The sAMAccountName is the logon name used to support clients and servers from earlier versions of Windows (pre-Windows 2000). Despite its age, it remains a fundamental attribute in Active Directory (AD) for ensuring backward compatibility, serving as a unique logon name for users and computers in a domain. The Get-ADUser PowerShell cmdlet is frequently used to identify the sAMAccountName of AD user objects. This article explains how to get an AD user's sAMAccountName using PowerShell and the AD user reports in ADManager Plus.
The following table compares the process of finding an AD user's sAMAccountName using PowerShell versus ADManager Plus.
Before you start, ensure:
To get an AD user's sAMAccountName using PowerShell, open Windows PowerShell as an administrator and execute the following script:
Get-ADUser -Identity 'John' | Select-Object Name, sAMAccountName
To find an AD user's sAMAccountName using ADManager Plus:
To retrieve a list of users from a specific OU, you can use the -SearchBase parameter.
Get-ADUser-Filter * -SearchBase$targetOU | Select-Object Name, sAMAccountName
To get a complete list of all users in your domain, you can simply remove the -SearchBase parameter from the previous example.
Get-ADUser -Filter * | Select-Object Name, sAMAccountName
The following command gets all users and exports their name, sAMAccountName, and status to a CSV file.
Get-ADUser -Filter * -Properties Enabled | Select-Object Name, sAMAccountName, Enabled | Export-Csv -Path "C:\AD_Users.csv" -NoTypeInformation
Here are some practical examples of using the Get-ADUser cmdlet to retrieve users based on their sAMAccountName.
The simplest way to get a user is by using the -Identity parameter with their sAMAccountName.
# Get user by sAMAccountName
Get-ADUser -Identity "John"
To view more than the default properties, use the -Properties parameter to specify which attributes you want to see, such as their email address or department.
# Get the email address and department of a user
Get-ADUser -Identity "John" -Properties email, department | Select-Object name, email, department
Check if users are enabled using just their sAMAccountName with the following script:
# Import the list of sAMAccountNames from a CSV file
Import-Csv -Path "C:\temp\users.csv" | ForEach-Object {
# For each username in the CSV, run Get-ADUser
Get-ADUser -Identity $_.sAMAccountName -Properties Enabled, LastLogonDate | Select-Object sAMAccountName, name, Enabled, LastLogonDate
While PowerShell is a powerful tool for AD administration, relying on it exclusively comes with significant challenges, especially in complex AD environments.
ADManager Plus allows you to overcome all the PowerShell limitations and helps you obtain AD users effortlessly with its predefined AD reports.
sAMAccountName is the legacy, NetBIOS-compatible logon name, while UserPrincipalName is the more modern, email-style logon name.
This is a crucial step in any user onboarding script to avoid errors. The best way is to try to retrieve the user and check if the result is null. Here is a simple and reliable function you can add to your scripts:
function Test-sAMAccountNameExists {
param (
[Parameter(Mandatory=$true)]
[string]$UserName
)
# The @() ensures the result is always an array, preventing errors if null
$user = @(Get-ADUser -Filter "sAMAccountName -eq '$UserName'")
if ($user.Count -gt 0) {
# If count is greater than 0, the user exists
Write-Host "Username '$UserName' already exists." -ForegroundColor Red
return $true
} else {
Write-Host "Username '$UserName' is available." -ForegroundColor Green
return $false
}
}
# --- How to use the function ---
Test-sAMAccountNameExists -UserName "b.cooper"
Test-sAMAccountNameExists -UserName "new.user99"
The manager attribute in AD stores the distinguished name and not the sAMAccountName. To accomplish this, you retrieve the user object, check if the Manager property is populated, and if so, you can use its value to retrieve the manager's user object. Here's the script:
# The user you want to check
$userName = "b.cooper"
# Step 1: Get the user and specifically request the Manager property
$user = Get-ADUser -Identity $userName -Properties Manager
if ($null -ne $user.Manager) {
# Step 2: If the manager property exists, get the manager's user object
$manager = Get-ADUser -Identity $user.Manager
Write-Host "The manager of '$userName' is '$($manager.sAMAccountName)'."
}
else {
Write-Host "User '$userName' does not have a manager listed."
}