Who… What… Where…

There are a number of ways to query the Active Directory database to export objects and there attributes. One of the most common groups of tools are provided by Microsoft; dsget and dsquery.

Query Group Members

To display the member of a specific group use the dsget group command

dsget group “CN=My Group,OU=Domain Groups,DC=Domain,DC=co,DC=uk” -members

The above command will list the UPN of the users in My Group, if more information is required from each of the users within My Group the output can be piped into another dsget command

To display the member of a specific group use the dsget group command

dsget group “CN=My Group,OU=Domain Groups,DC=Domain,DC=co,DC=uk” -members | dsget user -upn -display -disabled -acctexpires

This commnd above will list the users in the group My Group with there UPN, display name, if the account is disabled and when the account expires.

The command line tool tasklist without any switches will simply display the local currently running processes and if the /S parameter is used process’s running on a remote machine can be queried.

Now all of this isn’t really worth writing about you might say, however one switch that I found useful was the command tasklist /svc ; this will display a list of all running processes along with any related services attached to that process.