Reporting on Active Directory users involves gathering information about user accounts, their properties, and attributes within an Active Directory environment. This can be accomplished using various methods, including PowerShell scripts and native Active Directory tools, but their limited GUI and inability to generate complex Active Directory reports make them a less optimal choice for this task. ADManager Plus, with its user-friendly interface and more than 200 predefined reports makes it easier to report on Active Directory users and their attributes. Unlike PowerShell, ADManager Plus' Active Directory reports do not require scripting knowledge and can be generated by non-IT admin personnel and on the go from its mobile apps, making it the optimal choice for Active Directory reporting.
Obtaining a list of all the Active Directory users helps with meeting audit requirements and gaining visibility into the dormant and inactive accounts.
Regularly reporting on enabled or disabled users helps administrators monitor and appropriately manage them.
User account status must be continuously monitored, and inactive users must be promptly disabled or deleted to mitigate potential security risks.
Locked-out users must be continuously monitored to identify unauthorized access attempts, compromized accounts, or potential password attacks.
Account expiry reports help IT administrators track user account life cycles, including when accounts are due to expire.
Monitoring last logon reports helps administrators gain insights on user activity and analyze them over time for potential data breaches and malicious activity.
By generating manager-based reports, administrators can identify managers responsible for specific teams or departments. This is vital for delegating administrative tasks, assigning responsibilities, and granting appropriate permissions based on organizational hierarchy.
Nested reports enables administrators to gain insights on the intricacies of Active Directory groups and its members.
Every organization will have its own policies and procedures on how Active Directory objects are managed throughout the life cycle. By selecting and presenting data that is directly applicable to the Active Directory environment, IT administrators gain insights that are actionable and meaningful, and that is when custom reports come into play.
A list of all Active Directory users can be obtained using the Get-ADUsers cmdlet in PowerShell. Here's a sample script that you can use to fetch all the Active Directory users using PowerShell:
The New-ADUser cmdlet can also be used to create multiple Active Directory users. The following is a sample command to create Active Directory users in bulk using PowerShell:
ADManager Plus has an All Users report to retrieve all the Active Directory users in an Active Directory domain. This report can be scheduled and automatically generated at a set time. In addition to this, here are a few benefits for getting Active Directory users using ADManager Plus' All Users reports:
To get a list of all the enabled and disabled users using PowerShell, execute the Get-ADUser cmdlet along with the enabled and disabled filters. Here are some sample scripts that you can use to fetch enabled and disabled users using PowerShell.
To get a list of all the enabled Active Directory users, execute this command:
To get a list of all the disabled Active Directory users, execute this command:
ADManager Plus' preconfigured reports can be instantly generated to fetch the enabled and disabled Active Directory users. Additionally, automations can be configured to take appropriate actions on user accounts based on these reports. Here's how you can benefit from choosing ADManager Plus over the Get-ADUser cmdlet:
Administrators can use the Get-ADUser cmdlet with certain filters to fetch the active and inactive users in Active Directory. Below are a few sample scripts.
To get a list of all the users who have logged in over the past 90 days, execute this command:
Get-ADUser -Filter {(LastLogonDate -gt (Get-Date).AddDays(-90)) -and (Enabled -eq $true)}
To get a list of all the users who have been inactive over the last 90 days, execute this command:
Get-ADUser -Filter {(LastLogonDate -lt (Get-Date).AddDays(-90)) -and (Enabled -eq $true)}
The list of active and inactive users can be instantly obtained with the click of a button and exported in PDF, XLSX, CSV, and more in ADManager Plus. These users can also be obtained from the All Users report itself by filtering the results based on users' account status. Here are some benefits from ADManager Plus to accomplish this task:
The account lockout status of users in Active Directory can be obtained using the Search-ADAccount cmdlet and certain filters. Here's a sample script that can be used to get the account lockout status using PowerShell:
Search-ADAccount -LockedOut | Select-Object Name, SamAccountName, LockedOut
ADManager Plus' locked-out users report fetches and displays all the users who have been locked out. Here are a few benefits for using ADManager Plus to get the account lockout status of users:
To generate a report of expired, soon-to-expire, and never-expire users in Active Directory using PowerShell, you can use the commands mentioned below.
To get Active Directory user accounts and their account expiration date, use this command:
Get-ADUser -Filter {AccountExpirationDate -le (Get-Date)} | Select-Object Name, SamAccountName, AccountExpirationDate
To get Active Directory user accounts that are about to expire in the next 30 days, use this command:
Get-ADUser -Filter {AccountExpirationDate -ne $null -and AccountExpirationDate -le (Get-Date).AddDays(30)} | Select-Object Name, SamAccountName, AccountExpirationDate
To get Active Directory user accounts that will never expire, use this command:
Get-ADUser -Filter {AccountExpirationDate -eq $null} | Select-Object Name, SamAccountName
ADManager Plus' account expired users, recently expired users, and soon-to-expire user account reports enables IT administrators to report on user accounts based on the user account expiration status. The account expired users' report fetches and lists all the user accounts that have expired, whereas the recently expired users report allows administrators to narrow down expired users' results based on the expiration date. The soon-to-expire users reports allows administrators to analyze and determine what will happen to user accounts that will expire soon. Here are a few benefits for the account expiration reports in ADManager Plus:
The last logon report can be generated using the Get-ADUser cmdlet in PowerShell along with some filters. Here is a sample script that can be used:
Get-ADUser -Filter * -Properties LastLogonDate | Select-Object Name, SamAccountName, LastLogonDate
ADManager Plus provides a real last logon report that fetches and displays the real last logon details of users in the desired domains, groups, or OUs based on the last logon time stamp value in the domain controllers. Here are a few benefits for choosing ADManager Plus for generating the last logon details of users over PowerShell:
Manager based reports can be obtained using the following PowerShell script:
Get-ADUser -Filter * -Properties Manager | Select-Object Name, SamAccountName, @{Name="Manager"; Expression={(Get-ADUser $_.Manager).Name}}"
ADManager Plus provides a manager-based users' report that allows you to get a list of all the direct reports of managers. Here are a few benefits of this report:
PowerShell uses the Get-ADGroupMember cmdlet to get the members of an Active Directory group. Here's a sample script:
Get-ADGroupMember -Identity "Managers" | Select-Object Name, SamAccountName
Additionally, to get a users group membership details, the Get-ADPrincipalGroupMembership cmdlet can be used. Here's a sample script:
ADManager Plus group membership reports enables administrators to easily find members of Active Directory groups including nested groups without scripting. The reports also come with built-in filtering options to narrow down results. Here a few benefits for choosing ADManager Plus over PowerShell for finding members of Active Directory groups:
Custom reports in PowerShell can be generated by using filters along with their cmdlets. For instance, the Get-ADUser cmdlet that is used to fetch Active Directory users can be used along with the Username filter to get a list of all the Active Directory users along with their usernames. Here are a few sample scripts that can be used to generate customized user reports:
To get a list of all Active Directory users based on their department attribute, execute the command:
To get a list of all Active Directory users and their sAMAccountName attributes using a CSV file, execute this command:
import-module activedirectory Get-ADUser -Filter * -SearchBase "OU=Abc, DC=example, DC=com" | Select sAMAccountName, name | export-csv -Path c:\Scripts\Users.csv
To get a list of all Active Directory users and their displayName attribute using a CSV file, execute this command:
Get-ADUser -Filter * -SearchBase "OU=Abc, DC=example, DC=com" | Select sAMAccountName, givenName, displayName, mail, telephoneNumber | export-csv -Path
To get a list of all Active Directory users with empty telephoneNumber attribute, execute this command:
Get-ADUser -LDAPFilter '(!(telephoneNumber=*))'| Select sAMAccountName, givenName | export-csv -path c:\Scripts\Emptyattrib.csv
c:\Scripts\Users.csv
ADManager Plus enables administrators to create custom reports with required details tailored to the organizational requirements. Custom reports can be built from scratch using filters and can be automatically generated like any other report in ADManager Plus. Here are few benefits for choosing ADManager Plus to build and generate custom reports:
Over 280,000 organizations across 190 countries
trust ManageEngine to manage
their IT.
Over 100,000 technicians
trust
ADManager Plus to manage their Windows environment.
Create and manage AD user accounts in bulk using CSV files and customizable templates.
Learn MoreAutomate routine AD tasks like creating users, deleting inactive users, and more. Track the status of automated tasks whenever required.
Learn MoreDelegate AD administration and management securely to your help desk and HR teams. Offload repetitive tasks like password resets and user creation.
Learn More2022, Zoho Corporation Pvt. Ltd. All Rights Reserved.
Your download is in progress and it will be completed in just a few seconds!
If you face any issues, download manually here