There are several ways to export Active Directory users to CSV. In this guide, I’ll show you how to export users with PowerShell and the AD Pro Toolkit.
Export AD Users to CSV with PowerShell
You will need the RSAT tools installed, or run these commands directly on a domain controller.
Step 1. Open PowerShell as administrator
Step 2. Run the following command to export all users to CSV:
Get-ADUser -Filter * -Properties DisplayName, EmailAddress, Department |
Select-Object Name, DisplayName, EmailAddress, Department |
Export-Csv c:\reports\ad-users.csv -NoTypeInformation -Encoding UTF8
Why you need both -Properties and Select-Object
Get-ADUser returns only a small set of default properties. Anything else,
including EmailAddress and Department, has to be requested with -Properties
first, and Select-Object then picks which of those columns end up in the
CSV. If you select a column without requesting it, the column still appears
but comes back empty, which is why this usually looks like a broken export
rather than a missing parameter.
Export and include all attributes
Get-ADUser -Filter * -Properties * | Export-Csv c:\reports\all-users.csv -NoTypeInformation
This pulls every attribute on every account, which is useful when you are looking for a property and do not know its name. It is slow on a large domain and produces a very wide file, so once you know which attributes you need, name them instead of using *.
Export Active Directory Users to CSV with AD Pro Toolkit
The AD Pro Toolkit makes it easy to export a user list from Active Directory without PowerShell. It includes built-in reports that can be exported to CSV, Excel, or PDF with a few clicks. It’s one of 200+ built-in reports in the AD reporting tool.
Why use AD Pro Toolkit to export users
- No scripts to write or maintain, and no PowerShell knowledge needed
- Filter by OU, group, department or account status from the interface instead of editing a filter
- Export to CSV, Excel, or PDF from the same report
- Schedule the report to run automatically and email the file to whoever needs it
Step 1. Click on the All Users Report
Step 2. Click “Run Report” to list users from Active Directory
Tip: By default, it will list all users. You can click “Browse” to list users from a specific OU. You can also filter the list to get specific users, such as disabled, by department, by OU and so on.
Step 3. Click the “Export” button to export the list.
You can add or remove additional attributes to the export by clicking the "Columns" button.
Export CSV Example
Export AD Users from a Specific OU
With PowerShell use the -SearchBase parameter with the OU’s distinguished name:
Step 1. Find the OU's distinguished name
Get-ADOrganizationalUnit -Filter "Name -eq 'Sales'" | Select-Object DistinguishedName
That returns something like OU=Sales,DC=ad,DC=activedirectorypro,DC=com. You can also read it from the Attribute Editor tab in Active Directory Users and Computers, but the command is quicker and gives you a string you can paste straight into the next step.
Step 2. Run the export with -SearchBase
Get-ADUser -Filter * -SearchBase "OU=Sales,DC=ad,DC=activedirectorypro,DC=com" -Properties DisplayName, EmailAddress, Department | Select Name, DisplayName, EmailAddress, Department | Export-Csv c:\reports\sales-users.csv -NoTypeInformation
Child OUs are included by default
-SearchBase searches the whole subtree, so any OUs nested inside Sales are exported too. Add -SearchScope OneLevel if you want only the accounts sitting directly in that OU. This is the usual reason an export comes back with more rows than expected.
With the AD Pro Toolkit
Click "Browse OU" and select the OU. No distinguished name to look up.
Common Attributes to Export
Anything in this list has to be named in -Properties before you can select it.
| Attribute | What it is |
|---|---|
EmailAddress |
Primary email address |
Department |
Department field |
Title |
Job title |
Manager |
Manager, returned as a distinguished name |
Office |
Office location |
OfficePhone |
Telephone number |
Enabled |
Whether the account is enabled |
LastLogonDate |
Approximate last logon |
PasswordLastSet |
When the password was last changed |
whenCreated |
When the account was created |
Troubleshooting Common Errors
The term 'Get-ADUser' is not recognized
The Active Directory module is not available on the machine you are running from. Install the RSAT tools, or run the command on a domain controller where the module is already present. If RSAT is installed and you still get this, load the module first with Import-Module ActiveDirectory.
Access is denied
The account you are running as cannot read the attribute you asked for. Most user attributes are readable by any authenticated account, but some are restricted, so run PowerShell as an account with the rights you need or pass one with -Credential.
The CSV has the right rows but the columns are empty
The attribute was selected but never requested. Add it to -Properties as well as Select-Object, as covered further up this page. This is the single most common reason an export looks broken.
Could not find a part of the path
The folder in your Export-Csv path does not exist. PowerShell will create the file but not the directory above it, so create the folder first or point the export somewhere that already exists.
The export is very slow
You are most likely using -Properties *, which pulls every attribute on every account. Name the handful of attributes you actually need instead.
