PowerShell/SCSM - Retrieving Active Directory Object Classes

Following my previous post, today I continue my SCSM journey. I had to create a new automation workflow using SCSM and SCORCH to give the ability to a portal user to add an Active Directory Account to one or more group(s).

Once you get the input of the user, the selected user account and groups impacted by the request are added to the Service Request Related Item, in the Configuration Item field.

Finding this information with PowerShell was not easy. Also Users and Groups are tagged as "User Class" and we want to avoid querying the Active Directory to verify is a user is really a user and a group... really a group object.

Here is an example of Service Request using the SCSM Console:

See the objects highlighted, those are stored in the CMDB of SCSM and not in AD.
We properly see the class of each objects.

Retrieving this information with PowerShell/Smlets module

Using PowerShell with the SMlets module, this information is not easily accessible.
The problem: We can't tell if an object is an user or a group. Computer however shows correctly as computer object.

# Get a single ticket with AD objects
$SRTicket = Get-SCSMObject -Id 992315e4-a94c-6e35-2720-51fe9808f903

# Get all the classes of the first object (which is a group in this case)
((Get-SCSMRelationshipObject -BySource $SRTicket -Filter "RelationshipID -eq 'd96c8b59-8554-6e77-0aa7-f51448868b43'").targetobject
Note that the RelationshipID 'd96c8b59-8554-6e77-0aa7-f51448868b43' is used for Active Directory objects.

In the output, we have 2 groups, 1 user and 1 computer. But It looks like we can't find out if the groups are actually group object or a user is really an user object.

Finding the real class of an object

To work around that, we have to use the method GetClasses() which reveal more information.

# Get all the classes of the first object (which is a group in this case)
((Get-SCSMRelationshipObject -BySource $SRTicket -Filter "RelationshipID -eq 'd96c8b59-8554-6e77-0aa7-f51448868b43'").targetobject | Select-Object -First 1).getclasses()

Note that I'm selecting only the first object (Select -first 1), which is a group object.

You have to look at the property Name and look for "Microsoft.AD.*" User/Group or Computer, to find the real object class.

Adding a property Class 

Finally you can use the following piece of code to retrieve all the class.
We are adding a property called "Class" that will run against each object and check which value is present: "Microsoft.AD.User", "Microsoft.AD.Group" or "Microsoft.AD.Computer".

# Retrieve Relationship Objects CLASS of AD objects(Computers, Users and Groups)) inside SCSM
(Get-SCSMRelationshipObject -BySource $SRTicket -Filter "RelationshipID -eq 'd96c8b59-8554-6e77-0aa7-f51448868b43'").targetobject |
Select-Object -Property DisplayName, @{
    Label = "Class";
    Expression = {
        if ($_.getclasses().name -contains "Microsoft.AD.User")
        elseif ($_.getclasses().name -contains "Microsoft.AD.Group")
        elseif ($_.getclasses().name -contains "Microsoft.Windows.Computer")

Thanks for reading! If you have any questions, leave a comment or send me an email at [email protected] I invite you to follow me on Twitter @lazywinadm / Google+ / LinkedIn. You can also follow the LazyWinAdmin Blog on Facebook Page and Google+ Page.


  1. Hey Vivek, I can't check right now but i think you can specify a range

    or a column
    $worksheet.column[0] | select-object -property text

  2. Hi Francois,

    Thanks for the simple explanation.
    Can you post a script which then emails the info you extracted from excel via outlook?

  3. Hi Sailesh,
    I am sure you could figure it out (best way to learn :-)
    -Wrap the code into a function
    -Store the result into a variable
    -Send an email using Send-MailMessage (or create a link.. "mailto:" style to open outlook)

    Hope this help.

  4. Anyone managed to display all the data in a column? I would like to display everything from A2 and down. I've tried for example $worksheet.Range("A2:A65536").Text but it still only reads the first row in the column.