Get-ADUser: Find Active Directory User Info with PowerShell

The Get-ADUser is the most commonly used PowerShell cmdlet for retrieving Active Directory user information, including attributes like usernames, email addresses, account activity, group memberships, contact details, job titles, organizational data, etc. Using the Get-ADUser cmdlet, you can get the value of any attribute of an AD user account, list domain users, export user reports to CSV/TXT files, and use various criteria to select and filter domain users.

Get-ADUser Cmdlet in the Active Directory PowerShell Module

To use the Get-ADUsercmdlet to get information from AD, you must have the Active Directory module for PowerShell installed on the computer.

This module is installed on AD domain controllers along with the Active Directory Domain Services (AD DS) role. The AD module can also be installed manually on any computer (it is part of the RSAT package):

• Windows Server 2012 R2 and newer: Install-WindowsFeature -Name "RSAT-AD-PowerShell" –IncludeAllSubFeature
• Windows 11 and 10: Get-WindowsCapability -Name RSAT.ActiveDirectory* -Online | Add-WindowsCapability -Online

Check that the module is installed, and if necessary, import it into your PowerShell session:

Get-Module ActiveDirectory
Import-Module ActiveDirectory

If RSAT-AD-PowerShell is not installed, you get an error when running the Get-ADUser command:

Get-ADUser: The term 'get-aduser' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

View the complete syntax and list of available arguments for the Get-ADUser cmdlet:

help Get-ADUser

How to Find AD User and List Properties with Get-ADUser

Let’s look at how to use the Get-ADUser cmdlet to find different information about domain users. The cmdlet can retrieve information for a single AD user or multiple users.

To display the list of all domain user accounts:

Get-ADUser -filter *

To get the properties of a specific user, use the –Identity parameter. Identity can be a username, login (SAMAccountName), DN (Distinguished Name), SID, or GUID.

The following PowerShell commands will return the same result for the same AD user account:

Get-ADUser –Identity b.smith
Get-ADUser –Identity "CN=Brian Smith,OU=Users,OU=Berlin,DC=woshub,DC=loc"
Get-ADUser –Identity "Brian Smith"

By default, the Get-ADUser cmdlet returns only 10 basic user attributes (out of more than 120 user account properties): DistinguishedName, SamAccountName, Name, SID, UserPrincipalName, ObjectClass, account status (Enabled: True/False according to the UserAccountControl AD attribute), etc.

Lists the values of all available attributes for the specified user.

Get-ADUser -identity b.smith -properties *

Then we’ll go to the formatting of Get-ADUser output so that the necessary user attributes are displayed. For example, you want to display the values of the following user properties:

For example, I want to display information about whether a user’s password has expired (Expired: True/False), the last time the password was changed, when the user password expires, and the last time the user logged into the domain. This info is stored in the following user account attributes:

• PasswordExpired
• PasswordLastSet
• PasswordNeverExpires
• LastLogonTimestamp

Run the command:

Get-ADUser tuser -properties PasswordExpired, PasswordLastSet, PasswordNeverExpires, lastlogontimestamp

To display only the specific user attributes in the output (remove all unnecessary attributes), filter them using Select-Object -Property or Format-Table. The following command displays the password status for all AD users in a convenient table view:

Get-ADUser -filter * -properties PasswordExpired, PasswordLastSet, PasswordNeverExpires | Format-Table Name, PasswordExpired, PasswordLastSet, PasswordNeverExpires

Get-ADUser -Filter Examples

The Get-ADUser -Filter parameter allows to filter the list of users by one or more attributes. This helps in finding Active Directory users whose attributes match specific criteria.

For example, I want to list active (Enabled) user accounts whose name contains “Dmitry”. To do this, a filter with multiple conditions is used. User attributes must meet both filter conditions in this example (-and).

Get-AdUser -Filter "(Name -like '*Dmitry*') -and (Enabled -eq 'True')" -Properties * |select name,enabled

To select values for user attributes, you can use all of the standard PowerShell logical comparison operators (-eq, -ne, -gt, -ge, -lt, -le, -like, -notlike, -and, -or, etc.)

You can use the Sort-Object cmdlet to sort the result list by a specific user property (attribute). In addition, you can use the Where-Object cmdlet to specify multiple filter criteria at once.

Get-ADUser -filter * -properties PasswordExpired, PasswordLastSet, PasswordNeverExpires -SearchBase 'OU=NY,DC=woshub,DC=com'| where {$_.name –like "*Dmitry*" -and $_.Enabled -eq $true} | sort-object PasswordLastSet | select-object Name, PasswordExpired, PasswordLastSet, PasswordNeverExpires

You can use LDAP filters in Get-ADUser queries. An LDAP filter can be specified by using the -LdapFilter attribute.

Get-ADUser -LDAPFilter '(&(department=it)(title=sysops))'

Exporting Active Directory Users to CSV/TXT Files with PowerShell

The Get-ADUser command can be used to output a list of domain users and their properties to a text file:

Get-ADUser -filter * -properties PasswordExpired, PasswordLastSet, PasswordNeverExpires | ft Name, PasswordExpired, PasswordLastSet, PasswordNeverExpires > C:\temp\users.txt

Or, use the Export-CSV cmdlet to export users to a CSV file, that you can then easily open in Excel.

Get-ADUser -filter * -properties PasswordExpired, PasswordLastSet, PasswordNeverExpires | where {$_.name –like "*Dmitry*"} | sort-object PasswordLastSet | select-object Name, PasswordExpired, PasswordLastSet, PasswordNeverExpires | Export-csv -path c:\tmp\user-passwords-expires.csv -Append -Encoding UTF8

Export a company email address list from AD to a CSV file. Later, you can import this CSV address list into desktop email clients (such as Outlook or Mozilla Thunderbird):

Get-ADUser -Filter {(mail -ne "null") -and (Enabled -eq "true")} -Properties Surname,GivenName,mail | Select-Object Name,Surname,GivenName,mail | Export-Csv -NoTypeInformation -Encoding utf8 -delimiter "," $env:temp\adress_list.csv

Get-ADUser Usage Examples

Let’s show several useful PowerShell command examples for querying Active Directory users with various filters. Combine them to get the list of AD user objects you need:

Display AD users, whose names begin with Joe:

Get-ADUser -filter {name -like "Joe*"}

Count the total number of user accounts in the Active Directory:

Get-ADUser -Filter {SamAccountName -like "*"} | Measure-Object

List disabled Active Directory users:

Get-ADUser -Filter {Enabled -eq "False"} | Select-Object SamAccountName,Name,Surname,GivenName | Format-Table

List AD user email addresses:

Get-ADUser -filter * -properties EmailAddress -SearchBase 'OU=Paris,OU-Fr,DC=woshub,DC=com'| select-object Name, EmailAddress

List enabled users and their email addresses:

Get-ADUser -Filter {(mail -ne "null") -and (Enabled -eq "true")} -Properties Surname,GivenName,mail | Select-Object Name,Surname,GivenName,mail | Format-Table

Find the users who don’t have an Email address set:

Get-ADUser -Filter * -Properties EmailAddress | where -Property EmailAddress -eq $null

Get active users who don’t have a Department specified in their properties:

Get-AdUser -Filter "Enabled -eq 'True'" -Properties * |where Department -eq $null|select name,enabled, Department

Get the creation date of the Active Directory user account:

Get-ADuser -Filter * -Properties Name, WhenCreated | Select name, whenCreated

List users created in the last 24 hours:

$lastday = ((Get-Date).AddDays(-1))
Get-ADUser -filter {(whencreated -ge $lastday)}

List the accounts with expired passwords (password expiration options are set in the domain password policy):

Get-ADUser -filter {Enabled -eq $True} -properties name,passwordExpired| where {$_.PasswordExpired}|select name,passwordexpired

Users who haven’t changed their domain passwords in the last 90 days:

$90_Days = (Get-Date).adddays(-90)
Get-ADUser -filter {(passwordlastset -le $90_days)}

Find inactive user accounts (not logged into the domain for more than 180 days).  The LastLogonTimestamp attribute value is used to get the logon history of a domain user.

$LastLogonDate= (Get-Date).AddDays(-180)
Get-ADUser -Properties LastLogonTimeStamp -Filter {LastLogonTimeStamp -lt $LastLogonDate } | ?{$_.Enabled –eq $True} |  Sort LastLogonTimeStamp| FT Name, @{N='lastlogontimestamp'; E={[DateTime]::FromFileTime($_.lastlogontimestamp)}} -AutoSize

To get a user’s photo from Active Directory and save it to a JPG file:

$usr = Get-ADUser sjoe -Properties thumbnailPhoto
$usr.thumbnailPhoto | Set-Content sjoe.jpg -Encoding byte

To get a list of users only from a specific domain container (Organizational Unit), use the -SearchBase parameter:

Get-ADUser -SearchBase 'OU=London,DC=woshub,DC=loc' -filter * -properties PasswordExpired, PasswordLastSet, PasswordNeverExpires | ft Name, PasswordExpired, PasswordLastSet, PasswordNeverExpires

Select users from multiple OUs at once using the following PowerShell commands:

$OUs = "OU=NY,DC=woshub,DC=com","OU=LA,DC=woshub,DC=com","OU=MA,DC=woshub,DC=com"
$OUs | foreach {Get-ADUser -SearchBase $_ -Filter * |select Name, Enabled}

List the AD groups that the user account is a member of:

Get-AdUser sjoe -Properties memberof | Select memberof -expandproperty memberof

List the users from the OU that are members of a specific domain security group:

Get-ADUser -SearchBase 'OU=Rome,OU=Italy,DC=woshub,DC=com' -Filter * -properties memberof | Where-Object {($_.memberof -like "*CEO*")}

List users from the OU who are members of a specific domain security group:

Get-ADUser -SearchBase 'OU=Rome,OU=Italy,DC=woshub,DC=com' -Filter * -properties memberof | Where-Object {($_.memberof -like "*CEO*")}

Task: get the user’s company name from AD and save it to a CSV file for a list of user accounts in a text file (one account per line). You can then import this CSV file into Excel:

Import-Csv c:\ps\users_list.csv | ForEach {
Get-ADUser -identity $_.user -Properties Name, Company |
Select Name, Company |
Export-CSV c:\ps\users_ad_list.csv -Append -Encoding UTF8
}

List users from the OU, except for members of a specific group:

$Users = Get-ADUser -filter * -SearchBase ‘OU=Berlin,DC=woshub,DC=com’ -properties memberOf
ForEach ($User In $Users)
{
$Groups = -join @($User.memberOf)
If ($Groups -notlike '*Domain Admins*')
{
$User.Name
}
}

Export a list of AD users with the Organizational Unit names (where they are located) to the Out-GridView table:

get-aduser -filter * -Properties cn,canonicalname | select name,userprincipalname,@{Name="OU";expression={$_.Canonicalname.substring(0,$_.canonicalname.length-$_.cn.length)}}| Out-GridView

Check that the AD user account exists:

$SamAccountName='jbrown'
if (@(Get-ADUser -Filter { SamAccountName -eq $SamAccountName }).Count -eq 0)
{  Write-Host "User $SamAccountName doesn’t exist"}

List the domain computers the user is allowed to log on (logon restriction through the LogonWorkstations AD attribute).

Get-ADUser jbrown -Properties LogonWorkstations | Format-List Name, LogonWorkstations