/flags/active-directory/get-aduser-properties
Get-ADUser -Properties: get attributes beyond the default set (and why * is slow)
- tool
- Active Directory PowerShell
- command
- Get-ADUser
- flag
- -Properties (alias -Property)
- default
- the default set: DistinguishedName, Enabled, GivenName, Name, ObjectClass, ObjectGUID, SamAccountName, SID, Surname, UserPrincipalName
Get-ADUser -Identity anna -Properties Department, Title, mail returns those attributes in addition to the default set. Without -Properties, Get-ADUser returns only a small default set of user properties; everything else is simply missing from the object. The reference: "Use this parameter to retrieve properties that are not included in the default set. Specify properties for this parameter as a comma-separated list of names. To display all of the attributes that are set on the object, specify * (asterisk)."
Import-Module ActiveDirectory
Get-ADUser -Identity anna -Properties Department, Title, mail, LastLogonDate
Get-ADUser -Filter 'Enabled -eq $true' -Properties mail, Department |
Select-Object SamAccountName, mail, Department
Get-ADUser -Identity anna -Properties * # every attribute that is setDefault set and what to add
The default set returned by Get-ADUser is DistinguishedName, Enabled, GivenName, Name, ObjectClass, ObjectGUID, SamAccountName, SID, Surname and UserPrincipalName. Common additions:
| Property | Meaning |
|---|---|
| mail, EmailAddress | LDAP mail attribute / its friendly name |
| Department, Title, Company, Manager | organization attributes (Manager is a DN) |
| LastLogonDate | converted lastLogonTimestamp, replicated, approximate |
| PasswordLastSet, PasswordNeverExpires, PasswordExpired | password state |
| LockedOut, BadLogonCount | lockout state (BadLogonCount is per domain controller) |
| MemberOf | direct group memberships as DNs |
| whenCreated, whenChanged | object timestamps |
| extensionAttribute1-15, msDS-* attributes | use the LDAP display name |
For attributes that are neither default nor extended properties, "you must specify the LDAP display name of the attribute", for example msDS-UserPasswordExpiryTimeComputed.
-Properties * vs named properties
* asks the domain controller for every attribute of every matching object, including large ones such as certificates and group lists. For one user that is fine. For -Filter * over a whole domain it is slow and heavy on the domain controller and the network. In scripts, list the properties you use.
Pitfalls
- Select-Object is not enough.
Get-ADUser anna | Select-Object Departmentshows an empty column because Department was never requested. - Wildcard and pipeline.
-Propertiestakes names, not filters; filter objects with-Filter(Get-ADUser -Filter). - Computed attributes. Constructed attributes such as
msDS-UserPasswordExpiryTimeComputedare returned only when named explicitly. - Module missing. If
Get-ADUseris not found, install RSAT (install RSAT on Windows 11, Get-ADUser is not recognized). - Inactive accounts. For last logon reports,
Search-ADAccount -AccountInactiveis simpler (inactive accounts).
FAQ
Why is the mail (or Department, or LastLogonDate) column empty?
Those attributes are not in the default property set. Add them: Get-ADUser anna -Properties mail, Department, LastLogonDate. Select-Object alone cannot show what the cmdlet did not retrieve.
What is the difference between LastLogon and LastLogonDate?
lastLogon is not replicated and is different on every domain controller. LastLogonDate is the module's friendly conversion of lastLogonTimestamp, which is replicated but updated only periodically, so it is accurate to within days rather than minutes.
How do I list all attribute names a user has?
Run Get-ADUser anna -Properties * | Get-Member -MemberType Property. The reference also suggests -Properties Extended | Get-Member for the most commonly used ones.