The other day a friend asked me how I would get Active Directory Schema information using Powershell. I knew of the schema property on the
DirectoryServices.ActiveDirectory.Forest class and that is where I started.
Initially I just called the static method GetCurrentForest on the Forest class and then accessed the schema using the property like this.
$Forest = [DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
$Forest.Schema
This worked find and gave me the Schema object I was after but information I got back was minimal. It only returned Schema Role Owner and the Distinguished Name. I found that if you want to get real data like the classes and properties you needed to call methods on object (
DirectoryServices.ActiveDirectory.ActiveDirectorySchema) returned from Schema property.
At this point it is not all that complicated but I thought it would be nice to have functions that would abstract all this.
Below is a couple of functions you may find useful. They work both V1 and V2 of Powershell.
Get-Forest : Gets the Forest Object
- DomainController [optional] - DNS Name of the Host to connect to
- Credential [optional] - Network credentials to use.
Get-ADSchema : Gets the Schema
- DomainController [optional] - DNS Name of the Host to connect to
- Credential [optional] - Network credentials to use.
Get-ADSchemaClass : Gets a specific Schema Class
- Class [optional] - Class Object to get (Default is all)
- DomainController [optional] - DNS Name of the Host to connect to
- Credential [optional] - Network credentials to use.
Get-ADSchemaProperty : Gets a specific Schema Property
- Property [optional] - Property to get (Default is all)
- DomainController [optional] - DNS Name of the Host to connect to
- Credential [optional] - Network credentials to use.
NOTE: These will be included in my "Soon to be available" BSONPOSH module (v2 only.)
function Get-Forest
{
Param($DomainController,[Management.Automation.PSCredential]$Credential)
if(!$DomainController)
{
[DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
return
}
if($Creds)
{
$Context = new-object DirectoryServices.ActiveDirectory.DirectoryContext("DirectoryServer",$DomainController,$Creds.UserName,$Creds.GetNetworkCredential().Password)
}
else
{
$Context = new-object DirectoryServices.ActiveDirectory.DirectoryContext("DirectoryServer",$DomainController)
}
[DirectoryServices.ActiveDirectory.Forest]::GetForest($Context)
}
function Get-ADSchema
{
Param($DomainController,[Management.Automation.PSCredential]$Credential)
if($DomainController -and !$Credential)
{
$Forest = Get-Forest -DNSName $DomainController
}
elseif($DomainController -and $Credential)
{
$Forest = Get-Forest -DNSName $DomainController -Credential $Credential
}
else
{
$Forest = Get-Forest
}
$Forest.Schema
}
function Get-ADSchemaClass
{
Param($Class = ".*",$DomainController,[Management.Automation.PSCredential]$Credential)
if($DomainController -and !$Credential)
{
$Forest = Get-Forest -DNSName $DomainController
}
elseif($DomainController -and $Credential)
{
$Forest = Get-Forest -DNSName $DomainController -Credential $Credential
}
else
{
$Forest = Get-Forest
}
$Forest.Schema.FindAllClasses() | ?{$_.Name -match "^$Class`$"}
}
function Get-ADSchemaProperty
{
Param($Property = ".*",$DomainController,[Management.Automation.PSCredential]$Credential)
if($DomainController -and !$Credential)
{
$Forest = Get-Forest -DNSName $DomainController
}
elseif($DomainController -and $Credential)
{
$Forest = Get-Forest -DNSName $DomainController -Credential $Credential
}
else
{
$Forest = Get-Forest
}
$Forest.Schema.FindAllProperties() | ?{$_.Name -match "^$Property`$"}
}
tshell :: Aug.25.2009 ::
Active Directory, All ::
No Comments »
