The Get-ADUser cmdlet is one of the most widely used PowerShell cmdlet utilized by administrators working with AD. This cmdlet allows you to query and get all AD users, their specific properties, and apply filters to find specific AD users based on organizational units (OUs), group membership, or attributes. This article explains how to use the Get-ADUser cmdlet with practical examples, including advanced filtering techniques, property selection, and much more. This article also compares the cmdlet directly with the AD user reports in ADManager Plus, an AD reporting tool.
See how the script-based approach in PowerShell compares to the simple, GUI-based reporting in ADManager Plus.
Before you start, ensure you have:
To get all AD users using PowerShell:
Get-ADUser -Filter *
Use different parameters along with the Get-ADUser cmdlet to generate more granular user reports.
To get all AD users using ADManager Plus:
Here are some common parameters that can be used along with the Get-ADUser cmdlet:
| Parameter | Description |
|---|---|
| -Identity | This parameter specifies a single user to retrieve by their sAMAccount Name, DN, GUID, or SID. |
| -Filter | This parameter finds users based on a query. Use * to find all users. |
| -Properties | This parameter specifies which additional user attributes to retrieve. |
| -SearchBase | Restricts the search to a specific OU or container path. |
| -SearchScope | Defines the depth of the search (Base, OneLevel, or Subtree). The default is Subtree. |
| -ResultSetSize | Sets the maximum number of users to be returned by the query. Use $null for no limit. |
| -Server | Specifies which domain controller (DC) to run the query against. |
| -LDAPFilter | Finds users using the more complex LDAP query syntax instead of the PowerShell filter. |
| -Credential | Runs the command using the credentials of a different user account. |
To retrieve information about a specific user, use the -Identity parameter. You can identify users by their sAMAccountName, DN, GUID, or SID:
#Get user by sAMAccountName
Get-ADUser -Identity "jdoe"
#Get user by UPN
Get-ADUser -Identity "john.d@company.com"
#Get user by DN
Get-ADUser -Identity "CN=John Doe,OU=Users,DC=company,DC=com"
To get all users in your Active Directory domain, use the -Filter * parameter.
# Get all users (basic properties only)
Get-ADUser -Filter *
# Format output in a table for better readability
Get-ADUser -Filter * | Format-Table Name, sAMAccountName, Enabled
To see more useful details like email address or department, you need to use the -Properties parameter.
# To view all properties for all users
Get-ADUser -Filter * -Properties *
# To view a specific selection of properties for all users
Get-ADUser -Filter * -Properties email, department | Select-Object Name, email, department
A common requirement is to export the list of users to a CSV file for reporting or auditing. You can do this by using the Export-Csv cmdlet along with the Get-ADUser cmdlet.
Get-ADUser -Filter * -Properties email, department | Select-Object name, email, department | Export-Csv -Path "C:\Reports\ad_users.csv" -NoTypeInformation
The key to limiting your search to an OU is to use the -SearchBase parameter of the Get-ADUser cmdlet. For this, you need the distinguished name (DN) of the OU you want to search in. It's a unique path to the OU within your domain.
Here's how you can find it:
Once you have the DN, use it with the -SearchBase parameter. The -Filter * command will get all users within that location.
Get-ADUser -Filter * -SearchBase "OU=Sales,DC=yourdomain,DC=com"
Use this command to generate a list of all users who hold a specific job title within the organization. This can be useful while creating targeted email distribution lists or for departmental reporting.
Get-ADUser -Filter "Title -eq 'Sales Manager'" -Properties displayName, department | Select-Object displayName, department, sAMAccountName
This script retrieves a list of all user accounts created within the last seven days. This helps keep track of recent account creations or for verifying that new employees have been set up correctly.
$days = 7
$cutoffDate = (Get-Date).AddDays(-$days)
Get-ADUser -Filter 'whenCreated -ge $cutoffDate'-Properties whenCreated | Select-Object Name, sAMAccountName, whenCreated
When you only know part of a user's name, you can find them using a wildcard (*). For instance, if you want to find all the users whose names contain "John", you can use the following script:
Get-ADUser -Filter "Name -like '*John*'" -Properties displayName, email | Select-Object displayName, email
This script uses a user's DN to find all user accounts that list that user as their manager, effectively mapping out team structures.
$manager = Get-ADUser "manager.sAMAccountName"
Get-ADUser -Filter "manager -eq '$($manager.distinguishedName)'"-Properties displayName, Title | Select-Object Name, DisplayName, Title
This example demonstrates how to retrieve a list of users belonging to multiple departments. This is far more efficient than running and combining separate commands for each department.
Get-ADUser -Filter "department -eq 'Sales' -or department -eq 'Marketing'" -Properties department | Select-Object name, department
Solution: This error means the Active Directory Module is not installed or available in your PowerShell session. To fix this, you need to install the remote server administration tools (RSAT) for AD on your Windows client machine. On a server, ensure the Active Directory Module for Windows PowerShell feature is installed.
Solution: This indicates that the user specified in the -Identity parameter could not be found. Double-check the spelling of the username and verify that the user account actually exists in AD and has not been deleted.
Solution: The user account you are using to run the PowerShell script does not have the necessary permissions to read information from AD. To resolve this, run PowerShell as a user who is a member of the domain and has at least read access.
This type of error, or getting no results when you expect them, is often caused by a syntax issue in your -Filter string. Verify if variables and special characters are properly quoted and escaped.
Solution: This is a network connectivity error. The computer running the script cannot contact a DC. Check your network connection and ensure you can ping your domain and a specific DC.
While PowerShell is a powerful tool for report generation, it comes with several inherent limitations, especially when used for regular reporting by a broader IT team.
ADManager Plus is a comprehensive AD reporting solution that directly addresses the limitations of PowerShell, empowering organizations to manage and report on their AD environment more efficiently and securely.
The Get-ADUser cmdlet is used to get one or more user objects from AD. Administrators use it to find users based on specific criteria, view their properties, and export user data for reporting and auditing purposes.
You can filter AD users with the -Filter parameter, which accepts a query string. For example, to find all users in the Marketing department, you would use:
Get-ADUser -Filter "Department -eq 'Marketing"
To get every property for a user, you must use the -Properties parameter. This is essential for obtaining essential user attributes like LastLogonDate, whenCreated, and MemberOf.
A simple way is to attempt to retrieve the user and check if the command returns a result. If it returns an object, the user exists; if it returns nothing or an error, the user does not.
To get a list of groups a user belongs to, you need to query the MemberOf property.
Get-ADUser -Identity 'john' -Properties MemberOf | Select-Object -ExpandProperty MemberOf