Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a Powershell cmdlet or script to query Active Directory if a given domain account (such as "myDomain\myUser") exists?

share|improve this question
up vote 1 down vote accepted

Old question, I know, but I feel I need to add this bit here because none of the previous answers use any form of error handling.

Also, if you need to support users from multiple domains, you will have to query the correct domain controller (or query the Global Catalog and specify the DN of a directory partition).

$Domainname = 'ABC'
$Username = 'Administrator'

Try
{
   $DomainController = Get-ADDomainController -DomainName $DomainName -Discover -ErrorAction Stop
   Get-ADUser -Identity $Username -Server $DomainController -ErrorAction Stop

   # user account exists
}
Catch [Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException]
{
   # no error, user account does not exist
}
Catch
{
   # Domain controller not found, domain unreachable, authentication failure or another error occurred
}
share|improve this answer
    
+1 for adding a response to my 6 year old question! :) – Max Mar 2 at 18:22

This is what we use to validate accounts. It relies of course on Import-Module ActiveDirectory and either a 2008 R2 DC, or a DC running ADWS:

function validateUser
{
    param(
    [string]$username
    )

    # If the username is passed without domain\
    if(($username.StartsWith("domain\")) -eq $false)
    {
        $user = Get-ADUser -Filter { SamAccountName -eq $username }
        if (!$user)
        {
            return $false
        }
        else
        {
            return $true
        }
    }
    elseif(($username.StartsWith("domain\")) -eq $true)
    {
        $username = ($username.Split("\")[1])
        $user = Get-ADUser -Filter { SamAccountName -eq $username }
        if (!$user)
        {
            return $false
        }
        else
        {
            return $true
        }
    }
}
$userCheck = validateUser -username smith02
if($userCheck -eq $true) { do stuff } else { user doesn't exist }
share|improve this answer
    
+1 for this one because it uses native powershell cmdlets. – Mark Henderson Mar 16 '12 at 20:17
    
My inbox seems to show a little bit more of your reply; something about streamlining it. If you still want to, please feel free to do so! – Robin Mar 17 '12 at 0:21
    
Hey robin. I did originally write that but then I realized i didn't quite have time to do it. Maybe tomorrow... – Mark Henderson Mar 17 '12 at 0:33

You can use the Directory Searcher .net object to do this.

Here is a very un-optomized code snippet from one of my utility scripts that has fallen by the wayside.

$AD = [ADSI]"<ldap_connection_string>"
$query = New-Object System.DirectoryServices.DirectorySearcher
$query.SearchRoot = $AD
$Users = $query.FindAll() | Where-Object {$_.properties.objectclass -eq "user"} 

So you should be able to change the .objectclass to .cn or .name and then match against that.

Or don't be lazy like I am and read up on how to construct a proper query :)

share|improve this answer

I would grab the Quest AD Roles cmdlets - http://www.quest.com/powershell/activeroles-server.aspx - and user their Get-QADUser cmdlet with the -Identity parameter.

For example,

$username = "mydomain\myusername"

if (Get-QADUser -Identity $username)
{Write-Host "It's alive"}
else
{Write-Host "Account does not exist."}
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.