPassword
userPKCS12
userPrincipalName
userSharedFolder
userSharedFolderOther
userSMIMECertificate
userWorkstations
uSNChanged
uSNCreated
uSNDSALastObjRemoved
USNIntersite
uSNLastObjRem
uSNSource
versionNumber
wbemPath
wellKnownObjects
whenChanged
whenCreated
wWWHomePage
x121Address
x500uniqueIdentifier
</code>

https://www.easy365manager.com/how-to-get-all-active-directory-user-object-attributes/
wiki

User Tools

Site Tools

Page Tools
