1

We have a former Win2k AD domain, which is migrated to W2k3 servers, and has a slew of schema extensions (Exchange, msSFU, and self-defined) from the past and various parts of the forest.

Searching users works just fine, I get the complete list of users. However, if I query the user objects, I get only an incomplete list of properties:

$user.properties.propertynames

delivers

objectClass
cn
distinguishedName
instanceType
whenCreated
whenChanged
uSNCreated
uSNChanged
name
objectGUID
userAccountControl
badPwdCount
codePage
countryCode
badPasswordTime
lastLogoff
lastLogon
pwdLastSet
primaryGroupID
objectSid
accountExpires
logonCount
sAMAccountName
sAMAccountType
objectCategory
isCriticalSystemObject
nTSecurityDescriptor

This response lacks quite a few properties that AD Explorer shows.

How can I list all the properties and values that really exist? Any other hint for a tool to achieve that besides Powershell?

Background: We need to check the consistency of the user objects. It seems like if the object was created back then with W2k the user has a more complete set of properties than when they are set up on a W2k3 ADUC. Some problems seem to arise from that, but I am not yet sure, and would like to sanity check the user properties.

I know how to use $objSearcher.PropertiesToLoad.Add (). But that is of no help since I also want to find if there are any unknown properties lurking in some user objects.

Some old user objects have up to 150 properties. But not all old users have the same set. I want to get a list of who has what.

How can I get the total list of available properties, that are used on any objects?

Improve this question
1
  • @uSlackr is right - you really only want to interrogate the ones you're really interested in. If you tell us your actual problem rather than some problems seem to arise from that, we might be able to narrow it down to a specific set of attributes that you can check, which will make your life much easier. Fact is, some attributes that were used in previous versions of Windows Server aren't used any more, so extra attributes being populated on older objects is unavoidable.
    – Ben Pilbrow
    Jun 14, 2011 at 8:08

1 Answer 1

Reset to default
2

There are lot of system properties that might make the exercise you are thinking of less than useful due to a significant amount of extraneous data. Perhaps you could use AD Explorer to identify the attributes that look interesting and use the -Properties parameter to retrieve them for all users.

When you retrieve a user object in AD, it only returns back a subset of the object attributes. You can use the -Properties parameter to force get-user to retrieve other properties. For example: get-aduser jjohnson -Properties pwdlastset would add pwdlastset to the list of properties normally retrieved by get-aduser for the user jjohnson.

Improve this answer
2
  • Point is, user objects have different sets of properties. I want to see how the properties are distributed, and which are used where. Some old user objects have about 150 properties. New ones may have less than 50. What is available everywhere?
    – Posipiet
    Jun 14, 2011 at 7:38
  • I found more information on this. Perhaps this blog post from the AD powershell blog can get you further with this. Scroll down to the end of the comments. There is some code for querying attributes from AD. blogs.msdn.com/b/adpowershell/archive/2009/02/25/…
    – uSlackr
    Jul 15, 2011 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.