Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm a software developer currently stuck to support CyberArk at a large company. I need to pull up a list of accounts that is belong to a certain user. For example, let's said I have a user account named Bob and I want to find all the accounts that belong to Bob in AD meaning on the Organization tab of a user properties, the Manager should be Bob.

I've absolutely zero knowledge regarding AD except the very basic. Is there a way to do it? I only have access to "Active Directory Users and Computers" tool and I'm not even sure if I have enough privilege to run script or install powershell to do it but would like to know the script or powershell command to do so if there is one.

share|improve this question
    
Why would a person have more then one account? –  Zoredache Nov 23 '11 at 3:57
    
One account is for normal login and another one is for installing software/hardware which have higher privileges. Also, there might be say an application account that is associated with a user as far as I understand. –  Jack Nov 23 '11 at 23:34
add comment

1 Answer

Install Powershell and the Quest cmdlets.

Then you could use something like this:

Get-QADUser -SearchRoot "DC=Company,DC=com" -LdapFilter '(&(manager=cn=Bart De Vos,ou=IT,dc=Company,dc=com)(objectCategory=User))'

You could also use the query in the advanced search box of AD.

(&(manager=cn=Bart De Vos,ou=IT,dc=Company,dc=com)(objectCategory=User))

You don't need any special rights for this, all members of the domain have full read-access to it.

share|improve this answer
    
Thank you for your tips butI do not have enough permission to run it. sigh... –  Jack Nov 23 '11 at 23:34
    
@Jack: Try getting the permission, not much you can do otherwise. Make sure to open your powershell with a domainuser that has rights on the DC (Rightclick + Shift on the shortcut -> Run As) –  Bart De Vos Nov 24 '11 at 8:28
    
Even without the Quest (or Microsoft's ActiveDirectory PowerShell module) you can use the provided LDAP query with the built-in DS suite tools: dsquery * -filter "(&(manager=cn=Bart De Vos,ou=IT,dc=Company,dc=com)(objectCategory=User))" –  jscott May 8 '12 at 23:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.