AD Pro Toolkit has ready-made reports for users, groups, computers, OUs, contacts and Group Policy. They all work the same way: open one, narrow it down, choose the columns, and export it.
Where the data comes from
Reports read AD Pro Toolkit's own copy of your directory, which is synced every 30 minutes. That's why they open quickly, even on a large domain, without putting load on your domain controllers.
So a change made in Active Directory a few minutes ago may not show yet. It appears after the next sync. The sync status is shown in the title bar.
A few reports read live instead. See Reports that work differently.
Find a report
Go to Reports. The menu groups reports by object type:
| Group | Reports on |
|---|---|
| Users | General, Account status, Logon, Membership, Managers, Passwords, Security and Data quality reports. |
| Groups | General and membership reports. |
| Computers | General, computer status and operating system reports. |
| Directory | Organizational units, contacts and Group Policy. |
| Hybrid | Active Directory compared with Microsoft 365. |
For example, Reports > Users > Account status has reports for disabled, locked out and expired accounts.
Narrow down a report
All of these can be combined. For example, disabled users, in the Sales OU, whose department is Marketing.
- Search: type in the search box to match the name, logon name, UPN or email address.
- OU: select OU: All to choose one or more OUs. OUs nested inside them are included.
- Time period: reports about time, such as inactive accounts, have a dropdown to choose the number of days.
- Filter: select Filter to build conditions on any column. See Filter on any column.
Select a column header to sort by it, and select it again to reverse the order.
Filter on any column
- Select Filter.
- Select Add condition.
- Choose a column, a condition and a value. For example, Department, Equals,
Sales. - Add more conditions if you need them, and choose whether to match All conditions (AND) or Any condition (OR).
- Select Apply.
The button then shows how many conditions are on, for example Filter (2). To remove them, open it again and select Clear all.
The filter narrows the report you're on, and never widens it. On the Disabled Users report, a filter for a department still only shows disabled users.
Date columns have conditions that move with time, such as More than N days ago and Within the last N days. Use these instead of a fixed date when you'll run the same report again later.
Choose the columns
- Select Columns.
- Tick the columns you want, and untick the ones you don't.
Your choice is saved for that report, for you only. To report on an Active Directory attribute that isn't in the list, add it as a custom attribute.
Export a report
Select Export and choose Excel, CSV or PDF. The export includes every row that matches your search and filters, not just the page on screen, with the columns you've chosen.
To get a report by email on a schedule, see Scheduled reports.
Reports that work differently
- True Last Logon reads every domain controller directly when you select Run report. Active Directory doesn't copy each logon between domain controllers, so this is the accurate answer to "when did this person last sign in?". It takes longer than other reports on a large domain.
- Deleted Users reads deleted accounts directly from Active Directory. By default only admins can see deleted objects, so AD Pro Toolkit's service account needs extra read access for this report.
- Hybrid reports compare each Active Directory account with Microsoft 365, read live when you select Run report. They need a Microsoft 365 connection.
Things to know
- What you see depends on your role. If your role is limited to some OUs, reports only show objects in those OUs.
- Reports never change anything. To act on what a report finds, use Tools.