System.DirectoryServices.DirectorySearcher not picking up all the users

Question

I'm trying to make a backup of user attributes for multiple domains. I need to export all users to a csv file for each domain. Get-QADUser has been found to take 72 hours on one domain which is to slow. Instead I am using ``.

For some reason, on several domains it is not picking up all the users and I'm not sure why. Here is my code...

function CreateQueriedCsvDataSheet
{
    $csvFileWithPath = 'C:\Scripts\Tests\testResults.csv'
    $DomainControlConnector = 'www.example.com'
    $DomainName = 'myDomain1'
    $domainUserProperties = @('sAMAccountName', 'msRTCSIP-UserEnabled', 'msRTCSIP-OptionFlags', 'msRTCSIP-PrimaryUserAddress', 'msRTCSIP-PrimaryHomeServer', 
    'mail', 'msExchMasterAccountSid', 'homeMDB', 'proxyaddresses', 'legacyExchangeDN', 
    'lastLogonTimestamp', 'logonCount', 'lastLogoff', 'lastLogon', 'pwdLastSet', 'userAccountControl', 'whenCreated', 'whenChanged', 'accountExpires', 
    'sn', 'givenName', 'displayName', 'distinguishedName', 'initials', 'l', 'st', 'street', 'title', 'description', 'postalCode', 'physicalDeliveryOfficeName', 'telephoneNumber', 'facsimileTelephoneNumber', 'info', 'memberOf', 'co', 'department', 'company', 'streetAddress', 'employeeNumber', 'employeeType', 'objectGUID', 'employeeID', 'homeDirectory', 'homeDrive', 'scriptPath', 'objectSid', 'userPrincipalName', 'url', 'msDS-SourceObjectDN', 'manager', 'extensionattribute8')

    Logger $LogFileWithPath "Querying $DomainName for user account attributes and exporting to csv file $csvFileWithPath..."
    powershell -Command {
        Param ([string]$domainControlConnector, [string]$csvOutFile, [string]$DomainName, [String[]]$domainUserProperties)
        $domain = "LDAP://$domainControlConnector"

        Write-Host "Searching Users Properties for domain $DomainNamein in AD..."
        $adDomain = New-Object System.DirectoryServices.DirectoryEntry($domain)
        $adSearcher = New-Object System.DirectoryServices.DirectorySearcher($adDomain)
        $adSearcher.Filter = '(objectCategory=User)'
        $adSearcher.PageSize=1000
        $adSearcher.PropertiesToLoad.AddRange($domainUserProperties)
        $userRecords = $adSearcher.FindAll()
        Write-Host "Complete"

        # The AD results are converted to an array of hashtables.
        Write-Host "Exporting User Attributes to table..."
        $userPropertiesTable = @()
        foreach($record in $userRecords) {
            $hashUserProperty = @{}
            foreach($userProperty in $domainUserProperties){
                if ($record.Properties[$userProperty]) {
                    $hashUserProperty.$userProperty = $record.Properties[$userProperty][0]
                } else {
                    $hashUserProperty.$userProperty = $null
                }
            }
            $userPropertiesTable += New-Object PSObject -Property $hashUserProperty
        }
        Write-Host "Complete."

        $listOfBadDateValues = '9223372036854775807', '9223372036854770000', '0'
        $maxDateValue = '12/31/1600 5:00 PM'

        Write-Host "fixing table property titles and values for report"
        #$userPropertiesTable[0] = $userPropertiesTable[0] -replace 'givenname','FirstName'

        $tableFixedValues = $userPropertiesTable | % { 
            if ($_.lastLogonTimestamp) {
                $_.lastLogonTimestamp = ([datetime]::FromFileTime($_.lastLogonTimestamp)).ToString('g')
            }; if (($_.AccountExpires) -and ($listOfBadDateValues -contains $_.AccountExpires)) {
                $_.AccountExpires = $null
            } else {
                if (([datetime]::FromFileTime($_.AccountExpires)).ToString('g') -eq $maxDateValue) {
                    $_.AccountExpires = $null
                } Else {
                    $_.AccountExpires = ([datetime]::FromFileTime($_.AccountExpires)).ToString('g')
                }
            }; if (($_.lastLogon) -and ($listOfBadDateValues -contains $_.lastLogon)) {
                $_.lastLogon = $null
            } else {
                if (([datetime]::FromFileTime($_.lastLogon)).ToString('g') -eq $maxDateValue) {
                    $_.lastLogon = $null
                } Else {
                    $_.lastLogon = ([datetime]::FromFileTime($_.lastLogon)).ToString('g')
                }
            }; if (($_.pwdLastSet) -and ($listOfBadDateValues -contains $_.pwdLastSet)) {
                $_.pwdLastSet = $null
            } else {
                if (([datetime]::FromFileTime($_.pwdLastSet)).ToString('g') -eq $maxDateValue) {
                    $_.pwdLastSet = $null
                } Else {
                    $_.pwdLastSet = ([datetime]::FromFileTime($_.pwdLastSet)).ToString('g')
                }
            };$_}
        Write-Host "Complete"

        Write-Host "Exporting table to csv file $csvOutFile"
        $tableFixedValues | Select-Object $domainUserProperties | Export-Csv $csvOutFile -NoTypeInformation -Force
        Write-Host "Complete"
    } -args $DomainControlConnector, $csvFileWithPath, $DomainName, $domainUserProperties
}

Function Main
{
    CreateQueriedCsvDataSheet

}

Main

Note: I also noticed for memberOf attribute, not all the groups are being listed for the user...

Update with TheMadTechnician's answer.

Currently working with code snippet...

    # The AD results are converted to an array of hashtables.
    Write-Host "Exporting User Attributes to table..."
    $userPropertiesTable = @()
    foreach($record in $userRecords) {
        $hashUserProperty = @{}
        foreach($userProperty in $domainUserProperties){
            if (($userProperty -eq 'objectGUID') -or ($userProperty -eq 'objectSid')) {
                if ($record.Properties[$userProperty]) {
                    $hashUserProperty.$userProperty = $record.Properties[$userProperty][0]
                } else {
                $hashUserProperty.$userProperty = $null
                }
            } Else {
                if ($record.Properties[$userProperty]) {
                    $hashUserProperty.$userProperty = ($record.Properties[$userProperty] -join '; ').trim('; ')
                } else {
                $hashUserProperty.$userProperty = $null
                }
            } #end Else
        } #end ForEach
        $userPropertiesTable += New-Object PSObject -Property $hashUserProperty
    } #end ForEach
    Write-Host "Complete."

Answer 1

Ok, here's my Switch example to clean up your If/Else block.

$tableFixedValues = Switch($userPropertiesTable){ 
            {$_.lastLogonTimestamp} {$_.lastLogonTimestamp = ([datetime]::FromFileTime($_.lastLogonTimestamp)).ToString('g')}
            {($_.AccountExpires) -and ($listOfBadDateValues -contains $_.AccountExpires) -or ([datetime]::FromFileTime($_.AccountExpires)).ToString('g') -eq $maxDateValue} {$_.AccountExpires = $null}
            {$_.AccountExpires} {([datetime]::FromFileTime($_.AccountExpires)).ToString('g')}
            {$listOfBadDateValues -contains $_.lastLogon -or ([datetime]::FromFileTime($_.lastLogon)).ToString('g') -eq $maxDateValue} {$_.lastLogon = $null}
            {$_.lastLogon} {$_.lastLogon = ([datetime]::FromFileTime($_.lastLogon)).ToString('g')}
            {($_.pwdLastSet) -and ($listOfBadDateValues -contains $_.pwdLastSet) -or (([datetime]::FromFileTime($_.pwdLastSet)).ToString('g') -eq $maxDateValue)} {$_.pwdLastSet = $null}
            {$_.pwdLastSet} {$_.pwdLastSet = ([datetime]::FromFileTime($_.pwdLastSet)).ToString('g')}
            default {$_}
}

That should effectively do the same thing as what you had going.

Now, for your memberOf issue, I'm betting that this change will resolve that for you:

$hashUserProperty.$userProperty = ($record.Properties[$userProperty] -join '; ').trim('; ')

That will take any collections and make them a single semicolon joined item (better for exporting to CSV), and if it's a collection with empty values it will remove extra semicolons and spaces afterwards.

CSV is not a good format for including memberOf, because it does not manage nested arrays very well. That is why I have joined the memberOf collection into a single string. If you want to preserve the format better you either need to iterate for all items in memberOf, or, probably better, use a format that does handle nested arrays such as XML or JSON.