Home / server / Questions / 243600
Accepted
Kovags
Asked: 2011-03-06 05:42:20 +0800 CST

Extracting information from active directory

  • 772

I work in the IT support department of a branch of a huge company.

I have to take care of a database with all the users, computers, etc. I'm trying to find a way to automatically update the database as much as possible, but the IT infrastructure guys doesn't give me enough privileges to use Active Directory in order to dump the users, nor they have the time to give me the information that I need.

Some days ago I found Active Directory explorer from Sysinternals that allows me to browse through Active Directory, and I found all the information that I need there (username, real name, date when it was created, privileges, company, etc.). Unfortunately I'm unable to export the data to a human readable format. I'm just able to take a snapshot of the whole database in a machine-readable format. Doing the snapshot takes hours and I'm afraid that the infrastructure guys won't like me doing entire snapshots on a regular basis.

Do you know of any tool (command-line is preferable) that would allow me to retrieve the values of the keys or export it to XML, CSV, etc?

active-directory data-extraction

3 Answers

  1. Best Answer

    Use the older command line tools for Active Directory to dump to CSV: http://support.microsoft.com/kb/298882

    Or use the newer PowerShell suite to export into CSV, Excel, etc. If you aren't up on your Powershell syntax the PowerGUI tool is outstanding. http://www.powergui.org

    Or use the not-too-old but not-too-new VBScript methods. Here is a sample VBScript that exports all properties from all users to Excel: http://gallery.technet.microsoft.com/scriptcenter/4d192f4d-2830-4a3e-9352-64a7e696a36e

    Microsoft has tons of PowerShell and VBScript examples here: http://gallery.technet.microsoft.com/ScriptCenter/

    • 3

  2. I'm re-interpreting your question as:

    How do I export data out of AD in a format easy to process, either as a complete dump or object by object?

    You need to go and become familiar with Powershell and the ActiveDirectory module. You can do things like this:

    Import-Module ActiveDirectory
$me = Get-ADUser myUsername -Properties givenName,sn
Write-Output "My name is $($me.givenName) $($me.sn)."

    or this:

    Import-Module ActiveDirectory
$subsetUsers = Get-ADUser -Filter * -SearchBase "ou=someou,dc=mydomain,dc=com"

    or this:

    Import-Module ActiveDirectory
$allUsers = Get-ADUser -Filter *
Write-Output "I've found $($allUsers.Count) users in this domain - writing to CSV."
$allUsers | Export-CSV "myOutputFile.csv"

    Powershell is your best friend ever.

    • 3

  3. First off, try and work with the infrastructure team, if you can explain to them exactly what data you need they may be able to set something up for you automatically.

    There are 2 things I will recommend here:

    CSVDE/LDIFDE. These are command line utilities that can export any information you want. If you want something to process use csvde, if you want full backups or ability to change select attributes consider ldifde.

    http://technet.microsoft.com/en-us/library/cc787549%28WS.10%29.aspx

    http://msdn.microsoft.com/en-us/library/ms870068%28v=exchg.65%29.aspx

    Softerra LDAP broswer is a great GUI tool you can use to browse "raw" AD.

    http://ldapbrowser.com/

    Look for the free version called ldap browser, not ldap administrator. From here you can right click any object and ldifde export.

    • 2