26

Using PowerShell, how can I get the currently logged on domain user's full name (not only its username) without the need of the ActiveDirectory module?

0
30
$dom = $env:userdomain
$usr = $env:username
([adsi]"WinNT://$dom/$usr,user").fullname

Returns:

John Doe

Some other (mostly) obscure properties also available. A few useful ones:

  • Homedrive UNC
  • Homedrive Letter
  • Description
  • Login script

Try:

[adsi]"WinNT://$dom/$usr,user" | select *
5
  • 4
    Good answer. Of course, this is querying AD... :)
    – Massimo
    Mar 17 '14 at 20:31
  • 1
    Do I need domain admin rights to run this command? Or can the domain user itself can run this command? Mar 17 '14 at 21:02
  • 1
    Any domain user can query AD for this kind of information.
    – Massimo
    Mar 20 '14 at 16:43
  • 1
    @Massimo Not any domain user can query AD for this kind of information. Users can be not granted (or denied) the "Read account restrictions" permission, and be unable to query any data from Active Directory
    – Ian Boyd
    Jun 16 '15 at 15:58
  • How can I use this multiline command in powershell?
    – coderzzz18
    Feb 20 '20 at 12:10
16

I like the accepted answer, but just because I wanted to try this out myself:

$user = whoami
Get-WMIObject Win32_UserAccount | where caption -eq $user | select FullName

returns:

FullName
--------
TheCleaner

or if you wish to not have the header info and just the result:

$user = whoami
Get-WMIObject Win32_UserAccount | where caption -eq $user | select FullName | ft -hide
6
  • I read this too quickly, it does query AD. I verbally retract my vote.
    – MDMoore313
    Mar 17 '14 at 21:14
  • 3
    But doesn't require the AD PS modules
    – squillman
    Mar 17 '14 at 21:28
  • 4
    @squillman it doesn't, just giving Cleaner a hard time.
    – MDMoore313
    Mar 17 '14 at 21:31
  • Gotcha. Sorry, must have been decaffeinated...
    – squillman
    Mar 18 '14 at 14:44
  • @TheCleaner , can you tell me how can I use these multi line command in Powershell?
    – coderzzz18
    Feb 20 '20 at 12:09
7

One liner using Powershell 3.0:

gwmi win32_useraccount | where {$_.caption -match $env:USERNAME} | select fullname | ft -HideTableHeaders
3

Based on your comment on Craig620's accepted answer,

Do I need domain admin rights to run this command? Or can the domain user itself can run this command?

It sounds like you're trying to avoid installing powershell modules on user workstations, yes, but also, no, you don't need to be a domain admin to look up your own name in AD. You can look up pretty much any information that appears in the GAL in Outlook, including full name, as a standard user.

You can also look up other people's full names as a standard user in AD (using Get-WmiObject Win32_userAccount, if you want to avoid the AD modules). Service accounts that query AD (well, prior to managed service accounts) are usually standard, unprivileged AD users.

2

If you've always got .Net 3.5 or higher (which you should with PowerShell v4.0 and higher):

Add-Type -AssemblyName System.DirectoryServices.AccountManagement;
$DisplayName = [System.DirectoryServices.AccountManagement.UserPrincipal]::Current.DisplayName;

That class provides very easy access to all the common LDAP properties, so you don't need to lookup twice (once with WinNT and again with LDAP) or use [ADSISearcher] to do an LDAP search if you want some extended properties that WinNT doesn't implement.

1

Using -match is not a good choice because a $env:USERNAME of "ed" will match "fred" and "edith". Instead use -eq for an exact match and add in the domain if needed. I use a foreach loop at the end to strip off all leading an trailing whitespace as an alternative to "select fullname | ft -HideTableHeaders" which prints a leading and trailing newline.

gwmi win32_useraccount | where {$_.caption -eq $("domain\" + $env:USERNAME)} | foreach {$_.fullname}
1
([adsi]"LDAP://$(whoami /fqdn)").displayName

You can retrieve a truckload of information using this very simple tool. Check out

([adsi]"LDAP://$(whoami /fqdn)") | fl *
0

If you don't want to use the Active Directory module, you can't; unless you want to go even deeper and perform an actual LDAP query against a domain controller.

Any user information other than the username is stored in Active Directory, and it has to be retrieved there.

4
  • But when I open the start menu, the full name of the user is shown here! I mean, it must be stored somewhere? Mar 17 '14 at 20:18
  • 4
    Yes, it's stored somewhere. It's stored in Active Directory. Mar 17 '14 at 20:26
  • It is probably stored/cached in the registry as well, but I didn't find it easily and gave up.
    – mfinni
    Mar 17 '14 at 21:35
  • 1
    It's true that it's stored in AD but the [ADSI] interface has been around a lot longer than the AD modules, and really isn't all that complicated, like the accepted answer shows. Mar 20 '14 at 15:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.