DSQuery user
Search for users in active directory.
Syntax
DSQuery User [{StartNode | forestroot | domainroot}] [-o {dn | rdn | samid}] [-scope {subtree | onelevel | base}] [-name Name] [-desc Description] [-upn UPN] [-samid Filter] [-inactive NumberOfWeeks] [-stalepwd NumberOfDays] [-disabled] [{-s Server | -d Domain}] [-u UserName] [-p {Password | *}] [-q] [-r] [-gc] [-limit NumberOfObjects] [{-uc | -uco | -uci}]
Key
StartNode | forestroot | domainroot The node in the console tree where the search starts. forestroot = search using the global catalog.
-o The format used to display the search results.
dn = distinguished name.
rdn = relative distinguished name.
samid = Security Accounts Manager (SAM) account name.
-scope The scope of the search:
subtree = subtree that is rooted at the start node in the console tree.
onelevel = immediate children of the start node only.
base = single object that the start node represents.
If forestroot is the StartNode, then subtree is the only valid scope.
-name Search for user(s) whose name attribute(CN) matches Name.
For example, "br*"
-desc Search for user(s) whose description matches. For example, "contractor*"
-upn Users whose UPN attribute matches UPN
-samid User(s) whose SAM account name matches SAMName
-inactive Users who have been inactive for n number of weeks
-stalepwd Users who have not changed their passwords for n days
-disabled Users with disabled accounts
-s Server to connect to (Default=the domain controller in the logon domain.)
-d Domain to connect to.
-u Username with which the user logs on to a remote server.
-p Password (UserName or Domain\UserName or Username@domain.com)
-q Quiet, suppress all output
-r Recursive search (follow referrals)
-gc Use the AD global catalog during the search.
-limit The maximum number of objects to return, default=100.
-uc Unicode format
-uco Unicode format for output only
-uci Unicode format for input only
Examples
Find all inactive accounts (more than 4 weeks inactive)
C:\> dsquery user -inactive 4
Disable all inactive accounts (more than 4 weeks inactive)
C:\> dsquery user -inactive 4 | dsmod user -disabled yes
Export all active users to .txt file.
C:\> dsquery user -limit 1000 -o rdn -name * > c:\all_users.txt
Export all disabled users to .txt file.
C:\> dsquery user -limit 1000 -o rdn -disabled -name * > c:\all_disabled_users.txt
