--- title: "Get-ADObject: Search Active Directory & Generate Reports" description: "Search Active Directory using the Get-ADObject PowerShell cmdlet and generate insightful AD reports for your organization." canonical: "https://adamtheautomator.com/get-adobject/" --- # Get-ADObject: Search Active Directory & Generate Reports > Search Active Directory using the Get-ADObject PowerShell cmdlet and generate insightful AD reports for your organization. Source: https://adamtheautomator.com/get-adobject/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Get-ADObject: Search Active Directory & Generate Reports](https://adamtheautomator.com/wp-content/uploads/2019/11/notebook-1850613_1920.jpg) # Get-ADObject: Search Active Directory & Generate Reports [![](https://secure.gravatar.com/avatar/d0d2f27a9722f2dfe1e0cb0ac68e75dbd5dd01c6f6e7d25440b7a195d4903060?s=192&d=mm&r=g)Kevin Sapp](https://adamtheautomator.com/author/kevinsapp/)5 November 20198 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Active Directory](/tag/active-directory/)[PowerShell](/tag/powershell/) Table of Contents * [Prerequisites/Requirements](#prerequisites-requirements) * [Get-ADObject: It’s Options and Parameters](#get-adobject-it-s-options-and-parameters) * [Learning Project Outline](#learning-project-outline) * [The Scenario](#the-scenario) * [The AD Environment](#the-ad-environment) * [Creating Active Directory Reports using Get-ADObject](#creating-active-directory-reports-using-get-adobject) * [Understanding the Filter Parameter](#understanding-the-filter-parameter) * [Limiting Search Scope using the SearchBase Parameter](#limiting-search-scope-using-the-searchbase-parameter) * [Leveraging the Filter Parameter](#leveraging-the-filter-parameter) * [Outputting AD Objects to a CSV File](#outputting-ad-objects-to-a-csv-file) * [Collecting the Other User Objects](#collecting-the-other-user-objects) * [Finding Disabled Accounts with the LDAP Filter](#finding-disabled-accounts-with-the-ldap-filter) * [The End Result](#the-end-result) * [Summary](#summary) * [Further Reading](#further-reading) Are you looking for a quick way to create an Active Directory (AD) report using PowerShell? You’ve come to the right place!  In this article, you will learn how to create custom reports of user accounts in your AD environment using the `Get-ADObject` cmdlet. Not a reader? Watch this related video tutorial! **_Not seeing the video? Make sure your ad blocker is disabled._** Imagine that you are working at a startup company and learn that the company was given funding by investors to grow the company by hiring new people for several positions. Your manager gives you a request to provide her with a report on the head count for each office to make sure that the workplace has sufficient office space. Normally, you would manually view AD accounts by using the _Active Directory Users and Computers_ (ADUC) application console installed on your desktop computer. However, using ADUC takes on average one minute per new employee to review information for each AD account. You quickly search the Internet for some options and discover that you can automate collecting the AD report data using a PowerShell cmdlet called `Get-ADObject`. In this article, you’ll learn what the `Get-AdObject` PowerShell cmdlet does and how to correctly use this handy AD PowerShell cmdlet to automate report creation. ## Prerequisites/Requirements This article will be a walkthrough using `Get-ADObject`. If you plan to follow along, be sure you have the following prerequisites in place: * Logged onto a domain-joined Windows 10 PC as a user with rights to query AD users * In a Windows Server 2016 or higher Active Directory environment. The lab you’ll be working with in this article is called _mylab.local_. * [Remote Server Administration Tools (RSAT) package](https://www.microsoft.com/en-us/download/details.aspx?id=45520) > _Quick tip: If you don’t have RSAT installed and you’re on the latest version of Windows 10, you can quickly install it using the PowerShell command `Install-WindowsFeature -Name RSAT-AD-PowerShell`._ ## Get-ADObject: It’s Options and Parameters The main purpose of the `Get-ADObject` cmdlet is to connect to an AD domain controller or Lightweight Directory Service (LDS) server and return information about various Active Directory objects. To query AD objects, the `Get-ADObject` cmdlet has a number of parameters allowing you to connect to different domain controllers, search a global catalog, authenticate via alternate credentials and also specify LDAP filters and limit objects returned by scope for a search base. > _Note that, by default, the `Get-ADObject` cmdlet will only return a single set of 1000 AD objects. The best way to override this configuration is to use the `ResultSetSize` parameter specifying the maximum number of objects to return. If you want to receive all of the objects, set this parameter to $Null (null value). Then you can use Ctrl+C to stop the query and return of objects._ For more information about `Get-ADObject`‘s parameters, check out the `Get-ADObject` help documentation. ## Learning Project Outline This article will teach you the `Get-ADObject` PowerShell cmdlet by applying it to a real-world scenario. You’ll learn by approaching the scenario explained in the introductory paragraphs. ### The Scenario In this article, you’re going to learn how to use `Get-ADObject` to generate two reports to send to your manager. The first report will break down all user accounts in each department. The boss would like separate CSV files for each department. The second task will query all disabled user accounts in a specific OU and it’s child OUs. By the end of the article, you’ll be able to generate CSV files that look like the following: ![AD user accounts by OU](https://adamtheautomator.com/wp-content/uploads/2020/06/CSV-files-that-look-like-the-following.png) AD user accounts by OU ![Disabled user accounts](https://adamtheautomator.com/wp-content/uploads/2020/06/CSV-files-that-look-like-the-following1.png) Disabled user accounts ### The AD Environment The Active Directory organizational unit (OU) structure you’ll be working with in this article looks like below. You can see that we have a parent _Department_ OU with three child OUs called _Accounting_, _Marketing_ and _IT_. Inside of each of those child OUs are two grandchild OUs called _Users_ and _Computers_. * Department (OU) – Accounting (OU) – Users – Computers – Marketing (Nested OU) – Users – Computers – IT (Nested OU) – Users – Computers > _Shortcut: You can build these OUs with the `New-ADOrganizationalUnit` PowerShell cmdlet. For a script to make quick work of this check out the [Create-OU-Structure.ps1](https://github.com/CodeDuet/powershell/blob/master/set-aduser_article/Create-OU-Structure.ps1) script._ You’ll also be working with dozens of different AD user accounts located inside of each of the _Users_ OUs as shown below. These names were chosen at random. * Accounting (_accountant\_user1-5_) * Marketing (_market\_user\_user1-5_) * IT (_it\_user1-5_) > _Shortcut: If you’d like to quickly create these user accounts inside of the aforementioned OUs, download and run the [Populate-AD\_Accounts.ps1](https://github.com/CodeDuet/powershell/blob/master/set-aduser_article/Populate-AD_Accounts.ps1) script._ ## Creating Active Directory Reports using Get-ADObject Enough introduction and background information on `Get-ADObject.` Let’s finally get down to learning how this PowerShell cmdlet works in the real world! In this first example, you’re tasked with providing your manager a CSV file with a report for all user accounts that exist in the Accounting, Marketing and IT department OUs. ### Understanding the Filter Parameter The only required parameter of the `Get-ADObject` PowerShell cmdlet is `Filter`. This is a parameter is one way to limit the number of objects returned. Since it’s a required parameter, you must define it even if you’d like to return all objects using a wildcard character (`*`). This tells `Get-ADObject` to return all objects. The simplest example of using the `Filter` parameter is to return all objects in an entire AD domain like below. ```powershell PS51> Get-ADObject -Filter * ``` You’ll see the `Filter` parameter used to both return all objects and to limit the scope of returned objects throughout this article. > _For more information on the `Filter` parameter’s syntax, run `[Get-Help](https://adamtheautomator.com/powershell-get-help/) about_ActiveDirectory_Filter` in the PowerShell console._ ### Limiting Search Scope using the SearchBase Parameter The example you’re working with is a perfect use case for `Get-ADObject`‘s `SearchBase` parameter. The `SearchBase` parameter allows you to limit the search query and thus objects returned via `Get-ADObject` by limiting the scope to a particular OU. By limiting scope, this reduces the time that it takes for `Get-ADObject` to run by excluding other OUs in AD and only targeting the specific OU that is relevant for retrieving the data that you need. The `SearchBase` parameter value is defined via a [distinguished name (DN)](https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ldap/distinguished-names) in the form of `OU=,DC=,DC=`. For example, to only find objects in the `Department` OU in a domain called _mylab.local_, the DN would look like `OU=Department,DC=mylab,DC=local`. In this example, pull out all the AD users in the parent Department OU and all child OUs like below. This will return _all_ users in the Department OU and in _all_ child OUs. ```powershell PS51> Get-ADObject -Filter * -SearchBase 'OU=Department,DC=mylab,DC=local' ``` ### Leveraging the Filter Parameter As of now, you’re able to query all user objects in the Department OU and all child OUs. But that’s not required at this point. Instead, let’s just pull out all of the Accounting users first. One way to do that is to actually use the `Filter` parameter rather than just providing a wildcard value. To limit the results, use the `Filter` value of `Department -eq 'Accounting'`. This limits the results to only those objects in the Department OU that have an AD department attribute set to _Accounting_. You can see below that you’re storing all objects in the `$accounting_users` variable. This will be used later. ```powershell PS51> $accounting_users = Get-ADObject -SearchBase 'OU=Department,DC=mylab,DC=local' -Filter {Department -eq "Accounting"} ``` ### Outputting AD Objects to a CSV File Now that `$accounting_users` contains all of the applicable objects, you can pipe only the `Name` and `Department` properties for each object to the [`Export-Csv`](https://adamtheautomator.com/export-csv/ "Export-Csv") cmdlet. This cmdlet creates a new CSV file and stores each AD object as a row. ```powershell PS51> $accounting_users | Select-Object -Property Name,Department | Export-Csv -NoTypeInformation -Path C:\users\$env:username\Desktop\report_accounting_users.csv ``` You should now have a CSV file called _report\_accounting\_users.csv_ on your desktop looking like the screenshot below. ![report\_accounting\_users.csv ](https://adamtheautomator.com/wp-content/uploads/2020/06/desktop-looking-like-the-screenshot-below..png) report\_accounting\_users.csv ## Collecting the Other User Objects Now that you know the basics of how to use `Get-ADObject` to find AD users, extend that to find the user objects for the other departments. You will use the same general concept as before. First, find all of the AD users in the San Francisco office. ```powershell #Get report of all department users that work in the San Francisco Office $sf_users = Get-ADObject -SearchBase 'OU=Department,DC=mylab,DC=local' -Filter { physicalDeliveryOfficeName -eq 'San Francisco' } -Properties Name,physicalDeliveryOfficeName,Department $sf_users | Select Name,physicalDeliveryOfficeName,Department | Export-Csv -NoTypeInformation -Path C:\users\$env:username\Desktop\report_sanfrancisco_office_users.csv ``` ![report\_sanfrancisco\_office\_users.csv](https://adamtheautomator.com/wp-content/uploads/2020/06/sf1.png) report\_sanfrancisco\_office\_users.csv Next, find all users that work in the Florida office. This example is a bit different because you’re using the `Select-Object` cmdlet’s [calculated properties](https://mcpmag.com/articles/2017/01/19/using-powershell-calculated-properties.aspx). This allows you to transform the object property name from simply `st` that comes from `Get-ADObject` to a more descriptive `State`. ```powershell #Get report of all department users that work in the Florida Office $fl_users = Get-ADObject -SearchBase 'OU=Department,DC=mylab,DC=local' -Filter { St -eq 'FL' } -Properties Name,St $fl_users | Select-Object -Property Name,@{N='State'; E={$_.st}} | Export-Csv -NoTypeInformation -Path C:\users\$env:username\Desktop\report_florida_state_users.csv ``` ![report\_florida\_state\_users.csv](https://adamtheautomator.com/wp-content/uploads/2020/06/more-descriptive-State.png) report\_florida\_state\_users.csv Finally, collect all of the IT users. This time, instead of using the Department AD attribute, use the `Filter` parameter to find all objects with a name starting with _it_. ```powershell #Get report of all select department users that have a name that contains "user" $select_users = Get-ADObject -SearchBase 'OU=Department,DC=mylab,DC=local' -Filter {Objectclass -eq 'user' -and name -like 'it*'} -Properties Name,Department,st $select_users | Select-Object -Property Name,Department,@{N=’State’; E={$_.st}} | Export-Csv -NoTypeInformation -Path C:\users\$env:username\Desktop\report_select_users.csv ``` > _Note: Instead of using `objectClass -eq 'user'` in the previous example, you could have also used the [`Get-AdUser`](https://adamtheautomator.com/get-aduser/ "Get-AdUser") cmdlet._ ![report\_select\_users.csv](https://adamtheautomator.com/wp-content/uploads/2020/06/also-used-the-Get-AdUser-cmdlet..png) report\_select\_users.csv ## Finding Disabled Accounts with the LDAP Filter In the previous example, you used the `Filter` parameter to limit the objects returned by `Get-ADObject`. Another way to do that is to use the `LDAPFilter` parameter. This parameter performs the same task but allows you to specify a filter via an [LDAP query search string](https://adamtheautomator.com/ldap-filter/). The `LDAPFilter` parameter is considered a more advanced option to search Active Directory. Let’s now create a report to find all disabled users in your organization using the `LDAPFilter` and `SearchBase` parameters to target a specific OU. > _The useraccountcontrol:1.2.840.113556.1.4.803:=2 setting is an AD attribute specified for all disabled users in the Active Directory NTDS database. It’s a way for AD to flag accounts that are not active (logon is disabled). Here are [more sample LDAP queries](https://docs.microsoft.com/en-us/archive/blogs/muaddib/how-to-query-individual-properties-of-the-useraccountcontrol-active-directory-user-property-using-ldap) that you might find useful._ Below you can see we’re using the LDAP query string of `(&(objectclass=user)(objectcategory=user)(useraccountcontrol:1.2.840.113556.1.4.803:=2))`. Although complex, it does the job well. To understand the LDAP query search string, check out [Demystifying Active Directory and LDAP Search Strings](https://adamtheautomator.com/ldap-filter/). The command below runs the [LDAP filter](https://adamtheautomator.com/ldap-filter/ "LDAP filter") parameter used to show only disabled users and then creates a report using the `Export-CSV` cmdlet as you’ve done previously. ```powershell $disabled_users = Get-ADObject -LDAPFilter "(&(objectclass=user)(objectcategory=user)(useraccountcontrol:1.2.840.113556.1.4.803:=2))" -SearchBase 'OU=Department,DC=mylab,DC=local' $disabled_users | Select-Object -Property Name | Export-Csv -NoTypeInformation -Path C:\users\$env:username\Desktop\report_disabled_users.csv ``` ![report\_disabled\_users.csv](https://adamtheautomator.com/wp-content/uploads/2020/06/The-End-Result.png) report\_disabled\_users.csv ### The End Result You should now have five CSV files on your desktop ready for your manager! * _report\_accounting\_users.csv_ * _report\_sanfrancisco\_office\_users.csv_ * _report\_florida\_state\_users.csv_ * _report\_select\_users.csv_ * _report\_disable\_users.csv_ ## Summary In this article, you learned how to search Active Directory using the `Get-ADObject` PowerShell cmdlet. What next? To take what you’ve learned farther, take this process of generating AD reports to the next level by exporting the data to a database perhaps. Once in a database, you could have the AD report data accessed using either a custom-built website or an application such as Microsoft SharePoint. This is only one idea. There are countless others! The ability to search Active Directory is a fundamental skillset needed in many organizations and one that will ultimately save you and your team hours of time. ## Further Reading * [**_Active Directory Scripts Galore: Come and Get It!_**](https://adamtheautomator.com/active-directory-scripts/) Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fget-adobject%2F&text=Get-ADObject%3A%20Search%20Active%20Directory%20%26%20Generate%20Reports)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fget-adobject%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fget-adobject%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2024/11/image-23.png) ### [Managing Active Directory Groups with PowerShell: The Ultimate Guide](/powershell-ad-groups-guide/) Learn how to manage Active Directory groups with PowerShell! This hands-on guide shows you how to query, create and modify AD groups using practical real-world ![](https://adamtheautomator.com/wp-content/uploads/2019/08/database-152091_1280.png) ### [Active Directory Database: PowerShell Monitoring Made Easy](/active-directory-database/) Find the ntds.dit location and monitor your Active Directory database using PowerShell. ![](https://adamtheautomator.com/wp-content/uploads/2019/07/panic-1393619_1280.png) ### [How to Find Locked Out Users in Active Directory with PowerShell](/find-locked-out-users-in-active-directory-powershell/) See what we can do to find locked out users in Active Directory with PowerShell! ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)