Solved

Powershell to search DN for users

Posted on 2013-01-24
41
688 Views
Last Modified: 2013-01-28
Hi Experts,

I have list of samaccountname is CSV file from different domains in forest

Is there any way to find all users DN even if the user is anywhere in forest?

I can use Quest commands too if we can accompalish with that

Thanks
0
Comment
Question by:chandru_sol
  • 24
  • 15
  • +1
41 Comments
 
LVL 20

Expert Comment

by:agonza07
ID: 38817577
Here's how to search through multiple domains in a forest.
http://halfloaded.com/blog/powershell-using-posh-to-search-across-multiple-domains-in-forest/

Here's how to get the DN from the SAMACCOUNTNAME
http://blogs.technet.com/b/benp/archive/2007/03/26/searching-the-active-directory-with-powershell.aspx

put them together and you got yourself your script.
0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38817634
I am newbie to powershell. Can you help on combining them together?

Thanks
0
 
LVL 17

Expert Comment

by:Premkumar Yogeswaran
ID: 38817767
Hi Chandru,

Check with the below script.

Please CSV in "c:\temp\user.csv"

Regards,
Prem


#Importing Active Directory Module in PowerShell
Import-Module ActiveDirectory
#Forest Wide Search Function
Function ForestWideSearch([String]$Filter)
{
  Foreach ($Domain in (Get-ADForest).Domains)
#Listing the Domains in a Forest
{
$Domain = (Get-ADDomain $Domain).DNSRoot
#Performing Search Operation per Domain
$Objects = Get-ADObject -LDAPFilter $Filter -Server $Domain -Properties *
Foreach ($Object in $Objects)
{
#Perform any Operation
Write-Host $Object.name $Object.distinguishedname
}
}
}
#LDAP Filter
$userobjects = import-csv c:\temp\user.csv
ForEach ( $userobject in $userobjects ) {
$samid = $userobject.samaccountname
}
$Filter = "(&(objeCtcategory=Person)(objectClass=User)(samaccountname=$samid))"
#Calling the Function
ForestWideSearch $Filter

Open in new window

0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38817792
Hope you are doing good! :-)

Thanks Prem. I will check and get back to you
0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38817807
Get-ADObject : The search filter cannot be recognized. i get this error
0
 
LVL 40

Expert Comment

by:Subsun
ID: 38818220
This should work..Replace Domain.com with your root forest..
Connect-QADService Domain.com -GC
Import-Csv C:\input.csv | %{Get-QADUser $_.sAMAccountName | Select sAMAccountName,DN} | Export-Csv C:\report.csv -NoTypeInformation

Open in new window

Sample CSV file
sAMAccountName
User1
User2
User3
User4

Open in new window

0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38818375
Will it be able to pull all attributes or only attributes replicated to GC. Can i also use this to export managers for users?
0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38818378
Only works for domain where my username exist and not for all domains. I have users from all domains in csv file
0
 
LVL 40

Expert Comment

by:Subsun
ID: 38818397
If use replace Domain.com with you root domain then it should work. It will give you manager..
0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38818452
I tried and it doesn't seem to work and doesn't pull details from other domains
0
 
LVL 40

Expert Comment

by:Subsun
ID: 38818482
It did work for me in my multidomain enviornment..  I can collect user information from 7 different domains (Same forest).. :-)

What if you run against single user from different domain?
Connect-QADService Domain.com -GC
Get-QADUser Testuser

Open in new window

0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38818500
Sorry Subsun i tried and it doesn't seem to bring user in other domain. Is there any pre-requisites for this to work

I can see it is trying to connect to default naming context of domain where i am connected and brings back blank result

Anyway to find out why?
0
 
LVL 40

Expert Comment

by:Subsun
ID: 38818517
You just need read permission on all domain objects.. Are you able to search the objects in ADUC?

What is the result you get when you run Connect-QADService Domain.com -GC
0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38818552
I think by default all users have read permission in AD. Yes i am able to search user in ADUC
DefaultNamingContext                               Type            
--------------------                               ----            
DC=child,DC=parent,DC=com                             ActiveDirectory
0
 
LVL 40

Expert Comment

by:Subsun
ID: 38818573
DC=child,DC=parent,DC=com, is this your root domain? where is the user located? I mean what is the user domain name?
0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38818593
Say for example i have below structure

parent.com
Child1.parent.domain.com
Child2.parent.domain.com
Child3.parent.domain.com
Child4.parent.domain.com

User was in Child3.parent.domain.com

Machine from where i am running script is connected to Child1.parent.domain.com and user who is running script is from child1.parent.domain.com
0
 
LVL 40

Expert Comment

by:Subsun
ID: 38818635
What is the result of..
Connect-QADService parent.com -GC
Get-QADUser Testuser

Open in new window


or
Connect-QADService  parent.domain.com -GC
Get-QADUser Testuser

Open in new window

0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38818652
Sorry it is not parent.domain.com (just parent.com) :-)
0
 
LVL 40

Expert Comment

by:Subsun
ID: 38818662
if root is parent.com then child should be like  Child1.parent.com.. and you should connect to parent.com
0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38818675
Yes tried same but it is connecting to defaultnamingcontext child1.parent.com
0
Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

 
LVL 40

Expert Comment

by:Subsun
ID: 38818729
Well that's a problem then..  Try this..

Import-Csv C:\input.csv | %{Get-QADUser $_.sAMAccountName -SearchRoot "DC=parent,DC=com" -UseGlobalCatalog | Select sAMAccountName,DN} | Export-Csv C:\report.csv -NoTypeInformation

Open in new window

0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38818799
I will try this now. Any idea why that is happening?
0
 
LVL 40

Expert Comment

by:Subsun
ID: 38818814
Not sure .. I am running scripts from computer connected to my parent domain,.. may be due to that I am getting all details.. never tried on a computer which is in child domain..
0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38818815
it works but something weird

Username for example user1 is pulled for a user list in csv but samaccountname is user
0
 
LVL 40

Expert Comment

by:Subsun
ID: 38818825
You can run
Get-QADUser user1 -SearchRoot "DC=parent,DC=com" -UseGlobalCatalog | FL
and check..
0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38818870
Definitely pulling wrong user

Child1.parent.com - Test1_ad (samaccountname)

Child2.parent.com - Test1 (samaccountname)

i am checking for samaccountname test1 but it is brining test1_ad
0
 
LVL 40

Expert Comment

by:Subsun
ID: 38818896
Add -SamAccountName parameter, then it won’t give you the wrong user..
Import-Csv C:\input.csv | %{Get-QADUser -SamAccountName  $_.sAMAccountName -SearchRoot "DC=parent,DC=com" -UseGlobalCatalog | Select sAMAccountName,DN} | Export-Csv C:\report.csv -NoTypeInformation

Open in new window

0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38818920
Checking this now...


Can you please help on this question as well?

http://www.experts-exchange.com/Programming/Languages/Visual_Basic/VB_Script/Q_27996820.html

Thanks
0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38818940
Can this be used for exporting all attributes or only attributes replicate to GC?

Thanks
0
 
LVL 40

Expert Comment

by:Subsun
ID: 38818968
Only attributes which are thre in GC.. You can run the following command and see the available attributes
Get-QADUser user1 -SearchRoot "DC=parent,DC=com" -UseGlobalCatalog -IncludeAllProperties | FL

Open in new window

0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38818978
I assume no other way of getting other attributes or is there still ways to get all attributes

Thanks
0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38819004
Wanted to ask you you prefer Poweshell AD or Quest AD?

It will be really helpful if you could check other question too
0
 
LVL 40

Expert Comment

by:Subsun
ID: 38819010
You can get all attributes.. which attribute you want?.. :-)
0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38819026
i would like to document all attributes or know of ways for some attributes and i can add them in future

extensionattributes
manager
telephone

etc....
0
 
LVL 40

Accepted Solution

by:
Subsun earned 500 total points
ID: 38820636
Try this script to get all attributes. Remove the star from select *, add whatever attribute you want and export it..
Import-Csv C:\input.csv | %{
Get-QADUser -SamAccountName  $_.sAMAccountName -SearchRoot "DC=parent,DC=com" -UseGlobalCatalog | `
% {Connect-QADService $_.Domain.Dnsname | Out-Null
		Get-QADUser $_.SamAccountName -IncludeAllProperties | 
		Select *}
}| Export-Csv C:\report.csv -NoTypeInformation

Open in new window

Wanted to ask you you prefer Poweshell AD or Quest AD?
I prefer Quest AD, But I use both depends on my requirement..

I will take a look at other question as soon as I can..
0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38821326
Thanks! I will try and let you know

what is the difference between Quest AD and Powershell AD?
0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38821461
Best way to start learning powershell. I am sure it is worth learning powershell but where to start is question

Thanks
0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38821462
I love Powershell and its potential and flexibility. Please guide me to go in right way to learn

:-)

Thanks
0
 
LVL 40

Expert Comment

by:Subsun
ID: 38825882
what is the difference between Quest AD and Powershell AD?
*QAD* cmdlets are from Quest: http://wwww.quest.com/powershell
And *AD* cmdlets are from Microsoft (Windows 2008 R2 and later)..
Both have different parameters to use but you can get same output from both (Property name may differ but values will be same.. :-))..

I love Powershell and its potential and flexibility. Please guide me to go in right way to learn
I thought you already started, I had given you some reference book in last question..
Best way to learn is to start scripting.. The more you do the more you learn... :-).  I am learning a lot by helping you guys...

Following article should help..
http://social.technet.microsoft.com/wiki/contents/articles/183.windows-powershell-survival-guide.aspx
0
 
LVL 12

Author Closing Comment

by:chandru_sol
ID: 38826044
Thanks Subsun!! Appreciated
0
 
LVL 12

Author Comment

by:chandru_sol
ID: 38826051
Have been really very busy with full time job. I am trying to find sometime soon to get hands on this and start helping and learn


Thanks again! :-)
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Set OWA language and time zone in Exchange for individuals, all users or per database.
Synchronize a new Active Directory domain with an existing Office 365 tenant
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now