How to Use PowerShell to Export Active Directory Users to a CSV File

Introduction

System administrators frequently need to audit their Active Directory (AD) environment. Whether you are preparing for a migration, conducting a security review to find disabled accounts, or simply generating a staff directory for HR, exporting AD users is a common task. While the graphical Active Directory Users and Computers (ADUC) tool is useful, PowerShell offers far more flexibility and speed. This guide demonstrates how to use the Get-ADUser cmdlet to export user data to a CSV file.

Prerequisites

To run these commands, you must run PowerShell as an Administrator and have the Active Directory module installed. This module is part of the Remote Server Administration Tools (RSAT). You can install it via the Windows Settings app or by running Install-WindowsFeature RSAT-AD-PowerShell on a Windows Server.

Step 1: The Basic Export

The core cmdlet is Get-ADUser. By default, it returns a limited set of properties for all users. To export a basic list of all enabled users:

Get-ADUser -Filter 'Enabled -eq $true' | Export-Csv -Path "C:\temp\enabled_users.csv" -NoTypeInformation

The -Filter 'Enabled -eq $true' parameter ensures disabled accounts (like service accounts or departed employees) are omitted. The -NoTypeInformation flag prevents PowerShell from writing an annoying header string to the first line of the CSV.

Step 2: Retrieving Specific Properties

Often, you need more than just the default properties (Name, SamAccountName, DistinguishedName). You must instruct Get-ADUser to fetch extended properties from the domain controller.

Get-ADUser -Filter * -Properties EmailAddress, Title, Department, LastLogonDate | Select-Object Name, SamAccountName, EmailAddress, Title, Department, LastLogonDate | Export-Csv -Path "C:\temp\detailed_users.csv" -NoTypeInformation

In this command:

• -Properties fetches the extra fields from AD.
• Select-Object filters the output so your CSV only contains the exact columns you want, in the order you specify.

Step 3: Exporting Users from a Specific Organizational Unit (OU)

If you have thousands of users, querying the entire directory can be slow. You can target a specific OU using the -SearchBase parameter.

Get-ADUser -Filter * -SearchBase "OU=Sales,OU=Users,DC=company,DC=com" -Properties EmailAddress | Select-Object Name, EmailAddress | Export-Csv -Path "C:\temp\sales_users.csv" -NoTypeInformation

Step 4: Finding Stale Accounts

A common security practice is identifying accounts that haven’t logged in recently. You can filter based on the LastLogonDate property.

$Date = (Get-Date).AddDays(-90)
Get-ADUser -Filter 'LastLogonDate -lt $Date -and Enabled -eq $true' -Properties LastLogonDate | Select-Object Name, LastLogonDate, SamAccountName | Export-Csv -Path "C:\temp\stale_users.csv" -NoTypeInformation

This script calculates the date 90 days ago and queries for all enabled users who haven’t logged in since before that date.

Conclusion

Mastering the Get-ADUser cmdlet combined with Export-Csv allows you to quickly generate tailored reports about your Active Directory environment, automating tasks that would take hours to complete manually in the GUI.