Searching through Active-Directory on Windows 2008 Server Core R2

Searching through Active-Directory can be done using the DirectorySearcher. First we need to connect to Active-Directory.


PS > $Connection = "LDAP://Server1/DC=APA,DC=CORP"
PS > $AD = [adsi] $Connection

We then create a new object containing the Searcher.


PS > $Searcher = New-Object System.DirectoryServices.DirectorySearcher $AD

In order to search through Active-Directory we have to specify a filter that tells the searcher what kind of information we wnat to look up.
First we define which objectClass we want to search through and then we specify the criterias. First we’ll search for a specicif Group.


PS > $Searcher.Filter = '(&(objectClass=Group)(name=NewGroup))'
PS > $Group = ($Searcher.FindOne()).GetDirectoryEntry()
PS > $Group


distinguishedName : {CN=NewGroup,OU=NewOU,DC=APA,DC=CORP}
Path              : LDAP://Server1/CN=NewGroup,OU=NewOU,DC=APA,DC=CORP

If we instead want to search for All groups we can specify this in the searcher.


PS > $Searcher.Filter = '(objectClass=Group)'
PS > $AllGroups = $Searcher.FindAll()
PS > $AllGroups

Path                                    Properties
----                                    ----------
LDAP://Server1/CN=Administrators,CN=... {admincount, iscriticalsystemobject,...
LDAP://Server1/CN=Users,CN=Builtin,D... {iscriticalsystemobject, samaccountn...
LDAP://Server1/CN=Guests,CN=Builtin,... {iscriticalsystemobject, samaccountn...
LDAP://Server1/CN=Print Operators,CN... {admincount, iscriticalsystemobject,...

We can also present the returned information in a variaty of ways, using ForEach-Object CmdLet.


PS > $AllGroups | ForEach { $_.GetDirectoryEntry() }


distinguishedName : {CN=Administrators,CN=Builtin,DC=APA,DC=CORP}
Path              : LDAP://Server1/CN=Administrators,CN=Builtin,DC=APA,DC=CORP

distinguishedName : {CN=Users,CN=Builtin,DC=APA,DC=CORP}
Path              : LDAP://Server1/CN=Users,CN=Builtin,DC=APA,DC=CORP

distinguishedName : {CN=Guests,CN=Builtin,DC=APA,DC=CORP}
Path              : LDAP://Server1/CN=Guests,CN=Builtin,DC=APA,DC=CORP

distinguishedName : {CN=Print Operators,CN=Builtin,DC=APA,DC=CORP}
Path              : LDAP://Server1/CN=Print Operators,CN=Builtin,DC=APA,DC=CORP

If we instead want to search for a User-Object, we can specify this in the Filter.


PS > $Searcher.Filter = '(&(objectClass=User)(name=jeapic))'
PS > $User = ($Searcher.FindOne()).GetDirectoryEntry()
PS > $User


distinguishedName : {CN=jeapic,OU=NewOU,DC=APA,DC=CORP}
Path              : LDAP://Server1/CN=jeapic,OU=NewOU,DC=APA,DC=CORP

Seraching for all Users is done as shown below


PS > $Searcher.Filter = '(objectClass=User)'
PS > $AllUser = $Searcher.FindAll()
PS > $AllUser

Path                                    Properties
----                                    ----------
LDAP://Server1/CN=Administrator,CN=U... {admincount, logonhours, iscriticals...
LDAP://Server1/CN=Guest,CN=Users,DC=... {iscriticalsystemobject, samaccountn...
LDAP://Server1/CN=SERVER1,OU=Domain ... {primarygroupid, iscriticalsystemobj...
LDAP://Server1/CN=krbtgt,CN=Users,DC... {admincount, countrycode, samaccount...
LDAP://Server1/CN=Client1,CN=Compute... {primarygroupid, iscriticalsystemobj...
LDAP://Server1/CN=SERVER2,CN=Compute... {primarygroupid, iscriticalsystemobj...
LDAP://Server1/CN=jeapic,OU=NewOU,DC... {primarygroupid, mail, displayname, ...

And last, searching for computers in Active-Directory, first we’ll search for one Computer


PS > $Searcher.Filter = '(&(objectClass=Computer)(name=Client1))'
PS > $Computer = ($Searcher.FindOne()).GetDirectoryEntry()
PS > $Computer


distinguishedName : {CN=Client1,CN=Computers,DC=APA,DC=CORP}
Path              : LDAP://Server1/CN=Client1,CN=Computers,DC=APA,DC=CORP

And finally, searching for All Computers.


PS > $Searcher.Filter = '(objectClass=Computer)'
PS > $AllComputer = $Searcher.FindAll()
PS >
PS > $AllComputer

Path                                    Properties
----                                    ----------
LDAP://Server1/CN=SERVER1,OU=Domain ... {primarygroupid, iscriticalsystemobj...
LDAP://Server1/CN=Client1,CN=Compute... {primarygroupid, iscriticalsystemobj...
LDAP://Server1/CN=SERVER2,CN=Compute... {primarygroupid, iscriticalsystemobj...

Below is the code used in this Post


$Connection = "LDAP://Server1/DC=APA,DC=CORP"
$AD = [adsi] $Connection

$Searcher = New-Object System.DirectoryServices.DirectorySearcher $AD
$Searcher.Filter = '(&(objectClass=Group)(name=NewGroup))'

$Group = ($Searcher.FindOne()).GetDirectoryEntry()
$Group

$Searcher.Filter = '(objectClass=Group)'

$AllGroups = $Searcher.FindAll()
$AllGroups | ForEach { $_.GetDirectoryEntry() }

$Searcher.Filter = '(&(objectClass=User)(name=jeapic))'

$User = ($Searcher.FindOne()).GetDirectoryEntry()
$User

$Searcher.Filter = '(objectClass=User)'

$AllUser = $Searcher.FindAll()

$Searcher.Filter = '(&(objectClass=Computer)(name=Client1))'

$Computer = ($Searcher.FindOne()).GetDirectoryEntry()
$Computer

$Searcher.Filter = '(objectClass=Computer)'

$AllComputer = $Searcher.FindAll()
$AllComputer

Rating 3.00 out of 5
[?]
  1. Oskar
    February 4th, 2009 at 13:14 | #1

    I think this post was really really helpful.

  2. March 11th, 2011 at 00:22 | #2

    Great shit man!

    Keep up the good work ;)

    Time for a beer?

  1. No trackbacks yet.

Comment Spam Protection by WP-SpamFree