Searching through Active-Directory on Windows 2008 Server Core R2
Searching through Active-Directory can be done using the DirectorySearcher. First we need to connect to Active-Directory.
PS > $Connection = "LDAP://Server1/DC=APA,DC=CORP" PS > $AD = [adsi] $ConnectionWe then create a new object containing the Searcher.
PS > $Searcher = New-Object System.DirectoryServices.DirectorySearcher $ADIn order to search through Active-Directory we have to specify a filter that tells the searcher what kind of information we wnat to look up.
First we define which objectClass we want to search through and then we specify the criterias. First we’ll search for a specicif Group.
PS > $Searcher.Filter = '(&(objectClass=Group)(name=NewGroup))'
PS > $Group = ($Searcher.FindOne()).GetDirectoryEntry()
PS > $Group
distinguishedName : {CN=NewGroup,OU=NewOU,DC=APA,DC=CORP}
Path : LDAP://Server1/CN=NewGroup,OU=NewOU,DC=APA,DC=CORP
If we instead want to search for All groups we can specify this in the searcher.
PS > $Searcher.Filter = '(objectClass=Group)'
PS > $AllGroups = $Searcher.FindAll()
PS > $AllGroups
Path Properties
---- ----------
LDAP://Server1/CN=Administrators,CN=... {admincount, iscriticalsystemobject,...
LDAP://Server1/CN=Users,CN=Builtin,D... {iscriticalsystemobject, samaccountn...
LDAP://Server1/CN=Guests,CN=Builtin,... {iscriticalsystemobject, samaccountn...
LDAP://Server1/CN=Print Operators,CN... {admincount, iscriticalsystemobject,...
We can also present the returned information in a variaty of ways, using ForEach-Object CmdLet.
PS > $AllGroups | ForEach { $_.GetDirectoryEntry() }
distinguishedName : {CN=Administrators,CN=Builtin,DC=APA,DC=CORP}
Path : LDAP://Server1/CN=Administrators,CN=Builtin,DC=APA,DC=CORP
distinguishedName : {CN=Users,CN=Builtin,DC=APA,DC=CORP}
Path : LDAP://Server1/CN=Users,CN=Builtin,DC=APA,DC=CORP
distinguishedName : {CN=Guests,CN=Builtin,DC=APA,DC=CORP}
Path : LDAP://Server1/CN=Guests,CN=Builtin,DC=APA,DC=CORP
distinguishedName : {CN=Print Operators,CN=Builtin,DC=APA,DC=CORP}
Path : LDAP://Server1/CN=Print Operators,CN=Builtin,DC=APA,DC=CORP
If we instead want to search for a User-Object, we can specify this in the Filter.
PS > $Searcher.Filter = '(&(objectClass=User)(name=jeapic))'
PS > $User = ($Searcher.FindOne()).GetDirectoryEntry()
PS > $User
distinguishedName : {CN=jeapic,OU=NewOU,DC=APA,DC=CORP}
Path : LDAP://Server1/CN=jeapic,OU=NewOU,DC=APA,DC=CORP
Seraching for all Users is done as shown below
PS > $Searcher.Filter = '(objectClass=User)'
PS > $AllUser = $Searcher.FindAll()
PS > $AllUser
Path Properties
---- ----------
LDAP://Server1/CN=Administrator,CN=U... {admincount, logonhours, iscriticals...
LDAP://Server1/CN=Guest,CN=Users,DC=... {iscriticalsystemobject, samaccountn...
LDAP://Server1/CN=SERVER1,OU=Domain ... {primarygroupid, iscriticalsystemobj...
LDAP://Server1/CN=krbtgt,CN=Users,DC... {admincount, countrycode, samaccount...
LDAP://Server1/CN=Client1,CN=Compute... {primarygroupid, iscriticalsystemobj...
LDAP://Server1/CN=SERVER2,CN=Compute... {primarygroupid, iscriticalsystemobj...
LDAP://Server1/CN=jeapic,OU=NewOU,DC... {primarygroupid, mail, displayname, ...
And last, searching for computers in Active-Directory, first we’ll search for one Computer
PS > $Searcher.Filter = '(&(objectClass=Computer)(name=Client1))'
PS > $Computer = ($Searcher.FindOne()).GetDirectoryEntry()
PS > $Computer
distinguishedName : {CN=Client1,CN=Computers,DC=APA,DC=CORP}
Path : LDAP://Server1/CN=Client1,CN=Computers,DC=APA,DC=CORP
And finally, searching for All Computers.
PS > $Searcher.Filter = '(objectClass=Computer)'
PS > $AllComputer = $Searcher.FindAll()
PS >
PS > $AllComputer
Path Properties
---- ----------
LDAP://Server1/CN=SERVER1,OU=Domain ... {primarygroupid, iscriticalsystemobj...
LDAP://Server1/CN=Client1,CN=Compute... {primarygroupid, iscriticalsystemobj...
LDAP://Server1/CN=SERVER2,CN=Compute... {primarygroupid, iscriticalsystemobj...
Below is the code used in this Post
$Connection = "LDAP://Server1/DC=APA,DC=CORP"
$AD = [adsi] $Connection
$Searcher = New-Object System.DirectoryServices.DirectorySearcher $AD
$Searcher.Filter = '(&(objectClass=Group)(name=NewGroup))'
$Group = ($Searcher.FindOne()).GetDirectoryEntry()
$Group
$Searcher.Filter = '(objectClass=Group)'
$AllGroups = $Searcher.FindAll()
$AllGroups | ForEach { $_.GetDirectoryEntry() }
$Searcher.Filter = '(&(objectClass=User)(name=jeapic))'
$User = ($Searcher.FindOne()).GetDirectoryEntry()
$User
$Searcher.Filter = '(objectClass=User)'
$AllUser = $Searcher.FindAll()
$Searcher.Filter = '(&(objectClass=Computer)(name=Client1))'
$Computer = ($Searcher.FindOne()).GetDirectoryEntry()
$Computer
$Searcher.Filter = '(objectClass=Computer)'
$AllComputer = $Searcher.FindAll()
$AllComputer
[?]


I think this post was really really helpful.
Great shit man!
Keep up the good work
Time for a beer?