Search This Blog

Jan 31, 2024

[PowerShell] When ExpandProperty is not good enough

The ExpandProperty parameter in select-object cmdlet is useful to view full values of a compound property (e.g. when a property's value is an array or an object). However the limitation is also obvious. It accepts only one property, so we are forced to write a script block to process all results, using a different way to convert/expand properties one by one, before we can finally assembly the output.

The other way to do it is to use inline expression. See below

$targetedProperties=@(
    samaccountname,
    @{l='membership'; e={$_.memberof}}
    @{l='allEmailAddresses'; e={$_.proxyAddresses}}
$uObj = get-aduser 'johnDoe' -properties *
$expandedObj = $uObj | select $targetedProperties
 



Array that includes most meaningful AD attributes for admins


$meaningfulP = @(
    "AccountExpirationDate"
    #"accountExpires" # above converted value is readable to human - blank means never
    "AccountLockoutTime"
    "AccountNotDelegated"
    "AllowReversiblePasswordEncryption"
    #"BadLogonCount" # these are temporary values that are reset by AD periodically
    #"badPasswordTime"
    #"badPwdCount"
    "c"
    "CannotChangePassword"
    "CanonicalName"
    "City"
    "CN"
    "co"
    "codePage"
    "Company"
    "Country"
    "countryCode"
    "Created"
    "createTimeStamp"
    "Deleted"
    "Department"
    #"departmentNumber"
    @{l="deptNumber";e={$_.departmentNumber}}
    "Description"
    "DisplayName"
    "DistinguishedName"
    "Division"
    "EmailAddress"
    "EmployeeID"
    "EmployeeNumber"
    "employeeType"
    "Enabled"
    "extensionAttribute12"
    "extensionAttribute14"
    "extensionAttribute2"
    "extensionAttribute3"
    "extensionAttribute4"
    "extensionAttribute5"
    "extensionAttribute6"
    "extensionAttribute8"
    "extensionAttribute9"
    "Fax"
    "GivenName"
    "HomeDirectory"
    "HomedirRequired"
    "HomeDrive"
    "HomePage"
    "HomePhone"
    "Initials"
    "instanceType"
    "isDeleted"
    "l"
    "LastBadPasswordAttempt"
    "LastKnownParent"
    "LastLogonDate"
    "legacyExchangeDN"
    "LockedOut"
    "lockoutTime"
    "logonCount"
    "LogonWorkstations"
    "mail"
    "mailNickname"
    "Manager"
    #"MemberOf"
    @{l='membership';e={($_.Memberof)[0..20]}} #to prevent this value to become too large to fit into Excel cell limit
    "MNSLogonAccount"
    "MobilePhone"
    "Modified"
    "modifyTimeStamp"
    "Name"
    "ObjectCategory"
    "ObjectClass"
    "Office"
    "OfficePhone"
    "Organization"
    "OtherName"
    "PasswordExpired"
    "PasswordLastSet"
    "PasswordNeverExpires"
    "PasswordNotRequired"
    "physicalDeliveryOfficeName"
    "POBox"
    "PostalCode"
    "preferredLanguage"
    "ProfilePath"
    "ProtectedFromAccidentalDeletion"
    #"proxyAddresses"
    @{l='allEmailAddr';e={$_.proxyAddresses}}
    "SamAccountName"
    "sAMAccountType"
    "ScriptPath"
    "sDRightsEffective"
    #"ServicePrincipalNames"
    @{l='SPN';e={$_.ServicePrincipalNames}}
    "SmartcardLogonRequired"
    "sn"
    "st"
    "State"
    "StreetAddress"
    "Surname"
    "targetAddress"
    "Title"
    "TrustedForDelegation"
    "TrustedToAuthForDelegation"
    "UseDESKeyOnly"
    "userAccountControl"
    "UserPrincipalName"
    "whenChanged"
    "whenCreated"
)