Technical Article

Look up AD user properties using powershell

,

You will need powershell active directory module installed on the computer where you are running this script from.

If you are using a Windows 10 machine like I am right now, here is a good resource to get the AD module installed.

https://gallery.technet.microsoft.com/Install-the-Active-fd32e541

You would need a normal AD account to be able to search AD. However, you don't need to be a domain admin or need any special permission in the AD.

try
{

		Import-Module Activedirectory 

		# we will grab current domainuser if no specific user or domain is specified

		$domain_name = ""
		$username = ""

		if ($username -eq "") {$username = $env:UserName}

		"User Name: " + $username  

		""

		if ($domain_name -eq "") {$domain_name = (Get-ADDomain).Name}

		"Domain: " + $domain_name

		$domain_controller = (Get-ADDomainController -Discover -DomainName $domain_name).HostName

		"Domain Controller: " + $domain_controller

		$domain_FQDN = (Get-ADDomain $domain_name).DNSRoot 
		"Domain FQDN: " + $domain_FQDN

		$domain_DN = (Get-ADDomain $domain_name).DistinguishedName

		"Domain Distinguished Name: " + $domain_DN

		""
		# lets look up the user in the AD         
		$get_aduser = Get-ADUser -Server $domain_FQDN -Properties * -Filter {sAMAccountName -eq $username} 
		If ($get_aduser -eq $Null)  

		{

				"Attention: User $username not found in AD domain $domain_FQDN"
				return

		}
		Else  {"SUCCESS: User $username exists in AD domain $domain_FQDN"}

		"Is password expired? " + $get_aduser.PasswordExpired
		"Is user enabled? " + $get_aduser.Enabled
		"Is user Locked Out? " + $get_aduser.LockedOut

		$group_membership = Get-ADPrincipalGroupMembership $username

		""
		"Group Membership:"
		"----------------"
		$group_membership.Name

		# now display all user properties
		$get_aduser
}

catch
{
		$_
}

Rate

You rated this post out of 5. Change rating

Share

Share

Rate

You rated this post out of 5. Change rating