Viewing User Attributes in Active Directory

6.7K

The user account object in Active Directory contains several properties (attributes), such as canonical name (CanonicalName attribute), first name, last name, e-mail address, phone number, job title, department, country, etc.

The most common way to view and change user attribute values in AD is to use RSAT graphical snap-ins or command line tools.

The CanonicalName attribute stores the user object path in a user-friendly domain/OU format. For example:

theitbros.com/Users/Accounting/Chris Wilson

Unlike DistinguishedName (DN), the CanonicalName attribute is easier to read and you can conveniently use it in scripts, reports, and identity management systems.

DistinguishedName vs CanonicalName

Active Directory stores object paths in multiple formats: DistinguishedName and CanonicalName.

Here is an example of Distinguished Name (DN):

CN=Chris Wilson,OU=Accounting,OU=Users,DC=theitbros,DC=com

And here is an example of Canonical Name:

theitbros.com/Users/Accounting/Chris Wilson

DistinguishedName is the primary LDAP identifier used for querying, binding, and object referencing in AD, while CanonicalName is easier for admins to read and use in reports/scripts.

How to View User Attributes with ADUC GUI

To view AD user properties, you can use the Active Directory Users and Computers (ADUC) or Active Directory Administrative Center (ADAC) graphical snap-ins.

1. To launch the ADUC console, run the command dsa.msc on your domain controller or a computer with Remote Server Administration Tools (RSAT) installed.
2. Open the properties of any AD user (you can locate the user using the search function or by manually expanding their AD OU).
   

   

3. The values of the basic attributes of the AD user object (name, email, phone, etc.) are displayed on a number of tabs in the User Properties window. But not all user attributes can be viewed from here (see the list of attributes defined in the AD schema). To view the advanced user attributes, use the Attribute Editor tab, which is not visible in the ADUC console by default.
4. Enable the Advanced Features option in the View menu.
   

   

5. Open the User Properties again and check if the Attribute Editor tab is now displayed.
6. A full list of all the AD user attributes and their values can be viewed on this tab. Here you can copy or edit any of the user attribute values that you have permissions to access.

   

7. You can also filter the attributes to show only those with values. Click Filter → Show only attributes that have values.
   

   

As convenient as ADUC is, you can only view the attributes of one user at a time. Use the CLI tools to view or export user attribute values from AD in bulk.

Using the Get-ADUser PowerShell Cmdlet

The most important PowerShell cmdlet for getting the properties of a user in Active Directory is Get-ADUser. It can be used to view, filter and export the attribute values of any user from AD. The PowerShell Active Directory module must be installed on a computer to use this cmdlet.

Basic Get-ADUser Syntax and Examples

To view basic information about an Active Directory user account, run the command:

Get-ADUser -Identity <user identity>

By default, the Get-ADUser cmdlet only lists the user’s primary attributes as follows:

• DistinguishedName
• Enabled
• GivenName
• Name
• ObjectClass
• ObjectGUID
• SamAccountName
• UserPrincipalName
• SID
• Surname

This default property set is intentionally limited for performance reasons. In case you want to explicitly request additional AD attributes, you should do this using the -Properties parameter.

Display Custom Attributes with the Properties Parameter

To display the values of other user attributes (including custom user attributes), you must specify a list of them using the -Properties parameter. For example, you want to view the user’s company name, department, job title, phone number, and last password change date in Active Directory:

Get-ADUser cwilson -Properties company, department, title, telephoneNumber, PwdLastSet

Viewing a Specific AD Attribute

In case you only need to retrieve a single AD user attribute, you should use the Select-Object cmdlet. For example, to display the user’s email address, run the following command:

Get-ADUser ckardashevsky -Properties mail |
Select-Object Name,mail

In order to display the CanonicalName attribute, run the command:

Get-ADUser ckardashevsky -Properties CanonicalName |
Select-Object Name,CanonicalName

This can be useful for scripting, reporting, and troubleshooting specific AD attributes.

Important. You should avoid using -Properties * in large production environments unless necessary. When you query all AD attributes, you may significantly increase query time and DC load. We recommend you to request only the specific attributes you need.

Convert PwdLastSet to Readable Date Format

You can use Pipe with the Select-Object cmdlet to display only the attributes you want and transform some of them (in this example, we will convert the PwdLastSet value from LDAP timestamp format to human-readable date and time):

Get-ADUser cwilson -Properties company, department, title, telephoneNumber, PwdLastSet |

Select-Object SamAccountName, Name, company, department, title, telephoneNumber,

@{Name = 'PwdLastSet'; Expression = { [DateTime]::FromFileTime($_.PwdLastSet) } }

Understanding LastLogon vs LastLogonTimestamp

AD stores several logon-related attributes, and they behave differently.

Attribute	Replicated Between DCs	Accuracy
lastLogon	No	Exact
lastLogonTimestamp	Yes	Approximate
LastLogonDate	PowerShell-calculated property based on lastLogonTimestamp	Human-readable

Note that the lastLogon attribute is not replicated between DCs, so you must query all DCs to get the exact value.

Keep in mind that the lastLogonTimestamp attribute is updated infrequently (by default up to ~14 days), so it can lag significantly behind the actual logon time.

Example:

Get-ADUser cwilson -Properties LastLogonDate |
Select Name, LastLogonDate

List All AD User Attributes with Get-ADUser *

To list all user attributes, add an asterisk (*) in the Properties parameter:

Get-ADUser cwilson -Properties *

Querying lastLogon Across All Domain Controllers

Note that the lastLogon attribute is not replicated between DCs. To retrieve the most accurate logon time, you must query each DC individually and compare the results:

$DCs = Get-ADDomainController -Filter *

$User = "cwilson"

$Results = foreach ($dc in $DCs) {
Get-ADUser $User -Server $dc.HostName -Properties lastLogon |
Select-Object Name,
@{Name="DC";Expression={$dc.HostName}},
@{Name="LastLogon";Expression={[DateTime]::FromFileTime($_.lastLogon)}}
}

$Results | Sort-Object LastLogon -Descending

Why Some AD Attributes Return Empty Values

Note that some AD attributes may return blank values because:

• The attribute is not populated
• The attribute is replicated from another system
• Permissions restrict access to the attribute
• The attribute is calculated dynamically
• The wrong attribute name is used

You can verify the exact LDAP attribute name with the Attribute Editor tab in ADUC. Or you can do that by reviewing the AD schema documentation.

Search and Filter AD Users by Attributes

With Get-ADUser, you can search for users with specific attribute values in Active Directory. For example, the following command will list all enabled user accounts whose name is Christopher:

Get-ADUser -Filter "Name -like '*Christopher*' -and Enabled -eq $true" -Properties *

Note. Some AD attributes are marked as confidential/protected by Access Control Lists (ACLs). Even if you request them using -Properties *, they may not be returned unless the user/service account has sufficient permissions to read them.

Commonly Used Active Directory User Attributes

Below you’ll find a list of AD user attributes that are commonly used in enterprise environments:

Attribute	Description
displayName	Full user display name
mail	User email address
proxyAddresses	Additional email aliases
department	User department
title	Job title
manager	User manager
company	Company name
employeeID	HR/employee identifier
telephoneNumber	Phone number
mobile	Mobile phone
lastLogonTimestamp	Approximate last logon time
memberOf	Group memberships
userAccountControl	Account status flags
extensionAttribute1-15	Custom Exchange/application attributes

You can retrieve any of these attributes with the Get-ADUser cmdlet using the -Properties parameter.

Viewing Multi-Valued Attributes

Some AD attributes can contain multiple values. Examples include:

• proxyAddresses
• memberOf
• servicePrincipalName

In case you want to display all values of a multi-valued attribute, run the command:

Get-ADUser cwilson -Properties proxyAddresses |
Select-Object -ExpandProperty proxyAddresses

In order to list group memberships, run the command:

Get-ADUser cwilson -Properties memberOf |
Select-Object -ExpandProperty memberOf

The Select-Object -ExpandProperty parameter displays each value separately instead of showing the entire attribute collection object.

Export Active Directory User Attributes to CSV

From the PowerShell console, you can flexibly export the required Active Directory user property values to a CSV or TXT file. For example, to export a list of names, phone numbers and job titles of all enabled user accounts from a specified OU to a CSV file:

Get-ADUser -Filter {Enabled -eq $true} `
    -SearchBase "OU=Users,OU=CA,DC=theitbros,DC=loc" `
    -Properties displayName, title, telephoneNumber |
    Select-Object DisplayName, Title, TelephoneNumber |
    Export-Csv -Path "C:\PS\export-ad-user-properties.csv" -Encoding UTF8 -NoTypeInformation

Note. The DSQUERY and DSGET command-line tools were introduced in Windows Server 2003 and are still available in modern Windows Server versions through RSAT. However, they are considered legacy tools and are rarely used today because PowerShell provides a more flexible and powerful alternative.

For example, to list basic users’ attributes, use this command:

dsquery user | dsget user -display -samid -upn -disabled -canchpwd

How to Export Disabled or Inactive Users

In case you need to export disabled AD users to CSV, run the following:

Get-ADUser -Filter {Enabled -eq $false} -Properties department |
Select Name,SamAccountName,Department |
Export-Csv C:\PS\disabled-users.csv -NoTypeInformation

If you need to find inactive users who have not logged on for 90 days, use the command:

$Date=(Get-Date).AddDays(-90)
Get-ADUser -Filter * -Properties LastLogonTimeStamp |
Where-Object {
$_.LastLogonTimeStamp -and
([DateTime]::FromFileTime($_.LastLogonTimeStamp) -lt $Date)
}

Note. In large AD environments, using -Filter * without -SearchBase may query the entire directory and increase load on DCs. We recommend you to scope the query/use paging where applicable.

Find Users with Missing Attributes

Note that you can use PowerShell to identify AD users with missing attribute values. For example, in case you need to find users without email addresses, run the following command:

Get-ADUser -Filter * -Properties mail |
Where-Object {!$_.mail} |
Select Name,SamAccountName

In order to find users without department information:

Get-ADUser -Filter * -Properties department |
Where-Object {!$_.department} |
Select-Object Name,SamAccountName

This can helpful during identity audits and directory cleanup tasks.