PowerShell Get-ADUser Attribute Deep Dive: All Properties
─□✕

PowerShell Get-ADUser Attribute Deep Dive: All Properties

PowerShell Tips Editor 4 min read
PowerShell Get-ADUser Attribute Deep Dive: All Properties

Run Get-ADUser jsmith and you get ten attributes back. Run it again with -Properties * and you get hundreds, but at a real cost to your domain controllers. Understanding which attributes exist, which are returned by default, and how to request precisely what you need is the difference between a well-behaved reporting script and one that saturates LDAP on a busy DC.

Quick Answer

Use Get-ADUser -Identity jsmith -Properties PasswordLastSet, LastLogonDate, MemberOf to request only the attributes you actually need. Avoid -Properties * in bulk queries — it transfers hundreds of attributes per user and causes unnecessary DC load.

Default Attributes vs Extended Attributes in Get-ADUser

By default, Get-ADUser returns only a subset of the most commonly used attributes. Everything else is considered an extended attribute and requires explicit enumeration in -Properties.

# Default properties returned without -Properties
Get-ADUser -Identity "jsmith" | Get-Member -MemberType Properties

# Typical defaults include:
# DistinguishedName, Enabled, GivenName, Name, ObjectClass,
# ObjectGUID, SamAccountName, SID, Surname, UserPrincipalName

# Extended attributes require explicit request
Get-ADUser -Identity "jsmith" -Properties PasswordLastSet, `
    LastLogonDate, AccountExpirationDate, Department, `
    Manager, MemberOf, EmailAddress, TelephoneNumber

The reason for this design is performance. A typical Active Directory user object can carry hundreds of attributes populated across the schema. Returning all of them for every query — especially when searching thousands of users — would place unnecessary load on domain controllers and saturate the network. Always be explicit.

Using -Properties with Specific Attribute Names

Attribute names in -Properties use their LDAP display names. PowerShell maps these to friendlier names in the resulting object (e.g., pwdLastSet becomes PasswordLastSet), but the underlying LDAP name is what you pass.

# Request multiple specific extended attributes
$user = Get-ADUser -Identity "jsmith" -Properties @(
    "PasswordLastSet",
    "LastLogonDate",
    "AccountExpirationDate",
    "LockedOut",
    "BadLogonCount",
    "Department",
    "Title",
    "Manager",
    "EmailAddress",
    "MemberOf"
)

$user | Select-Object SamAccountName, Department, Title,
                      PasswordLastSet, LastLogonDate,
                      LockedOut, BadLogonCount

Key Security Attributes: PasswordLastSet, LastLogonDate, AccountExpirationDate

These three attributes drive the majority of security and compliance reporting scenarios. Understanding their nuances prevents reporting errors.

# Password age report for enabled accounts
$staleDate = (Get-Date).AddDays(-90)

Get-ADUser -Filter { Enabled -eq $true } `
           -Properties PasswordLastSet, PasswordNeverExpires,
                       AccountExpirationDate |
    Where-Object { $_.PasswordLastSet -lt $staleDate -and
                   $_.PasswordNeverExpires -eq $false } |
    Select-Object SamAccountName, PasswordLastSet,
                  AccountExpirationDate |
    Sort-Object PasswordLastSet |
    Export-Csv "StalePasswords.csv" -NoTypeInformation

Key points: PasswordLastSet is replicated and accurate. LastLogonDate is also replicated (updated every 9–14 days per Microsoft’s replication interval design). The raw LastLogon attribute is not replicated — do not use it for domain-wide last-logon reporting.

Probing Available Attributes with Get-ADObject -Properties *

When you need to discover what attributes a user object actually has populated — not just what exists in the schema — query the object directly.

# See all populated attributes on a specific user object
$obj = Get-ADObject -Identity (Get-ADUser "jsmith").DistinguishedName `
                    -Properties * -ErrorAction Stop

# List attribute names and their values, filtering out empty ones
$obj.PSObject.Properties |
    Where-Object { $null -ne $_.Value -and $_.Value -ne "" } |
    Select-Object Name, Value |
    Sort-Object Name |
    Format-Table -AutoSize

This is a diagnostic tool, not something to run across all users. Use it on a representative sample user to discover which extended attributes your organisation actually populates before building a bulk report.

Building a Standard User Report with Selected Properties

A well-defined set of properties covers most HR, helpdesk, and security audit needs without over-requesting attributes.

$reportProps = @(
    "Department", "Title", "Manager", "EmailAddress",
    "PasswordLastSet", "PasswordNeverExpires", "LastLogonDate",
    "AccountExpirationDate", "LockedOut", "Enabled"
)

$users = Get-ADUser -Filter * -Properties $reportProps |
    Select-Object SamAccountName, GivenName, Surname,
                  @{N="ManagerName"; E={ if ($_.Manager) {
                      (Get-ADUser $_.Manager).Name } else { "" } }},
                  Department, Title, EmailAddress,
                  Enabled, LockedOut,
                  PasswordLastSet, PasswordNeverExpires,
                  LastLogonDate, AccountExpirationDate

Write-Host "Processed $($users.Count) user accounts."

Exporting to CSV and Excel with ImportExcel

CSV is the universal fallback; the ImportExcel module (available on PSGallery) produces native .xlsx files with formatting without requiring Excel to be installed.

# CSV — always works
$users | Export-Csv "ADUserReport-$(Get-Date -Format yyyyMMdd).csv" `
         -NoTypeInformation -Encoding UTF8

# Excel — requires: Install-Module ImportExcel
$users | Export-Excel "ADUserReport-$(Get-Date -Format yyyyMMdd).xlsx" `
         -AutoSize `
         -TableName "ADUsers" `
         -FreezeTopRow `
         -WorksheetName "Users"

Write-Host "Export complete."

Common Errors

  • LastLogon vs LastLogonDate confusion: The raw LastLogon attribute stores an integer (Windows FILETIME) and is not replicated between domain controllers. If you query a specific DC, you only see logins that DC handled. Use LastLogonDate instead — it is replicated and represents the approximate last logon across all DCs within the replication convergence window.
  • -Properties * in bulk queries: On a domain with 10,000 users, Get-ADUser -Filter * -Properties * returns hundreds of attributes per object, creates very large PSCustomObjects in memory, and generates a significant LDAP query load on your domain controllers. Always enumerate only the attributes your script actually uses.

Related Cmdlets / See Also

Wrapping Up

Always request only the attributes your script needs, use LastLogonDate rather than the unreplicated LastLogon, and reserve -Properties * for single-object diagnostics. These habits keep LDAP queries lean and reports accurate.

Send-Item -To