HOWTO: Easily Compare AD Attributes Between Users

You guys are in for a treat today.  Have you ever attempted to troubleshoot an issue with an Active Directory user only to find yourself in ADSI edit trying to figure out if any attributes are not configured correctly?  Since you’re often not sure what the value is supposed to be, you’d like to compare it to another known working user. That’s a pretty common problem in Windows IT and I’ve just created a tool that makes it much, much easier to do!  Let me know show you how it works.

When you run this tool, a dialog box appears that looks like this:

• This screen is asking for the users you’d like to display Active Directory attributes for.  You can enter 1 or 2 or 10 different users if you’d like, just be sure to separate each one with a semicolon.
• It can take a few moments for the AD attributes to load so a progress bar is displayed.  It shouldn’t take more than 5 seconds or so per user.

• You’re now presented with a grid view that contains 3 columns : the username, the attribute name and its value. That’s pretty cool, but that’s not the best part.  The grid view has a built in real time search that automatically searches every single item of text means that you can do some incredibly powerful analytics.

• Let’s say for example that you are troubleshooting a logon issue for user named sbrown.  You know that jack.johnson is working.  You also want to include your own account as a control.
• All you need to do is in the filter box type logon.  This will return any field in any attribute or description or name that has that key word

• Ah ha, in this case we can see that sbrown has never actually logged in before.  This tool makes it incredibly simple to analyze Active Directory attributes.
• Here is another example.  Let’s say you’re having email issues with two users.  You know your email works so you compare them and search for the email domain name:

• Ah ha!  The working account has a proxyAddress configured while the two accounts that are not working do not.  (This is because in my lab only admin-rv is provisioned with an Exchange account).

Lastly, let’s say you want to export all of the attributes related to passwords into a spreadsheet for further analysis, reporting, etc?  Turns out all you need to do is select the records you want and press OK

The results are automatically pasted into your clipboard.  You can now paste these results into Excel for example.

The sky is the limit!

Here is the script:

Accepts one or more user names and displays all AD attributes for those users in a GridView for easy analysis
# Home; Active Directory; Attributes; Users; Analysis;

# Requires PowerShell 3 due to how the type accelerator I use to generate custom objects
#requires -version 3
# Also requires that the module "ActiveDirectory" is loaded to use Get-ADUser

# Required to load the Messagebox to display a friendly error if no user is found
[System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms") | Out-Null

Function Get-UserInput([string]$Description)
{
    $objForm = New-Object System.Windows.Forms.Form 
    $objForm.Text = "AD User Attributes"
    $objForm.Size = New-Object System.Drawing.Size(300,170) 
    $objForm.StartPosition = "CenterScreen"

    $objForm.KeyPreview = $True
    $objForm.Add_KeyDown({if ($_.KeyCode -eq "Enter") 
        {$x=$objTextBox.Text;$objForm.Close()}})
    $objForm.Add_KeyDown({if ($_.KeyCode -eq "Escape") 
        {$objForm.Close()}})

    $OKButton = New-Object System.Windows.Forms.Button
    $OKButton.Location = New-Object System.Drawing.Size(75,95)
    $OKButton.Size = New-Object System.Drawing.Size(75,23)
    $OKButton.Text = "OK"
    $OKButton.Add_Click({$x=$objTextBox.Text;$objForm.Close()})
    $objForm.Controls.Add($OKButton)

    $CancelButton = New-Object System.Windows.Forms.Button
    $CancelButton.Location = New-Object System.Drawing.Size(150,95)
    $CancelButton.Size = New-Object System.Drawing.Size(75,23)
    $CancelButton.Text = "Cancel"
    $CancelButton.Add_Click({$objTextBox.text = "Cancel"; $objForm.Close()})
    $objForm.Controls.Add($CancelButton)

    $objLabel = New-Object System.Windows.Forms.Label
    $objLabel.Location = New-Object System.Drawing.Size(10,20) 
    $objLabel.Size = New-Object System.Drawing.Size(280,40) 
    $objLabel.Text = $Description
    $objForm.Controls.Add($objLabel) 

    $objTextBox = New-Object System.Windows.Forms.TextBox 
    $objTextBox.Location = New-Object System.Drawing.Size(10,60) 
    $objTextBox.Size = New-Object System.Drawing.Size(260,20)
    # Include default usernames here if desired
    $objTextBox.Text = "samaccountname" 
    $objForm.Controls.Add($objTextBox) 

    $objForm.Topmost = $True

    $objForm.Add_Shown({$objForm.Activate(); $objTextBox.focus()})
    [void] $objForm.ShowDialog()

    return $objtextBox.Text
}

# Create a custom object that will store the values we discover to present them in a gridview
$C="UserName Attribute Value"; $myobj=@(); Function Add-ToObject{$args|%{$i++;$P+=@{$C.split(" ")[$i-1]=$_}};$Script:myObj+=@([pscustomobject]$P)}

$UserNames = Get-UserInput "Enter samaccountname(s) to show AD user attributes (Separate each name with a `";`")"
if($UserNames -eq "Cancel" -or $UserNames -eq '') { break } 
# If more than one user is found, split them out into separate elements so they can be checked one at a time
$UserNames = $UserNames -split ";"

# This code can probably be combined with the other checks as we are performing multiple redundant get-aduser calls but this works for now
# The purpose of this loop is simply to validate that the users exist and if not, display an error message, and quit
ForEach($Username in $UserNames)
{
    try{
        Get-ADUser -Identity $UserName -ErrorAction SilentlyContinue | Out-Null
    }
    catch{
        [Windows.Forms.MessageBox]::Show("Cannot find user `'$Username`'.  `nExiting Tool." , "AD User Attributes", [Windows.Forms.MessageBoxButtons]::OK , [Windows.Forms.MessageBoxIcon]::Error) | Out-Null; Exit
    }
}
cls

# We need to enumerate all Active Directory propeties so we can later expand each of them and store any entries with multiple line or objects as a single text string
# Different users can have different attributes so we need to first build a list of all possible attributes to later iterate through
$UserNames | % { Write-Progress -Activity "Reading active directory attributes for $UserName..."; $Props += (Get-ADUser $_ -Properties * | Get-Member -MemberType Properties)  }

# Once we have a master list of all properties, generate a list of all of the unique ones, eliminating the duplicates
$Props = $Props | select -Unique

ForEach($Username in $UserNames) 
{
    # Grab all attributes and values from Active Directory for this user
    $UserDetails = get-aduser $UserName -Properties * -ErrorAction Stop

    ForEach ($UserDetail in $UserDetails)
    {
        ForEach($Prop in $Props)
        {
            Write-Progress -Activity "Reading active directory attributes for $UserName..." -Status $Prop
            
            # For properties with multiple values, expand them and append them to a single line separated by a semicolon so Out-GridView can search it
            $Result = (get-aduser $UserName -Properties * | select -ExpandProperty $Prop.Name) -join ";"
            
            # The attributes defined below are known to be stored in a unique format.  We need to confirm them to a human readable form using the .NET method ::Fromfiletime
            switch ($Prop.name) {
                'lastLogonDate' { if(!$Result) { $Result = "Never Logged In" } }

                { 
                    'lastLogonTimestamp',
                    'lastLogon',
                    'badPasswordTime',
                    'lastLogonTimestamp',
                    'pwdlastset' -contains $_ } { if($Result) { $Result = [string][datetime]::fromfiletime($Result) } 
                }
                # If a password is marked to never expire, it is assigned the value below.  if we find that, we translate that into human readable form.  Otherwise we convert it
                'accountExpires' { if ($Result -eq "9223372036854775807") {$Result = "Never Expires" } Else { $Result = [string][datetime]::fromfiletime($Result) } }
            }
            
            Add-ToObject $UserName $Prop.Name $Result
        }
    }
}

# Whatever is selected inside the grid view is automatically exported to the clipboard as CSV data
$SendToClipboard = $myobj | select UserName, Attribute, Value | Out-GridView -Title "Active Directory User Attributes" -PassThru | ConvertTo-CSV -NoTypeInformation | clip