Managing user accounts in an Active Directory (AD) environment is one of the most routine yet critical responsibilities of any system administrator. Whether you are conducting an audit, preparing a migration, or simply keeping track of your organization’s users, having a reliable way to extract account data is essential.
One of the most commonly needed pieces of information is the SAMAccountName — the logon name used by users to authenticate against the domain. In this post, we will walk through how to use PowerShell to extract SAMAccountNames from Active Directory and export them into a structured file that can be opened in Microsoft Excel.
What Is a SAMAccountName?
The Security Account Manager (SAM) Account Name is a unique identifier assigned to each user or computer object in an Active Directory domain. It is the value users typically type when logging in with the format DOMAIN\username. Every active account in your organization has one, making it a foundational attribute for any user inventory or reporting task.
Prerequisites
Before running any of the scripts covered in this guide, ensure the following conditions are met:
- PowerShell is installed and accessible on your machine (version 5.1 or later is recommended).
- The Active Directory PowerShell module is available. This is included with the Remote Server Administration Tools (RSAT) package, or it is natively available on a Domain Controller.
- The account used to run the scripts has at least read permissions on Active Directory objects.
- The export destination folder (e.g.,
C:\Exports\) exists on the machine before the script runs.
Script 1: Exporting All SAMAccountNames to CSV
The most straightforward approach is to retrieve every user object in Active Directory and export their SAMAccountNames to a CSV file. This format is fully compatible with Microsoft Excel and requires no additional modules.
# Import the Active Directory module
Import-Module ActiveDirectory
# Get all AD users and export SAMAccountName to CSV
Get-ADUser -Filter * -Properties SamAccountName |
Select-Object SamAccountName |
Export-Csv -Path "C:\Exports\SAMAccounts.csv" -NoTypeInformationHow It Works
- Import-Module ActiveDirectory — Loads the Active Directory module into the current PowerShell session, making AD-related cmdlets available.
- Get-ADUser -Filter * — Queries Active Directory and retrieves all user objects without any filtering criteria. The
-Propertiesparameter specifies which attributes to include in the results. - Select-Object SamAccountName — Narrows the output to only the SAMAccountName attribute, keeping the exported data clean and focused.
- Export-Csv — Writes the results to a CSV file at the specified path. The
-NoTypeInformationflag removes the metadata header line that PowerShell would otherwise include at the top of the file.
Limitation
This script retrieves all user accounts, including those that have been disabled. In many scenarios — such as license audits or access reviews — disabled accounts should not be included. The next script addresses this directly.
Script 2: Exporting Only Active SAMAccountNames to CSV
When the goal is to work exclusively with accounts that are currently enabled and in use, a simple filter can be applied to exclude disabled users.
# Import the Active Directory module
Import-Module ActiveDirectory
# Get only ACTIVE AD users and export SAMAccountName to CSV
Get-ADUser -Filter {Enabled -eq $true} -Properties SamAccountName |
Select-Object SamAccountName |
Export-Csv -Path "C:\Exports\SAMAccounts.csv" -NoTypeInformationHow It Works
The key change in this version is the filter condition:
- -Filter {Enabled -eq $true} — This instructs the cmdlet to return only user objects where the
Enabledattribute is set toTrue, meaning the account is active and not disabled in Active Directory.
Everything else in the script behaves identically to the first version. The result is a clean CSV file containing only the SAMAccountNames of users who currently have access to the domain.
Optional: Including the Enabled Status in the Output
If you want the exported file to explicitly confirm the enabled state of each account — useful for documentation or audit trails — you can add the Enabled property as an additional column:
Import-Module ActiveDirectory
Get-ADUser -Filter {Enabled -eq $true} -Properties SamAccountName, Enabled |
Select-Object SamAccountName, Enabled |
Export-Csv -Path "C:\Exports\SAMAccounts.csv" -NoTypeInformation
This produces a two-column file where every row will show True under the Enabled column, giving the reader immediate visual confirmation of the account status.
Practical Considerations
Scoping to a Specific Organizational Unit
If your Active Directory structure uses Organizational Units (OUs) and you only need users from a specific department or location, you can limit the search scope using the -SearchBase parameter:
Get-ADUser -Filter {Enabled -eq $true} -SearchBase "OU=Finance,DC=company,DC=com" -Properties SamAccountName |
Select-Object SamAccountName |
Export-Csv -Path "C:\Exports\FinanceSAMAccounts.csv" -NoTypeInformationRunning the Script on a Non-Domain Controller
These scripts do not need to be executed directly on a Domain Controller. Any Windows machine with the RSAT tools installed and network connectivity to the domain can run them. Simply open PowerShell as an administrator and ensure the Active Directory module is available.
File Output Location
The path C:\Exports\ used in the examples is arbitrary. You can change it to any location accessible to the account running the script, including network shares.
Conclusion
PowerShell provides a straightforward and reliable way to extract user data from Active Directory without the need for third-party tools. The scripts covered in this guide are intentionally simple, making them easy to adapt for broader reporting needs. Whether you need a full account inventory or a filtered list of active users, these scripts serve as a solid foundation for any AD management workflow.
As a next step, consider scheduling these scripts as automated tasks to generate regular reports, or extend them to include additional attributes such as display names, email addresses, department information, or last logon dates.