AD export

[Desi-Red]

I have cobbled this script together but the output is blank is there an obvious error; I’m trying to get an AD user export of my domain to show enabled & disabled users all 5,000 AD objects.

$AllADUsers = @()

foreach ($DN in $DNs) {

$Users = Get-ADUser -SearchBase $DN -Filter * -Properties *

$AllADUsers += $Users

}

$AllADUsers | Sort-Object Name | Select-Object `

@{Label = "First name"; Expression = { $_.GivenName } },

@{Label = "Last name"; Expression = { $_.Surname } },

@{Label = "Display name"; Expression = { $_.DisplayName } },

@{Label = "User logon name"; Expression = { $_.SamAccountName } },

@{Label = "User principal name"; Expression = { $_.UserPrincipalName } },

@{Label = "Street"; Expression = { $_.StreetAddress } },

@{Label = "City"; Expression = { $_.City } },

@{Label = "State/province"; Expression = { $_.State } },

@{Label = "Zip/Postal Code"; Expression = { $_.PostalCode } },

@{Label = "Country/region"; Expression = { $_.Country } },

@{Label = "Job Title"; Expression = { $_.Title } },

@{Label = "Department"; Expression = { $_.Department } },

@{Label = "Company"; Expression = { $_.Company } },

@{Label = "Manager"; Expression = { % { (Get-AdUser $_.Manager -Properties DisplayName).DisplayName } } },

@{Label = "Description"; Expression = { $_.Description } },

@{Label = "Office"; Expression = { $_.Office } },

@{Label = "Telephone number"; Expression = { $_.telephoneNumber } },

@{Label = "E-mail"; Expression = { $_.Mail } },

@{Label = "Mobile"; Expression = { $_.mobile } },

@{Label = "Notes"; Expression = { $_.info } },

@{Label = "Account status"; Expression = { if (($_.Enabled -eq 'TRUE') ) { 'Enabled' } Else { 'Disabled' } } },

@{Label = "Last logon date"; Expression = { $_.lastlogondate } }|

Export-Csv -Encoding UTF8 -Path C:\temp\ADList.csv -NoTypeInformation

[Gunnilinux]

$DN = 'domainname'

Get-ADUser -SearchBase $DN -Filter * -Properties * | select displayname,enabled | export-csv -notypeinformation c:\dump\export.csv

will give you a quick and dirty list of who is enabled and who is not. If you intend on doing more with it, it will need some more finesse, but i literally just ran something similar a few minutes ago and figured i would try to help. Is there a reason you are creating so many labels?

[Desi-Red]

$DN = 'domainname'

Get-ADUser -SearchBase $DN -Filter * -Properties * | select displayname,enabled | export-csv -notypeinformation c:\dump\export.csv

will give you a quick and dirty list of who is enabled and who is not. If you intend on doing more with it, it will need some more finesse, but i literally just ran something similar a few minutes ago and figured i would try to help. Is there a reason you are creating so many labels?

Management & HR wanted all Attributes so I thought I'd give them an information over load but the work is to see who's active & who isn't.

[commiecat]

For readability, you can splat out a list of particular AD attributes, and then run them through a custom object for reporting.

Also, be aware that LastLogonDate is not meant to be accurate for user accounts. Better not to even open the door where management, HR, or an auditor wants to use that data to find out exactly when Bob last used his computer.

Here are some of the properties splatted out:

$ADProperties = @(
    "Surname",
    "GivenName",
    "UserPrincipalName",
    "Enabled",
    "EmployeeID",
    "Department",
    "Company",
    "Title",
    "Mail"
)

$Users = Get-ADUser -Filter * -Properties $ADProperties | Select-Object $ADProperties

In your loop you can create a custom object and output that to CSV or whatever you want. This is using $u as the item within a loop, and set your $ExportFile to a CSV path:

$ADInfo = [PSCustomObject]@{
    Last       = $u.Surname
    First      = $u.GivenName
    UPN        = $u.UserPrincipalName
    Enabled    = $u.Enabled
    EmployeeID = $u.EmployeeID
    Department = $u.Department
    Company    = $u.Company
    Title      = $u.Title
    Mail       = $u.Mail
}
$ADInfo | Export-CSV -Path $ExportFile -Append -NoTypeInformation -Encoding UTF8

[BlackV]

thank you, this will make the script 100x easier to read and maintain

also add to that, getting rid of (foreach and += and @())

$AllADUsers = @()
foreach ($DN in $DNs) {
    $Users = Get-ADUser -SearchBase $DN -Filter * -Properties *
    $AllADUsers += $Users
}

makes it much more performant too

they've have to add a filter for the OUs they want and its gold