Windows .NET Search and Modification Tools

Windows .NET Search and Modification Tools

Windows .NET-based domain controllers have a set of very useful and powerful utilities that help administrators perform a number of operations with Active Directory objects from the command prompt. In addition, these utilities can be used for batch operations. For that purpose the results from a query command can be piped as input to one of the other commands.

All these utilities (listed below) use the LDAP protocol and can query both Windows 2000 and Windows .NET domains. However, they can run on Windows XP/.NET-based computers only.

There are a huge number of parameters of every utility, and you can view their description in the Help and Support Center or in the built-in help feature. Do not forget to use quotation marks around a parameter's string value.

DsQuery and DsGet

The DsQuery.exe utility can find directory objects of any type or objects of a specific type. The DsGet.exe utility displays the specified attributes (a limited set of attributes) of specific type objects. These specific types are:

computer	contact	subnet
group	OU	site
server	user

For example, the following command displays ADsPaths and GUIDs of the user accounts in the User container:

   C:\>dsquery * CN=Users, DC=net, DC=dom   -filter objectClass=user   -attr ADsPath objectGUID 

The most universal dsquery * command can find objects of any type and display any attributes of these objects.

To find all users in the domain, use the command:

 C:\>dsquery user 

The following two commands display the first and last names of all users in the domain:

 C:>dsquery user | dsget user -fn -ln 

The base and scope of search operations can be specified as domainroot (default option), forestroot

Renaming of an object:

 C:\>dsmove CN=Sam, OU=Staff, DC=net, DC=dom -newname Samuel dsmove succeeded: CN=Sam, OU=Staff,   DC=net, DC=dom 

DsRm

The DsRm.exe utility deletes one or more directory objects. You can also delete an entire object subtree.

The following command immediately (without any prompt) removes all child objects in the Staff OU, but keeps (do not delete) the OU object itself:

   C:\>dsrm OU=Staff, DC=net, DC=dom   -noprompt -subtree -exclude dsrm succeeded:   OU=Staff, DC=net, DC=dom