Tuesday, May 8, 2012

hunting computers in Active Directory

This quick batch script allow you to quickly search active directory for computers and grab attributes using very little typing.  It can also be very powerful depending on how creative you get with it.

@echo off
REM this section is just to setup a switch in the script that allows you to grab all attributes from an object.
REM I'm only giving myself the chance to either use the switch in the first or second variable but feel free to
REM add more.
if "%1"=="/a" goto :a1
if "%2"==/a" goto :a2

REM This means that I will be searching through Active Directory with the object's name in question as my first
REM variable. Any word that I use after that can be an Object's Attribute that I wish to grep.
dsquery * -filter "(name=%1)" -attr %*

goto :end

:a1
REM This will pull all the attributes if your switch (/a) is the first variable.  It's handy if you can't remember an
REM attributes exact syntax
dsquery * -filter "(name=%2)" -attr *
goto :end
:a2
REM This will pull all attributes if your switch (/a) is the second variable.
dsquery * -filter "(name=%1)" -attr *

:end

This script requires the W2k3 Administrator's Tools on WinXP, or RSAT on Vista/7.  Some useful attributes to grep are:
lastLogonTimestamp
operatingSystem
distinguishedName
whenCreated
whenChanged
memberOf