removing 'CN' from DistinguishedName in Powershell script

Question

I have the below script that I use to periodically export the list of users in all of the OUs in AD, and it works pretty well, but 'DistinguishedName' isn't all that great to have as an output as it makes it hard to filter the output by OU. I've been looking, and it should be possible to remove the 'CN=' portion, leaving just the OUs, but scripting is my Achilles Heel and everything I've tried to add in from examples I've found has either returned strange results or blown up when run. How could the below script be modified to make the last column the Distinguished Name minus the 'CN=_______,'?

import-module ActiveDirectory 
 
#Set the domain to search at the Server parameter. Run powershell as a user with privilieges in that domain to pass different credentials to the command. 
#Searchbase is the OU you want to search. By default the command will also search all subOU's. To change this behaviour, change the searchscope parameter. Possible values: Base, onelevel, subtree 
#Ignore the filter and properties parameters 
 
$ADUserParams=@{ 
'Server' = 'DC01' 
'Searchbase' = 'OU=Users,OU="OU2",OU=OU1,DC=Domain,DC=Local' 
'Searchscope'= 'Subtree' 
'Filter' = '*' 
'Properties' = '*' 
} 

$maxPasswordAgeTimeSpan = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge
 
#This is where to change if different properties are required. 

$DNList | ForEach-Object{($_ -split "," | Select-Object -Skip 1) -join ","}

$SelectParams=@{ 
'Property' = 'DisplayName', 'SAMAccountname', 'enabled', 'lastlogondate', 'logoncount', 'passwordlastset', 'created', 'DistinguishedName'
} 
 
get-aduser @ADUserParams | select-object @SelectParams | @DNList | export-csv "c:\temp\userlist_test_$(get-date -f yyyy-MM-dd).csv"

change `, 'DistinguishedName'` to `, @{l='DistinguishedName';e={$_.DistinguishedName.Split(',',2)[1]}}`. That splits the DistinguishedName on commas, but only splits it into 2 object, and the `[1]` gets the second object, effectively skipping everything before and including the first comma. — TheMadTechnician, Oct 04 '22 at 21:05

Santiago Squarzon · Answer 1 · 2022-10-04T21:44:18.330

First things first, 'Properties' = '*' is not a good idea, you would be querying for all user's Attributes when you only need those in $ADUserParams. You should always query for those attributes you actually need as, not only, your query will run faster but also it will have less impact on your Domain Controller(s) depending on the size of it and how many objects you have in your Domain.

As for getting the Organizational Unit from the user's DistinguishedName, I personally would use any of the nice regexes shown in this question, for this particular example I'm using the one shown in mjolinor's answer which would suffice in almost any case.

The code would look like this:

$ADUserParams = @{
    Server      = 'DC01'
    Searchbase  = 'OU=Users,OU="OU2",OU=OU1,DC=Domain,DC=Local'
    Searchscope = 'Subtree'
    Filter      = '*'
    Properties  = @(
        'DisplayName'
        'SAMAccountname'
        'enabled'
        'lastlogondate'
        'logoncount'
        'passwordlastset'
        'created'
        'DistinguishedName'
    )
}

Get-ADUser @ADUserParams | Select-Object @($ADUserParams.Properties + @{
    Name       = 'OU'
    Expression = { $_.DistinguishedName -replace '^CN=.+?(?<!\\),' }
}) | Export-Csv path\to\export.csv -NoTypeInformation

Thank you! That worked well and gave the info desired. – SubnetMask Oct 05 '22 at 14:12 — SubnetMask, Oct 05 '22 at 14:12

Mikel V. · Answer 2 · 2022-10-05T07:19:10.790

0

you can accomplish that retrieving also name attribute, then you can create a calculated property

@{l='OU';e={$_.distinguishedname -replace "CN=$($_.name),"}}

where you replace name data with in distinguishedname string.

$SelectParams=@{ 'Property' = 'DisplayName', 'SAMAccountname', 'enabled', 'lastlogondate', 'logoncount', 'passwordlastset', 'created', 'DistinguishedName','name' ,@{l='OU';e={$_.distinguishedname -replace "CN=$($_.name),"}}} 

get-aduser @ADUserParams | select-object @SelectParams

edited Oct 05 '22 at 07:19

answered Oct 04 '22 at 21:06

Mikel V.

351
2
8

You cannot use a splatted variable as part of an array. The term you're looking for is [calculated property](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_Calculated_Properties). – mklement0 Oct 04 '22 at 23:01
Thank you! That worked well and gave the info desired as well. – SubnetMask Oct 05 '22 at 14:12

removing 'CN' from DistinguishedName in Powershell script

2 Answers2