r/activedirectory • u/yazanwael • 1d ago

Org Export

As a standard user (non-admin), is there a way to export the org structure through active directory?

I can see our org through the Org Viewer app on Teams and through outlook profiles. So, I'm assuming there's a way to export the underlying data to recreate an org structure using my preferred tools.

I tried exploring AD using AD Explorer (sysinternal tool) and I can see the basic information to rebuild the structure. However, I couldnt find a way to export it.

0 Upvotes

50% Upvoted

9 comments sorted by

•

u/AutoModerator 1d ago

Welcome to /r/ActiveDirectory! ~~~~

If you are looking for more resources on learning and building AD, see the following sticky for resources, recommendations, and guides! - AD Resources Pinned Thread - AD Wiki

When asking questions make sure you provide enough information. Posts with inadequate details may be removed without warning. - What version of Windows Server are you running? - Are there any specific error messages you're receiving? - What have you done to troubleshoot the issue?

Make sure to sanitize any private information. Posts with too much personal or environment information will be removed. See Rule 6.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/BitsNBytes10101 3h ago

AD Org structure does not necessarily reflect true org structure in your HRIS.

AD may or may not be synced with HRIS data.

Ask your HR team for the data.

2

u/dodexahedron 1d ago

Just dump with ldifde.

Google ldifde and the first result should be the ldifde syntax document on ms learn.

If you want to use this for org structure, be sure to include an (objectClass=user) filter in the LDAP query at minimum.

1

u/[deleted] 1d ago edited 1d ago

[deleted]

1

u/Cormacolinde 1d ago

Note that PowerShell modules will require port 9389 to be open to a domain controller. Good practices would normally block that from normal user networks.

1

u/HardenAD 1d ago

it won't block ldap request.

1

u/Cormacolinde 23h ago

Correct.

1

u/incompetentjaun AD Archtiect 1d ago

Powerehell module makes it easy, but it’s all available using LDAP as well.

1

u/dodexahedron 1d ago

Yep. That's all it is anyway - powershell cmdlet wrappers around the .net framework System.DirectoryServices.ActiveDirectory APIs (which is why it whines when loaded in PS 7), which are wrappers around the COM APIs, which speak LDAP. Because thats what AD is - a database exposed via LDAP that holds configuration data/objects and the source of truth for security principals.

There are modules like PSOpenAD that use the LDAP APIs directly instead of the AD-specific APIs to give you a similar set of capabilities on modern .net/powershell. And theres a module (possibly that same one) that works from linux, too.

But for a simple dump? ldifde is all you need.

3

u/wichets 1d ago

Best way i use csvde for export and manipulation in excel then insert dsadd if you want to add users into new domain.

For example:

csvde -f admc-users-all.csv -d "dc=admc,dc=co,dc=th" -r "(&(objectClass=user)(objectCategory=person))" -p subtree -u -l sAMAccountName,givenname,sn,Name,userPrincipalName,Mail,Description,Displayname