I saw a posting that had a piece on AdFind at ActiveDir.org that made me want to post something to my blog here for anyone who doesn’t read ADOrg…
Basically one of the posters came up with a good way of setting local admin passwords on machines and part of the solution was to use adfind to get the list of machines. I was thrilled to see that but the command line was a little longer than needed but I don’t blame the poster… That is actually an issue with AdFind because there are soooo many options, sometimes you don’t see the cool option that you need. So in case anyone else is doing anything similar… here is some help for you
Basically the command used was
adfind -b ou=prodservers,ou=computers,dc=contoso,dc=com -f “objectcategory=computer” cn -nolabel -nodn | grep -iv “Objects returned” | grep -iv “Directory” | grep -iv “Using Server” | grep -iv “^$” > d:\servers.txt
The goal here is to get a list of computer names that doesn’t have my “shameless” AdFind Banner in the listing… I actually have an option explicitly to help with that when listing a single attribute… that option is called… -list
So instead of the command above using the grep’s to filter out some of the output, you can instead do something like
adfind -b ou=prodservers,ou=computers,dc=contoso,dc=com -f “objectcategory=computer” cn -list > d:\servers.txt
Much simpler, much cleaner, more pretty. 🙂
And in the spirit of perl… there is more than one way to slice this orange… You could also do something like
adfind -b ou=prodservers,ou=computers,dc=contoso,dc=com -f “objectcategory=computer” cn -nodn -nocsvheader -csv > d:\servers.txt
Granted that isn’t as elegant but it does quote the server names for you if you need them quoted.
Probably the one functional change I would make overall would be to dump the dNSHostName attribute instead of the cn/name. Why you ask? Well my dear reader, because you don’t have to rely on short hostname resolution… I would also change the filter to be an AND of the computer objectcategory tied together with dNSHostName having a value. If that attribute isn’t populated on the computer, it means the computer hasn’t successfully spoken to AD yet, why waste time on it? So how about…
adfind -b ou=prodservers,ou=computers,dc=contoso,dc=com -f “&(objectcategory=computer)(dnshostname=*)” dnshostname -list > d:\servers.txt
joe