30

Using PowerShell, how can I get the currently logged on domain user's full name (not only its username) without the need of the ActiveDirectory module?

0

10 Answers 10

33
$dom = $env:userdomain
$usr = $env:username
([adsi]"WinNT://$dom/$usr,user").fullname

Returns:

John Doe

Some other (mostly) obscure properties also available. A few useful ones:

  • Homedrive UNC
  • Homedrive Letter
  • Description
  • Login script

Try:

[adsi]"WinNT://$dom/$usr,user" | select *
6
  • 4
    Good answer. Of course, this is querying AD... :)
    – Massimo
    Mar 17, 2014 at 20:31
  • 1
    Do I need domain admin rights to run this command? Or can the domain user itself can run this command? Mar 17, 2014 at 21:02
  • 1
    Any domain user can query AD for this kind of information.
    – Massimo
    Mar 20, 2014 at 16:43
  • 1
    @Massimo Not any domain user can query AD for this kind of information. Users can be not granted (or denied) the "Read account restrictions" permission, and be unable to query any data from Active Directory
    – Ian Boyd
    Jun 16, 2015 at 15:58
  • How can I use this multiline command in powershell?
    – coderzzz18
    Feb 20, 2020 at 12:10
17

I like the accepted answer, but just because I wanted to try this out myself:

$user = whoami
Get-WMIObject Win32_UserAccount | where caption -eq $user | select FullName

returns:

FullName
--------
TheCleaner

or if you wish to not have the header info and just the result:

$user = whoami
Get-WMIObject Win32_UserAccount | where caption -eq $user | select FullName | ft -hide
6
  • I read this too quickly, it does query AD. I verbally retract my vote.
    – MDMoore313
    Mar 17, 2014 at 21:14
  • 3
    But doesn't require the AD PS modules
    – squillman
    Mar 17, 2014 at 21:28
  • 4
    @squillman it doesn't, just giving Cleaner a hard time.
    – MDMoore313
    Mar 17, 2014 at 21:31
  • Gotcha. Sorry, must have been decaffeinated...
    – squillman
    Mar 18, 2014 at 14:44
  • @TheCleaner , can you tell me how can I use these multi line command in Powershell?
    – coderzzz18
    Feb 20, 2020 at 12:09
8

One liner using Powershell 3.0:

gwmi win32_useraccount | where {$_.caption -match $env:USERNAME} | select fullname | ft -HideTableHeaders
3

Based on your comment on Craig620's accepted answer,

Do I need domain admin rights to run this command? Or can the domain user itself can run this command?

It sounds like you're trying to avoid installing powershell modules on user workstations, yes, but also, no, you don't need to be a domain admin to look up your own name in AD. You can look up pretty much any information that appears in the GAL in Outlook, including full name, as a standard user.

You can also look up other people's full names as a standard user in AD (using Get-WmiObject Win32_userAccount, if you want to avoid the AD modules). Service accounts that query AD (well, prior to managed service accounts) are usually standard, unprivileged AD users.

3

If you've always got .Net 3.5 or higher (which you should with PowerShell v4.0 and higher):

Add-Type -AssemblyName System.DirectoryServices.AccountManagement;
$DisplayName = [System.DirectoryServices.AccountManagement.UserPrincipal]::Current.DisplayName;

That class provides very easy access to all the common LDAP properties, so you don't need to lookup twice (once with WinNT and again with LDAP) or use [ADSISearcher] to do an LDAP search if you want some extended properties that WinNT doesn't implement.

3
([adsi]"LDAP://$(whoami /fqdn)").displayName

You can retrieve a truckload of information using this very simple tool. Check out

([adsi]"LDAP://$(whoami /fqdn)") | fl *
1

Using -match is not a good choice because a $env:USERNAME of "ed" will match "fred" and "edith". Instead use -eq for an exact match and add in the domain if needed. I use a foreach loop at the end to strip off all leading an trailing whitespace as an alternative to "select fullname | ft -HideTableHeaders" which prints a leading and trailing newline.

gwmi win32_useraccount | where {$_.caption -eq $("domain\" + $env:USERNAME)} | foreach {$_.fullname}
1

How about querying the registry instead of AD Like this:

if ((gwmi win32_computersystem).partofdomain -eq $true)
{Get-ItemPropertyValue -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\1 -Name "LoggedOnDisplayName"}
else 
{Get-ItemPropertyValue -Path HKLM:\SOFTWARE\Microsoft\Windows\Cu rrentVersion\Authentication\LogonUI\SessionData\1 -Name "LoggedOnUser" | %{$_.Split('\')[1]}}

Note: Only tested on Windows 10.

Another Note: this looks for the first logged user in the current session, so for example if you logged out of john.smith and logged in will.smith and run the above you will get the data related to john.smith instead of will.smith.

Update: The below script will get the current user's display name regardless of being on a domain joined PC or not or logging in with another account before logging in with the account that you need to get the display name for.

$user = (Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\" | Get-ItemProperty | Where-Object LoggedOnUser -like "$(whoami)" | select -First 1)

if ((Get-Item $user.PSPath).Property -contains "LoggedOnDisplayName" -eq $true) {
    $user.LoggedOnDisplayName
} else {
    $user.LoggedOnUser | %{$_.Split('\')[1]}
}
1
  • 1
    Thank you. This is way more reliable for me than the LDAP query, which often fails or times out because of network issues. Jun 16, 2023 at 16:06
0

If you don't want to use the Active Directory module, you can't; unless you want to go even deeper and perform an actual LDAP query against a domain controller.

Any user information other than the username is stored in Active Directory, and it has to be retrieved there.

4
  • But when I open the start menu, the full name of the user is shown here! I mean, it must be stored somewhere? Mar 17, 2014 at 20:18
  • 4
    Yes, it's stored somewhere. It's stored in Active Directory. Mar 17, 2014 at 20:26
  • It is probably stored/cached in the registry as well, but I didn't find it easily and gave up.
    – mfinni
    Mar 17, 2014 at 21:35
  • 1
    It's true that it's stored in AD but the [ADSI] interface has been around a lot longer than the AD modules, and really isn't all that complicated, like the accepted answer shows. Mar 20, 2014 at 15:11
0
Get-WMIObject Win32_UserAccount | where caption -eq (WhoAmI) | select FullName

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .