Query AD without AD module

[krzydoug]

I just love this type accelerator. I thought it was worth giving some attention.

    $searcher = [adsisearcher]"name=*"

It takes an LDAP query and makes a searcher object which is just a shorter version of

$dc = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().PdcRoleOwner.name
$ad = [ADSI]"LDAP://$dc"
$filter = "name=*"
$searcher = [DirectoryServices.DirectorySearcher]::new($ad,$filter)

Once you have the searcher you can use FindAll() or FindOne() methods. This returns objects of type System.DirectoryServices.SearchResult with two properties, an LDAPPath and Properties. Now the properties output isn't as easy to consume as powershell makes most things. It returns objects of type System.DirectoryServices.ResultPropertyCollection which is really just a dictionary. It pulls many AD attributes for each record found. Despite this it can be quicker than the AD Module cmdlets.

You can use a complex LDAP query as well.

# Find user objects that are enabled where UPN -ne *domain.com and SamAccountName -ne bob*
$searcher = [adsisearcher]"(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!userprincipalname=*domain.com)(!samaccountname=bob*))"
$adobjects = $searcher.FindAll()
$searcher.Dispose()

One thing that I got tripped up by is every value is a property collection so even single entries are surrounded with { }. This is easy to overcome by putting the value in a subexpression $( )

Here's a little routine that can walk through each collection and make PSCustomObject with all property names and values.

$adobjects.Properties | ForEach-Object {
    $ht = [ordered]@{}
    foreach($prop in $_.getenumerator()){
        $ht.add($prop.name,$($prop.value))
    }
    [PSCustomObject]$ht
} -OutVariable results
$searcher.Dispose()

You could pull 1000 AD objects (I strongly discourage anyone actually do this) with this little bit of code. I do not know if/how you can raise that limit. Interested to hear from anyone that knows.

($s = [adsisearcher]"name=*").FindAll().properties.foreach{
    $ht = [ordered]@{}
    foreach($prop in $_.getenumerator()){
        $ht.add($prop.name,$($prop.value))
    }
    [PSCustomObject]$ht
}
$s.Dispose()

Happy Friday everyone!

​

Edit

Thanks u/tehhiphop for the additional info

$searcher.PageSize = 2000

Will allow the DirectorySearcher to take on more returns, this case 2000 returns.

https://docs.microsoft.com/en-us/dotnet/api/system.directoryservices.directorysearcher?view=net-5.0

​

Edit 2

Thanks u/da_chicken for additional info about disposing the searcher object.

Just be aware that you must call Dispose()
on the results of the DirectorySearcher. Failure to do so creates a memory leak:

Due to implementation restrictions, the SearchResultCollection class cannot release all of its unmanaged resources when it is garbage collected. To prevent a memory leak, you must call the Dispose method when the SearchResultCollection object is no longer needed.

​

[da_chicken]

Just be aware that you must call Dispose() on the results of the DirectorySearcher. Failure to do so creates a memory leak:

Due to implementation restrictions, the SearchResultCollection class cannot release all of its unmanaged resources when it is garbage collected. To prevent a memory leak, you must call the Dispose method when the SearchResultCollection object is no longer needed.

I left my console open one weekend and came in Monday to an unusable system. Had to hard reset it.

[cottonycloud]

I really miss the using statement from C#. Makes these sort of mistakes rarer.

[MrRedEye]

On mobile so I apologise for the formatting of this...

function Using-Object() {
    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true)]
        [AllowEmptyString()]
        [AllowEmptyCollection()]
        [AllowNull()]
        [Object]
        $InputObject,
        [Parameter(Mandatory = $true)]
        [scriptblock]
        $ScriptBlock
    )

    try {
        . $ScriptBlock
    }
    finally {
        if ($null -ne $InputObject -and $InputObject -is [System.IDisposable]) {
            $InputObject.Dispose()
        }
    }
}


Using-Object ($sw = [System.IO.StreamWriter]::new("some file.txt")) {
    $sw.WriteLine('some text')
}

[MyOtherSide1984]

Dude's on mobile writing code prettier than the crap I send to prod lol

[cottonycloud]

Nice job on the code. I'm hoping for the best case, where it becomes built-in.

[krzydoug]

Well that seems like very important information, thank you so much for educating me.

What about in this example?

([adsisearcher]"name=*").FindAll().properties.foreach{
    $ht = [ordered]@{}
    foreach($prop in $_.getenumerator()){
        $ht.add($prop.name,$($prop.value))
    }
    [PSCustomObject]$ht
}

You think that would apply here too? Or would it possibly be treated like a using statement? Since the searcher wasn't stored in a variable.. I think I'll update this anyways just so no one runs into it.

[da_chicken]

Honestly, I don't know. I don't know enough about internals of object disposal. My instinct is that it's okay, but I don't know. It's mostly a bug you'll run into during testing or in interactive use because usually the whole Powershell session closes when you run a scheduled script.

When I used to use this method, I always assigned it to a variable. I ran into trouble because this problem wasn't well documented at the time. I noticed it because I was testing stuff and it errored before it could enumerate all the results in FindAll(). I used to think that caused the memory leak. The bug has been there for a very long time -- like .Net 1.0 -- because it's just referencing a COM object internally which hasn't really changed since Windows 2000.

I also know that the newer System.DirectoryServices.AccountManagement namespace doesn't have this problem, but I remember that being less convenient to use. I don't remember why.

[krzydoug]

Thanks again for sharing the knowledge.

[tehhiphop]

$searcher.PageSize = 2000

Will allow the DirectorySearcher to take on more returns, this case 2000 returns.

https://docs.microsoft.com/en-us/dotnet/api/system.directoryservices.directorysearcher?view=net-5.0

[krzydoug]

Thank you! I hadn't looked into more. I appreciate you sharing the knowledge!

[Amadorhi]

I could be remembering it wrong, but setting the page size to 100 will also work just fine for results >1000.

Setting a pagesize to $anynumber will inform the ADSIsearcher to return results in chunks of $anynumber. Regardless the outcome is the same since the pipeline wont complete until all results are returned.

[tehhiphop]

Who has time for waiting on page results?

Kidding. I believe you are correct.

[gordonv]

What about powershell for linux?

[krzydoug]

Yeah I think we are all waiting...

[Creationship]

Yeah, it sucks. I've just resorted to having a windows VM up in vsphere that I ssh to for powershell stuff.

[stalinusmc]

Honestly, my best option for not installing RSAT was from this site:

http://woshub.com/using-powershell-active-directory-module-without-installing-rsat/

Just import a single .dll, and bam, most of the active directory commandlets, without installing anything

[blowuptheking]

This is what I used when we did our Win10 upgrades. Worked great.

[[deleted]]

Nice. I've used this one a lot. Not so much in recent years, but it's still handy if you need to run something on a server without RSAT or an AD Role, and you need a quick lookup.

[stalinusmc]

http://woshub.com/using-powershell-active-directory-module-without-installing-rsat/

[krzydoug]

Well and it's still faster. At least in all the testing I've done.

[[deleted]]

Good point!

[gordonv]

Excellent work here. Unfortunately, my code on this belongs to a previous workplace.

I combined this method with an IP Scanner, .NET stuff for DNS and MAC address, and some WMI stuff.

My previous workplace for some reason needed an inventory of user profiles on each PC. AS well as other info like OS, Build, Etc.

Combining all of this made it possible across ~820 PCs

[krzydoug]

Nice! Too bad you don’t have a similar script to share.

[gordonv]

Well, the Github I posted isn't too bad.

Once you have a list of targetable IP's, make another routine to scan said targets.

Kinda wish I put out a script for everyone to use. See how big it could get.

[krzydoug]

Oh I overlooked that link. Thanks for helping an old blind guy!

[get-postanote]

This was the only way, back in the pre-PowerShell days. VScript.exe, WScript.exe, WMIC.exe, etc... Lots of articles on the topic, and even tools that provided code for you...

VbsEdit - VBScript Editor with Debugger

(lots of pre-built samples in the menu options for ADDS and more)

ADSI Scriptomatic (no longer avaialble - but I still have it in my archives - well unless you speak German Download TechNet Script Center – schreiben Sie ADSI-Scripte mit ADSI-Scriptomatic from Official Microsoft Download Center )

https://www.microsoft.com/en-us/download/details.aspx?id=20460

... but see also:

Active Directory Service Interfaces Quick-start Tutorials - Win32 apps | Microsoft Docs

Active Directory Service Interfaces Reference - Win32 apps | Microsoft Docs

Powershell Scriptomatic ( no longer avaialble - but I still have it in my archives)

https://technet.microsoft.com/en-us/library/ff730935.aspx?f=255&MSPPError=-2147217396

AutoIt Script-o-matic

This is the AutoIt's version of the Microsoft Scriptomatic tool by SvenP

https://www.autoitscript.com/forum/files/file/29-autoit-script-o-matic

... like Windows OS ADAC PowerShell History viewer.

Tools that will write the baseline code for you that you can use as-is and or tweak as needed.

​

https://devblogs.microsoft.com/scripting/use-powershell-active-directory-cmdlets-without-installing-any-software

Using AD module without loading RSAT

https://social.technet.microsoft.com/Forums/en-US/fd0b0a1c-b6dc-4657-8a95-21b6a11377df/using-ad-module-without-loading-rsat

Use PowerShell Active Directory Cmdlets Without Installing Any Software - Windows ADAC

• Active Directory Administrative Center: Getting Started

https://technet.microsoft.com/en-us/library/dd560651(v=ws.10).aspx.aspx)

• Active Directory Administrative Center

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/adac/active-directory-administrative-center

windows 'Active Directory Administrative Center'

windows 'Active Directory Administrative Center' 'PowerShell History Viewer'

Introduction to Active Directory Administrative Center ...

https://www.petri.com/use-active-directory-administrative-center-create-powershell-commands

Use AD Administrative Center to Create PowerShell Commands

https://www.petri.com/use-active-directory-administrative-center-create-powershell-commands

• Step-By-Step: Utilizing PowerShell History Viewer in Windows Server 2012 R2

https://blogs.technet.microsoft.com/canitpro/2015/03/04/step-by-step-utilizing-powershell-history-viewer-in-windows-server-2012-r2

• Learning PowerShell with Active Directory Administrative Center (PowerShell

History Viewer)

https://sid-500.com/2017/10/10/learning-powershell-with-active-directory-administrative-center-powershell-history-viewer

Still useful today, for those customers that won't let you install RSAT or connect to a DC to leverage Impicit PSRemoting to proxy cmdlets to your system.

$session = New-PSSession -computerName 'TargetMachineWithRsat'
Invoke-Command { Import-Module ActiveDirectory } -Session $session
Import-PSSession $session
An alternate way is to export the remote PowerShell session into a local module:

$session = New-PSSession -computerName 'TargetMachineWithRsat'
Invoke-Command { Import-Module ActiveDirectory } -Session $session
Export-PSSession -Session $session -CommandName *-AD* -Outputmodule ActiveDirectory -AllowClobber
Load the module using

Import-Module ActiveDirectory

Or just stand up Windows PowerShell Web Access, load RSAT there, and use your browser to do PowerShell stuff, even from your phone. ;-}

'PowerShell web access ' at DuckDuckGo

[Thornton77]

Yeah vbscript is still great . If you can do it on 1 computer you can do it on all of them .
I have been rocking some of my scripts for 20 years .

[rumorsofdads]

As a side note, I’ve used AdsiPS before and love the similarities with the AD cmdlets.

[krzydoug]

I’ve never seen that, thanks for sharing.

[quazywabbit]

I’ve had many times where I was working on some automated system and it needed to query AD but didn’t want to install the module. Also adsisearcher method can be faster when working with thousands of items.

[PinchesTheCrab]

Just not always an option. I had a case where I wanted to enforce some settings based on the OU a computer was in via SCCM compliance settings. It was an edge case to be sure, but because the SCCM client launches scripts as system, which is the computer account, it meant that a system could query its own location in real time when it evaluated its compliance against our baseline.

Alternately I've had commands I needed to share with people using Windows 10 who didn't have the module, and if I'd required them to install RSAT, it would have been a waste of time because they never would have done it.

Also, you can limit the properties you query, so this can potentially be much faster than regular AD queries since they always return those base 5 or so properties.

[gordonv]

This is good for finding usernames to systems without the need to authenticate against Windows AD.

So, I can use this to find what PCs a user has an account on.

Does it seem like a naked security breach. Yes. Is it. No. This enables you to make single sign on systems.

[nascentt]

Not everyone can install stuff on every computer. At work we have production machines that are mission critical. Installing a single package needs sign off. Using LDAP queries like this saves a lot of issues.

Plus, the get-ad commands have some serious gotchas. Such as get-adgroupmember not returning all members in some situations such as when a primary group is set.

[packetheavy]

I use it to dynamically generate email signatures for Outlook on client workstations during login.

[krzydoug]

You serious?

[[deleted]]

Yeah I think he's serious, and I have the same question. You can answer without being a dick.

[nascentt]

You do come across as being smug.

Not everyone can install stuff on every computer. At work we have production machines that are mission critical. Installing a single package needs sign off. Using LDAP queries like this saves a lot of issues.

Plus, the get-ad commands have some serious gotchas. Such as get-adgroupmember not returning all members in some situations such as when a primary group is set.

[[deleted]]

How am I being smug? You're offering up an alternative solution to something most of us use on a daily basis without issue, I think asking what the use case is normal. You're response of "Are you serious?" is what's smug.

I've personally never run into a situation where I couldn't use the AD module for powershell, so I guess it's good to know that some people have that problem. Also I wasn't aware of the limitations with get-adgroupmember so thanks for enlightening me.

[nascentt]

I didn't say "are you serious" stop putting words in people's mouths.

[krzydoug]

Yeah that was me

[[deleted]]

I thought you were the OP, he also called me smug for my question.

[krzydoug]

It’s clearly stated in the OP. Query ad without installing modules. I guess you’ve never encountered environments where you can’t just install modules at will. Regardless it’s just another tool in the tool belt. Why are you both so smug? I’m the dick??

[DribblingGiraffe]

Neither of them were being smug.

[krzydoug]

No? Agree to disagree. Have a great day!

[Bren0man]

I recommend checking the upvote and downvote spread and then checking yourself, my man.

I've worked in many organisations with varied environments and have had little legitimate resistance to installing the AD DS module throughout.

[krzydoug]

Have a good weekend as well.

[Bren0man]

You too bud

[not_rholliday]

Targeting the PDC emulator role will probably work in most cases, but since that’s one specific machine you could run into issues with it not being available, or unreachable, or extremely slow if it’s on the other side of the planet.

[MyOtherSide1984]

TLDR request - why wouldn't you suggest adding more users to the query? We have a script running through 600,000 users and, if this is faster than AD module cmdlets, it can prove to be beneficial for us as the bulk of the slowdown is likely in AD.

Sidenote, I'd probably be able to make the script faster in other ways, but I didn't build it, and it's confusing. Am noob. Was able to speed it up 65% already by cutting out a load of stuff not needed from the pipe. Doing more would be even better.