Skip to main content

Searching AD using .net and a GC

Searching AD using .net and a Global Catalog (GC) Server

Although I have been recently been exploring the world of R2 and AD-cmdlts, I have re-visited .net to search a the whole forest in one quick step.  As A GC holds a subset of information on all objects in the forest, we can query any GC in the forest to return these values.  Here, I am doing a search for a specific UPN, but the filter can inculde any attribute stored on the GC.

$upn= ""
$Forest = [System.DirectoryServices.ActiveDirectory.forest]::getcurrentforest()
$GC = $forest.FindGlobalCatalog()
$searcher = $gc.GetDirectorySearcher()
$searcher.filter = "(userprincipalname=$upn)"
$Results = $Searcher.FindAll()

The rest of the script is the same as how we ended up in my AD Searcher

You might not want to find any GC in the forest, you might want to only choose one from a particular site. As $forest.FindGlobalCatalog() has an option for this, the command simply becomes

$GC = $forest.FindGlobalCatalog("Sitename")
I'm a big fan of keeping things concise, and powershell allows you to do this quite easily.  We can take lines 2, 3 and 4 from the above script and do it all in one go ...

$searcher = [System.DirectoryServices.ActiveDirectory.forest]::getcurrentforest().FindGlobalCatalog().GetDirectorySearcher()

As before, you have the other search options you can configure, below is an output of the $searcher object ...

PS U:\> $searcher

CacheResults : True
ClientTimeout : -00:00:01
PropertyNamesOnly : False
Filter : (objectClass=*)
PageSize : 0
PropertiesToLoad : {}
ReferralChasing : External
SearchScope : Subtree
ServerPageTimeLimit : -00:00:01
ServerTimeLimit : -00:00:01
SizeLimit : 0
SearchRoot : System.DirectoryServices.DirectoryEntry
Sort : System.DirectoryServices.SortOption
Asynchronous : False
Tombstone : False
AttributeScopeQuery :
DerefAlias : Never
SecurityMasks : None
ExtendedDN : None
DirectorySynchronization :
VirtualListView :
Site :
Container :

You can set these the same way we set the filter.

NOTE : I have found that PropertiesToLoad is a read only value. The searcher returns all GC attributes. Also SearchRoot is set to the GC server selected.

So, to query the whole forest in one go : (with the rest of the AD searcher script)

$Collection = @()
$upn = ""
$ObjectCategory = "user"
$ObjectProplist = "samaccountname","userprincipalname","mail","whencreated","whenchanged","memberof"

$searcher = [System.DirectoryServices.ActiveDirectory.forest]::getcurrentforest().FindGlobalCatalog().GetDirectorySearcher()
$searcher.filter = "(&(objectCategory=user)(userprincipalname=$upn))"
$Searcher.pagesize = 1000
$Results = $Searcher.FindAll()
foreach ($Object in $Results){
   $Store = "" | select $ObjectProplist
   foreach ($prop in $ObjectProplist){
      switch ($prop){
         lastlogon {trap { $Store.lastlogon = "Last Logon value not valid";continue}&{$lastlogon =[DateTime]::FromFileTime($Object.Properties.lastlogon[0]);$Store.lastlogon = $lastlogon}}
         lastlogontimestamp {trap { $Store.lastlogontimestamp = "Last Logon value not valid";continue}&{$Store.lastlogontimestamp = [DateTime]::FromFileTimeUTC($Object.Properties.lastlogontimestamp[0])}}
         useraccountcontrol {$Store.$prop = $Object.Properties.$prop[0]}
         memberof {trap { $Store.$prop = "null";continue}&{$Store.$prop = [string]::join(",",$($Object.Properties.$prop))}}
         proxyaddresses {trap { $Store.$prop = "null";continue}&{$Store.$prop = [string]::join(",",$($Object.Properties.$prop))}}
         Default {trap { $Store.$prop = $Object.Properties.$prop;continue}&$Store.$prop = $($Object.Properties.$prop).tostring()}}
   $Collection += $Store
$Collection | export-csv "upn.csv" -NoTypeInformation


Popular posts from this blog

PowerShell 3 behavioural change

It's taken me way too long to get into PowerShell 3, I guess opportunity hasn't shown it's self until now and so, here, my V3 journey begins.

I was asked to debug a script that would run fine in PS v2 and not in v3.  The issue was a that a variable length was being checked and was failing in v3.  This is why...

In v2 if a variable is undefined, this test returns false

PS C:\windows\system32> $var.length -eq 0

In v3 the same test returns true....

PS C:\windows\system32> $var.length -eq 0

Not a biggie, but as in this case, a script has broken so something to consider!



Enable Powershell Remoting (WinRM) via Group Policy

I have been doing some testing on enabling WinRM via group policy, being that WinRM is the service that Powershell v2 sets up it remoting capabilities. Here are the GPO settings that you need to configure WinRM ....

set the winrm service to auto start

Computer Configuration \ Policies \ Windows Settings \ Security Settings \ System Services

Windows Remote Management (WS-Management)  set Startup Mode to Automatic

start the service

incorporated in to the above - you may need a restart.

create a winrm listener

Computer Configuration / Policies / Administrative Templates / Windows Components / Windows Remote Management (WinRM) / WinRM Service / Allow automatic configuration of listeners

IPv4 filter: *

* is listen on all addresses, or if you only want a particular IP address to respond use an iprange eg - don't forget that this IP range has to be valid for all hosts that fall in the scope of the GPO you are creating.  You can use -, - …

compare-object in Powershell - comparing mulitple values

I'm starting to use compare-object more and more, and one thing I noticed, is that you can compare 2 objects based on multiple attributes. here is how it is constructed...
Compare-Object -ReferenceObject $object1 -DifferenceObject $object2 -Property a,b,c,d,eIf a,b,c and d are the same, but e is different, compare object will return a difference. In the following example, I use "-eq $null" as a check because by default compare-object returns $null if the objects are the same.
#create an array of objects to check against

$collection = @()
foreach ($entry in ("aaaaa","bbbbb","ccccc","ddddd")){
   $store = "" | select "a","b","c","d","e"
   $store.a = $entry*1
   $store.b = $entry*2
   $store.c = $entry*3
   $store.d = $entry*4
   $store.e = $entry*5
   $collection += $store

#create an object similar to those in the array
$object = "" | select "a","b…