|
1 | 1 | <h1 align="center">PSADTree</h1> |
2 | 2 |
|
3 | 3 | <div align="center"> |
4 | | -<sub>Tree like cmdlets for Active Directory Principals!</sub> |
| 4 | +<sub>Tree-like cmdlets for Active Directory principals!</sub> |
5 | 5 | <br /><br /> |
6 | 6 |
|
7 | 7 | [](https://github.com/santisq/PSADTree/actions/workflows/ci.yml) |
|
10 | 10 |
|
11 | 11 | </div> |
12 | 12 |
|
13 | | -PSADTree is a PowerShell Module with cmdlets that emulate the [`tree` command](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tree) for Active Directory Principals. |
| 13 | +PSADTree is a PowerShell module that brings `tree`-like visualization to Active Directory group structures — perfect for spotting nested membership and circular references at a glance. |
| 14 | + |
14 | 15 | This Module currently includes two cmdlets: |
15 | 16 |
|
16 | 17 | - [Get-ADTreeGroupMember](docs/en-US/Get-ADTreeGroupMember.md) for AD Group Members. |
@@ -42,7 +43,9 @@ Set-Location ./PSADTree |
42 | 43 |
|
43 | 44 | ## Requirements |
44 | 45 |
|
45 | | -This Module uses the [`System.DirectoryServices.AccountManagement` Namespace](https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=dotnet-plat-ext-7.0) to query Active Directory, its System Requirement is __Windows OS__ and is compatible with __Windows PowerShell v5.1__ or [__PowerShell 7+__](https://github.com/PowerShell/PowerShell). |
| 46 | +- Windows operating system (uses Windows-specific Active Directory .NET APIs) |
| 47 | +- PowerShell 5.1 (Windows PowerShell) or PowerShell 7.4+ |
| 48 | +- Read permissions on the Active Directory objects you want to query |
46 | 49 |
|
47 | 50 | ## Usage |
48 | 51 |
|
@@ -110,9 +113,70 @@ ChildDomain group ├── TestGroup005 ↔ Processed G |
110 | 113 | ChildDomain group └── TestGroup006 ↔ Processed Group |
111 | 114 | ``` |
112 | 115 |
|
| 116 | +### Retrieve and inspect additional properties |
| 117 | + |
| 118 | +```powershell |
| 119 | +PS ..\PSADTree> $tree = Get-ADTreeGroupMember TestGroup001 -Properties * |
| 120 | +PS ..\PSADTree> $user = $tree | Where-Object ObjectClass -EQ user | Select-Object -First 1 |
| 121 | +PS ..\PSADTree> $user.AdditionalProperties |
| 122 | +
|
| 123 | +Key Value |
| 124 | +--- ----- |
| 125 | +objectClass {top, person, organizationalPerson, user} |
| 126 | +cn John Doe |
| 127 | +sn Doe |
| 128 | +c US |
| 129 | +l Elizabethtown |
| 130 | +st NC |
| 131 | +title Accounting Specialist |
| 132 | +postalCode 28337 |
| 133 | +physicalDeliveryOfficeName Accounting Office |
| 134 | +telephoneNumber 910-862-8720 |
| 135 | +givenName John |
| 136 | +initials B |
| 137 | +distinguishedName CN=John Doe,OU=Accounting,OU=Mylab Users,DC=mylab,DC=local |
| 138 | +instanceType 4 |
| 139 | +whenCreated 9/18/2025 4:53:58 PM |
| 140 | +whenChanged 9/18/2025 4:53:58 PM |
| 141 | +displayName John Doe |
| 142 | +uSNCreated 19664 |
| 143 | +memberOf CN=TestGroup001,OU=Mylab Groups,DC=mylab,DC=local |
| 144 | +uSNChanged 19668 |
| 145 | +department Accounting |
| 146 | +company Active Directory Pro |
| 147 | +streetAddress 2628 Layman Avenue |
| 148 | +nTSecurityDescriptor System.DirectoryServices.ActiveDirectorySecurity |
| 149 | +name John Doe |
| 150 | +objectGUID {225, 241, 160, 222…} |
| 151 | +userAccountControl 512 |
| 152 | +badPwdCount 0 |
| 153 | +codePage 0 |
| 154 | +countryCode 0 |
| 155 | +badPasswordTime 0 |
| 156 | +lastLogoff 0 |
| 157 | +lastLogon 0 |
| 158 | +pwdLastSet 0 |
| 159 | +primaryGroupID 513 |
| 160 | +objectSid {1, 5, 0, 0…} |
| 161 | +accountExpires 9223372036854775807 |
| 162 | +logonCount 0 |
| 163 | +sAMAccountName john.doe |
| 164 | +sAMAccountType 805306368 |
| 165 | +userPrincipalName john.doe@mylab.com |
| 166 | +objectCategory CN=Person,CN=Schema,CN=Configuration,DC=mylab,DC=local |
| 167 | +dSCorePropagationData 1/1/1601 12:00:00 AM |
| 168 | +mail john.doe@mylab.com |
| 169 | +``` |
| 170 | + |
| 171 | +>[!TIP] |
| 172 | +> |
| 173 | +> - `-Properties *` retrieves __all__ available attributes from each object. |
| 174 | +> - Use friendly names (e.g. `Country` → `c`, `City` → `l`, `PasswordLastSet` → `pwdLastSet`) or raw LDAP names — the key in `.AdditionalProperties` matches what you requested. |
| 175 | +> - See the full list of supported friendly names in the [source code `LdapMap.cs`](https://github.com/santisq/PSADTree/tree/main/src/PSADTree/LdapMap.cs) |
| 176 | +
|
113 | 177 | ### Get group members recursively, include only groups and display all processed groups |
114 | 178 |
|
115 | | -The `-Recursive` switch indicates that the cmdlet should traverse all the group hierarchy. |
| 179 | +The `-Recursive` switch indicates that the cmdlet should traverse traverse the entire group hierarchy. |
116 | 180 | The `-Group` switch limits the members tree view to nested groups only. |
117 | 181 | By default, previously processed groups will be marked as _"Processed Group"_ and their hierarchy will not be displayed. |
118 | 182 | The `-ShowAll` switch indicates that the cmdlet should display the hierarchy of all previously processed groups. |
|
0 commit comments