Export Active Directory User List: PowerShell, CSV, and Built-In Tools for Auditing and Reporting

Export Active Directory User List in Minutes with PowerShell or Built-In Tools

A user list export from Active Directory is essential for access reviews, compliance audits, and onboarding reports. Whether you need a filtered CSV of disabled accounts, a full directory snapshot, or a quick roster for a security review, the same core workflow applies: connect to AD, query users, select attributes, and save the results. PowerShell is the fastest method, but you can also use built-in GUIs or third-party consoles if your environment prefers clicks over scripts. This guide focuses on the reliable, repeatable approach an admin can use in production without installing extra software.

Why You Need a Clean User List Export

Exporting a user list gives you an auditable record of who has access, which accounts are disabled or stale, and how attributes like department or title map across your directory. A well-formatted list supports access recertification, helps onboard new hires by showing existing group memberships, and provides raw data for SIEM or HR sync jobs. Without it, reports rely on guesswork and manual screenshots that break every month.

Prerequisites and Permissions

You need a domain-joined workstation with the ActiveDirectory PowerShell module installed (ships with RSAT on Windows 10/11 and Windows Server). Your account must have at least read access to user objects in the target OU or domain. For large directories, a dedicated service account avoids prompting and throttling issues. Confirm the module is loaded with Get-Module ActiveDirectory before running the commands below.

Export All Users to CSV with PowerShell

The simplest export pulls every user and writes selected properties to a CSV file. Run the following from an elevated PowerShell prompt on a domain-joined machine:

Get-ADUser -Filter * -Properties DisplayName,EmailAddress,Enabled,LastLogonDate,Department,Title | Select-Object Name,SamAccountName,DisplayName,EmailAddress,Enabled,LastLogonDate,Department,Title | Export-Csv -Path "C:\ADExports\AllUsers.csv" -NoTypeInformation -Encoding UTF8

This gives you a flat file with Name, SamAccountName, email, account status, last logon, department, and title. Adjust the path and properties to fit your needs. Use -Properties to include attributes not returned by default.

Filter for Disabled or Stale Accounts

To export only disabled users, add a where clause:

Get-ADUser -Filter {Enabled -eq $false} -Properties DisplayName,EmailAddress,LastLogonDate,Department,Title | Select-Object Name,SamAccountName,DisplayName,EmailAddress,Enabled,LastLogonDate,Department,Title | Export-Csv -Path "C:\ADExports\DisabledUsers.csv" -NoTypeInformation -Encoding UTF8

You can combine filters to target stale accounts, for example users who have not logged on in 90 days:

Get-ADUser -Filter {Enabled -eq $true} -Properties DisplayName,LastLogonDate | Where-Object { $_.LastLogonDate -lt (Get-Date).AddDays(-90) } | Select-Object Name,SamAccountName,LastLogonDate | Export-Csv -Path "C:\ADExports\StaleUsers.csv" -NoTypeInformation -Encoding UTF8

Use a Specific OU or Domain

Limit the export to an organizational unit or domain to avoid pulling every object in the forest:

Get-ADUser -Filter * -SearchBase "OU=Employees,DC=contoso,DC=com" -Properties DisplayName,EmailAddress | Export-Csv -Path "C:\ADExports\Employees.csv" -NoTypeInformation -Encoding UTF8

For a multi-domain environment, specify -Server to target a particular domain controller:

Get-ADUser -Filter * -Server "DC01.contoso.com" -Properties DisplayName,EmailAddress | Export-Csv -Path "C:\ADExports\ContosoUsers.csv" -NoTypeInformation -Encoding UTF8

Schedule a Daily or Weekly Export

For recurring exports, wrap the command in a scheduled task or a PowerShell script called by Task Scheduler. Use -Append with Export-Csv to add to an existing file, or use Import-Csv to merge daily runs into a single log over time. Store exports in a shared folder with appropriate file permissions so only auditors can read the output.

Get-ADUser -Filter * -Properties DisplayName,EmailAddress,Enabled,LastLogonDate | Select-Object Name,SamAccountName,DisplayName,EmailAddress,Enabled,LastLogonDate | Export-Csv -Path "\\FileServer\ADExports\DailyUsers.csv" -NoTypeInformation -Encoding UTF8 -Append

Use the Active Directory Administrative Center (ADAC) GUI

If you prefer clicks, open ADAC and navigate to the target OU. Click the Tasks menu and choose Export List. You can select columns and apply basic filters, then save the output as a CSV for reporting. The GUI method is slower for large directories but requires no scripting knowledge. It still uses the underlying AD PowerShell provider, so the results mirror what you get with Get-ADUser.

Pitfalls to Avoid

• Default properties often omit email or display name; always specify -Properties for the fields you need.
• LastLogonDate is not updated on every DC, so for accurate stale-user reports query multiple domain controllers or use the LastLogon attribute (which requires per-user collection).
• Large exports can be slow; consider paging with -ResultSetSize or filtering early to limit memory use.
• Save credentials securely if running exports from a scheduled script on a service account; avoid hardcoding passwords in plain text.

Alternative Built-In Tools

DSQuery and CSVDE (legacy command-line tools) can also export user lists, but they return limited attributes and may require format conversion. PowerShell is the recommended path for modern Windows environments because it supports filtering, sorting, and selecting exactly the properties you need. For directories with mixed object types, add -SearchScope and -Filter to avoid exporting computers, groups, or service accounts unless intended.

Summary

An export active directory user list workflow should be repeatable, filtered, and scheduled to keep reports useful without manual effort. PowerShell with Get-ADUser and Export-Csv remains the standard method, while ADAC provides a fallback for teams that prefer GUI-driven workflows. Always verify the columns match your compliance or audit requirements, and store the file securely after export.