The Get-ADUser cmdlet is a fundamental PowerShell command for getting user account information from Active Directory (AD). Whether you need to audit user accounts, generate reports, or perform bulk operations, Get-ADUser provides powerful filtering and search capabilities. However, when dealing with multiple organizational units (OUs) and complex filtering requirements, the process can become time-consuming and require advanced scripting knowledge.
Using the Get-ADUser command to get AD users from multiple OUs:
Import-Module ActiveDirectory
$ous = 'OU=Sample1,DC=example1,DC=com','OU=Sample2,DC=example2,DC=com'
$ous | ForEach-Object {
Get-ADUser -Filter * -SearchBase $_ |
Select Name, DistinguishedName
} | Export-CSV -Path "C:\export.csv" -NoTypeInformation
Listing AD users from multiple OUs using ADManager Plus:
Retrieve all user accounts from sales and marketing organizational units in your domain.
$ous = 'OU=Sales,DC=contoso,DC=com','OU=Marketing,DC=contoso,DC=com'
$ous | ForEach { Get-ADUser -Filter * -SearchBase $_ }
This script defines multiple OUs and retrieves all users from each specified organizational unit.
Generate a CSV file containing usernames and email addresses from multiple departments.
$ous = 'OU=IT,DC=contoso,DC=com','OU=HR,DC=contoso,DC=com','OU=Finance,DC=contoso,DC=com'
$ous | ForEach { Get-ADUser -Filter * -SearchBase $_ -Properties EmailAddress | Select Name,SamAccountName,EmailAddress } | Export-CSV "C:\Users\MultiOU_Report.csv" -NoTypeInformation
This exports user details from IT, HR, and finance OUs into a single CSV file with specific attributes.
Retrieve only enabled user accounts including all sub-OUs within a parent OU.
Get-ADUser -Filter {Enabled -eq $true} -SearchBase "OU=Corporate,DC=contoso,DC=com" -SearchScope Subtree -Properties Department,Title
This queries all enabled users within the corporate OU and all its child OUs, including department and title information.
| Parameters | Description |
|---|---|
| -Identity | Specifies an AD user object by distinguished name, GUID, security identifier, or SAM account name |
| -Filter | Specifies a query string using PowerShell Expression Language to retrieve multiple objects |
| -SearchBase | Specifies the AD path to search under (OU or container distinguished name (DN)) |
| -SearchScope | Specifies the scope of AD search (Base, OneLevel, or Subtree) |
| -Properties | Specifies which user properties to retrieve (default returns a limited set) |
| -LDAPFilter | Specifies an LDAP query string for filtering users |
To retrieve users from multiple OUs, create an array of OU distinguished names and use ForEach-Object to iterate through them with Get-ADUser:
$ous = @('OU=Sales,DC=domain,DC=com','OU=HR,DC=domain,DC=com')
$ous | ForEach-Object { Get-ADUser -Filter * -SearchBase $_ }
This approach allows you to query multiple organizational units in a single script execution.
OneLevel searches only the immediate children of the specified OU, excluding sub-OUs. Subtree searches the entire hierarchy including all nested OUs. For multiple OU scenarios:
Include the -Properties parameter to retrieve additional attributes, then pipe the results through Export-CSV:
$ous = @('OU=IT,DC=contoso,DC=com','OU=Finance,DC=contoso,DC=com')
$users = foreach ($ou in $ous) {
Get-ADUser -Filter * -SearchBase $ou -Properties EmailAddress, Department, Title |
Select Name, SamAccountName, EmailAddress, Department, Title
}
$users | Export-CSV "C:\Reports\MultiOU_Users.csv" -NoTypeInformation
Common performance issues and solutions:
Combine OU iteration with filter conditions. For example, to get only enabled users with email addresses:
$ous = @('OU=Sales,DC=domain,DC=com','OU=Marketing,DC=domain,DC=com')
$ous | ForEach-Object {
Get-ADUser -Filter {Enabled -eq $true -and EmailAddress -like "*"} -SearchBase $_
}
Yes, specify the -Server parameter for each domain:
$ouList = @(
@{OU='OU=Users,DC=domain1,DC=com'; Server='dc1.domain1.com'},
@{OU='OU=Users,DC=domain2,DC=com'; Server='dc2.domain2.com'}
)
foreach ($item in $ouList) {
Get-ADUser -Filter * -SearchBase $item.OU -Server $item.Server
}
Get-ADUser returns these properties by default:
To retrieve additional properties like EmailAddress, Department, or Manager, use the -Properties parameter.
OUs with special characters require proper escaping. For OUs containing commas, use backslash ("\").
If the OU name is "Sales, North America":
$ou = 'OU=Sales\, North America,DC=contoso,DC=com'
Get-ADUser -Filter * -SearchBase $ou
For parentheses or other special characters, use single quotes and escape as needed.
There's no hard limit on the number of OUs you can query, but consider:
For optimal performance, batch large queries or implement pagination when dealing with 50+ OUs.
To generate a summary report with user counts per OU:
$ous = @('OU=Sales,DC=domain,DC=com','OU=IT,DC=domain,DC=com')
$report = foreach ($ou in $ous) {
$users = Get-ADUser -Filter * -SearchBase $ou -SearchScope OneLevel
[PSCustomObject]@{
OU = $ou
UserCount = $users.Count
}
}
$report | Format-Table -AutoSize