Export Active Directory users with PowerShell

-1+1 (No Ratings Yet)

From time to time I see forum posts where someone is trying to export user accounts from Active Directory. I suppose there are any number of business reasons why you might need to do this, so let’s assume you have one and want to know how to accomplish this with PowerShell.

Back to the PowerShell tutorial

Jeffery HicksMVP By Jeffery Hicks - Fri, March 7, 2014 - 0 comments google+ icon

Jeffery Hicks is a multi-year Microsoft MVP in Windows PowerShell, Microsoft Certified Professional and an IT veteran with 25 years of experience specializing in automation. He works today as an author, trainer and consultant.

If you’ve been following my last few articles you know that the beauty of PowerShell lies in its scalability. For the sake of my demonstration I’m going to assume I’ve been asked to export members of the Engineering department using the Microsoft Active Directory module. I’ll break things down into discrete steps but you could easily combine them into a single pipelined expression.

Get the users ^

Getting the users is pretty simple.

get-aduser

get-aduser

As you can see in the figure I have 52 user accounts. Or rather I have the stub of a user account. The Microsoft cmdlets will only give you what you ask for so you have to decide what information you need to export. If you want to get all properties, use a wildcard.

Or you can be more selective:

Export to CSV ^

Now, you might think you’re almost done.

While the command will complete, if you look at the results in Notepad or Microsoft Excel, you’ll see that some properties, like MemberOf don’t export. The CSV format only works well when you select flat properties. Above, I defined a second variable with the properties I wanted so let me export that along with other standard properties like Enabled and DistinguishedName.

Although depending on your version of PowerShell you might need to exclude the stream properties. Or be very specific about what you want to export.

If you need to use the CSV file outside of PowerShell you might need to include the –NoTypeInformation parameter. Otherwise, you can always re-import them into PowerShell, even on a totally different computer, and work with the objects.

Export to CSV

Export to CSV

Export to XML ^

In PowerShell, the best way to export a complete, rich object is with XML. If you are planning on later re-importing the account information into PowerShell, use Export-CliXML.

This will capture everything included nested properties like MemberOf.

You can certainly export a subset of selected properties as well. Again, you have to consider why you are exporting and what you intend to do with the data. An advantage of the XML format is that the property types are maintained so WhenCreated is stored as a DateTime whereas in the CSV everything is a string.

The other XML option is to create a file that is more of a standard XML. First, convert the user accounts to an XML document.

Then you can save the file to disk.

Now you have an XML file that can be used anywhere.

Summary ^

When exporting user accounts from Active Directory I can’t stress enough that you plan ahead and consider what you intend to do with the information, as well as what information you really need to export. It may seem simple to grab everything but that will take time and generate some large file sizes, especially when using XML. Of course none of this will get the user’s password. Even so, depending on your Active Directory and what you export there might be sensitive information so be sure to secure your exports.

In the next post you will learn how to import users to Active Directory from a CSV file with PowerShell.

Back to the PowerShell tutorial

Disclaimer
Your question wasn't answered? Please ask in the new 4sysops forum!
Please share your thoughts in a comment!

Login

Lost your password?