Searching through Active-Directory on Windows 2008 Server Core R2
January 17th, 2009
1 comment
Searching through Active-Directory can be done using the DirectorySearcher. First we need to connect to Active-Directory.
PS > $Connection = "LDAP://Server1/DC=APA,DC=CORP" PS > $AD = [adsi] $ConnectionWe then create a new object containing the Searcher.
PS > $Searcher = New-Object System.DirectoryServices.DirectorySearcher $ADIn order to search through Active-Directory we have to specify a filter that tells the searcher what kind of information we wnat to look up.
First we define which objectClass we want to search through and then we specify the criterias. First we’ll search for a specicif Group.
PS > $Searcher.Filter = '(&(objectClass=Group)(name=NewGroup))'
PS > $Group = ($Searcher.FindOne()).GetDirectoryEntry()
PS > $Group
distinguishedName : {CN=NewGroup,OU=NewOU,DC=APA,DC=CORP}
Path : LDAP://Server1/CN=NewGroup,OU=NewOU,DC=APA,DC=CORP
If we instead want to search for All groups we can specify this in the searcher.
PS > $Searcher.Filter = '(objectClass=Group)'
PS > $AllGroups = $Searcher.FindAll()
PS > $AllGroups
Path Properties
---- ----------
LDAP://Server1/CN=Administrators,CN=... {admincount, iscriticalsystemobject,...
LDAP://Server1/CN=Users,CN=Builtin,D... {iscriticalsystemobject, samaccountn...
LDAP://Server1/CN=Guests,CN=Builtin,... {iscriticalsystemobject, samaccountn...
LDAP://Server1/CN=Print Operators,CN... {admincount, iscriticalsystemobject,...
We can also present the returned information in a variaty of ways, using ForEach-Object CmdLet.
PS > $AllGroups | ForEach { $_.GetDirectoryEntry() }
distinguishedName : {CN=Administrators,CN=Builtin,DC=APA,DC=CORP}
Path : LDAP://Server1/CN=Administrators,CN=Builtin,DC=APA,DC=CORP
distinguishedName : {CN=Users,CN=Builtin,DC=APA,DC=CORP}
Path : LDAP://Server1/CN=Users,CN=Builtin,DC=APA,DC=CORP
distinguishedName : {CN=Guests,CN=Builtin,DC=APA,DC=CORP}
Path : LDAP://Server1/CN=Guests,CN=Builtin,DC=APA,DC=CORP
distinguishedName : {CN=Print Operators,CN=Builtin,DC=APA,DC=CORP}
Path : LDAP://Server1/CN=Print Operators,CN=Builtin,DC=APA,DC=CORP
If we instead want to search for a User-Object, we can specify this in the Filter.
PS > $Searcher.Filter = '(&(objectClass=User)(name=jeapic))'
PS > $User = ($Searcher.FindOne()).GetDirectoryEntry()
PS > $User
distinguishedName : {CN=jeapic,OU=NewOU,DC=APA,DC=CORP}
Path : LDAP://Server1/CN=jeapic,OU=NewOU,DC=APA,DC=CORP
Seraching for all Users is done as shown below
PS > $Searcher.Filter = '(objectClass=User)'
PS > $AllUser = $Searcher.FindAll()
PS > $AllUser
Path Properties
---- ----------
LDAP://Server1/CN=Administrator,CN=U... {admincount, logonhours, iscriticals...
LDAP://Server1/CN=Guest,CN=Users,DC=... {iscriticalsystemobject, samaccountn...
LDAP://Server1/CN=SERVER1,OU=Domain ... {primarygroupid, iscriticalsystemobj...
LDAP://Server1/CN=krbtgt,CN=Users,DC... {admincount, countrycode, samaccount...
LDAP://Server1/CN=Client1,CN=Compute... {primarygroupid, iscriticalsystemobj...
LDAP://Server1/CN=SERVER2,CN=Compute... {primarygroupid, iscriticalsystemobj...
LDAP://Server1/CN=jeapic,OU=NewOU,DC... {primarygroupid, mail, displayname, ...
And last, searching for computers in Active-Directory, first we’ll search for one Computer
PS > $Searcher.Filter = '(&(objectClass=Computer)(name=Client1))'
PS > $Computer = ($Searcher.FindOne()).GetDirectoryEntry()
PS > $Computer
distinguishedName : {CN=Client1,CN=Computers,DC=APA,DC=CORP}
Path : LDAP://Server1/CN=Client1,CN=Computers,DC=APA,DC=CORP
And finally, searching for All Computers.
PS > $Searcher.Filter = '(objectClass=Computer)'
PS > $AllComputer = $Searcher.FindAll()
PS >
PS > $AllComputer
Path Properties
---- ----------
LDAP://Server1/CN=SERVER1,OU=Domain ... {primarygroupid, iscriticalsystemobj...
LDAP://Server1/CN=Client1,CN=Compute... {primarygroupid, iscriticalsystemobj...
LDAP://Server1/CN=SERVER2,CN=Compute... {primarygroupid, iscriticalsystemobj...
Below is the code used in this Post
$Connection = "LDAP://Server1/DC=APA,DC=CORP"
$AD = [adsi] $Connection
$Searcher = New-Object System.DirectoryServices.DirectorySearcher $AD
$Searcher.Filter = '(&(objectClass=Group)(name=NewGroup))'
$Group = ($Searcher.FindOne()).GetDirectoryEntry()
$Group
$Searcher.Filter = '(objectClass=Group)'
$AllGroups = $Searcher.FindAll()
$AllGroups | ForEach { $_.GetDirectoryEntry() }
$Searcher.Filter = '(&(objectClass=User)(name=jeapic))'
$User = ($Searcher.FindOne()).GetDirectoryEntry()
$User
$Searcher.Filter = '(objectClass=User)'
$AllUser = $Searcher.FindAll()
$Searcher.Filter = '(&(objectClass=Computer)(name=Client1))'
$Computer = ($Searcher.FindOne()).GetDirectoryEntry()
$Computer
$Searcher.Filter = '(objectClass=Computer)'
$AllComputer = $Searcher.FindAll()
$AllComputer
[?]
And if we want to remove a user from a Group we can use the Delete() method.
If we want to Delete a User in Active-Directory, we can use the Delete() method.
It’s also possible to retrieve detailed information if we pipe the object to the Format-List CmdLet.
If we want to explore the properties on our Organizational-Unit, we can simply pipe the object to the Format-List CmdLet
And last step, removing an Organizational-Unit. It’s possible to accomplish through the deleteTree() method as shown below.
Nothing strange here, Domain name is APA.CORP and the server is called Server1
Lets connect to the Active-Directory through PowerShell. First we create a connection string.
Below is the code used in this post:
