Skip to main content

How to Get a User's Manager from Active Directory in Batch Script

Active Directory (AD) isn't just a security database; it's a complete organizational map. One of the most useful pieces of data stored in a user's account is their Manager, specifically, the Distinguished Name of the person they report to. For IT administrators, being able to pull this info via a Batch script is essential for automating approval workflows, generating departmental hierarchies, or contacting a supervisor when an account is flagged for security reasons.

This guide explains how to use the dsget utility and the PowerShell bridge to extract manager data.

Why Fetch the Manager Attribute?​

  • Escalation Automation: Automatically identifying and emailing a user's manager when their account has been locked due to a security breach.
  • Org-Chart Generation: Building a simple text-based hierarchy of who reports to whom for an entire organizational unit (OU).
  • Onboarding/Offboarding Checks: Verifying that a new employee has a designated manager before their account is fully activated.
Tool Availability

The dsquery and dsget utilities are part of the Remote Server Administration Tools (RSAT). These must be installed on your workstation to manage Active Directory from the command line.

Method 1: Using DSGET (The Classic Way)​

The dsget user command has a specific -mgr flag that returns the Distinguished Name (DN) of the user's supervisor.

@echo off
setlocal

:: Check for RSAT tools
where dsquery >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] dsquery.exe not found. Install RSAT tools first.
    echo [HELP] Settings ^> Apps ^> Optional Features ^> Add RSAT
    pause
    exit /b 1
)

set /p "USN=Enter username: "

if "%USN%"=="" (
    echo [ERROR] No username entered.
    pause
    exit /b 1
)

echo [PROCESS] Retrieving supervisor metadata for: "%USN%"...
echo.

:: 1. We find the user and pipe their identity to dsget
:: 2. We request the -mgr attribute
dsquery user -samid "%USN%" | dsget user -mgr

if %errorlevel% neq 0 (
    echo [ERROR] User not found or Domain Controller is unreachable.
    echo [HELP] Verify the username and domain connectivity.
)
pause

Method 2: Using PowerShell (Resolves Manager Name)​

The dsget -mgr approach only returns the manager's DN, which is hard to read. PowerShell can resolve it to a readable name.

@echo off
setlocal

set /p "TARGET=Enter username: "

if "%TARGET%"=="" (
    echo [ERROR] No username entered.
    pause
    exit /b 1
)

echo [PROCESS] Looking up organizational structure for "%TARGET%"...
echo.

powershell -NoProfile -Command ^
    "try {" ^
    "  $user = Get-ADUser -Identity '%TARGET%' -Properties Manager;" ^
    "  if ($user.Manager) {" ^
    "    $mgr = Get-ADUser $user.Manager -Properties Title, EmailAddress;" ^
    "    Write-Host ('Manager:  ' + $mgr.Name);" ^
    "    Write-Host ('Title:    ' + $(if ($mgr.Title) { $mgr.Title } else { '(not set)' }));" ^
    "    Write-Host ('Email:    ' + $(if ($mgr.EmailAddress) { $mgr.EmailAddress } else { '(not set)' }));" ^
    "    Write-Host ('DN:       ' + $user.Manager)" ^
    "  } else {" ^
    "    Write-Host '[INFO] No manager is assigned to this account.'" ^
    "  }" ^
    "} catch {" ^
    "  Write-Host '[ERROR] User not found or AD module not available.';" ^
    "  Write-Host '[HELP] Ensure RSAT Active Directory module is installed.';" ^
    "  exit 1" ^
    "}" 2>nul

pause

Creating a Supervisor Lookup Diagnostic Tool​

This professional script validates inputs, checks tool availability, and provides a complete organizational context report.

@echo off
setlocal EnableDelayedExpansion

echo ============================================================
echo   Active Directory Supervisor Lookup Tool
echo ============================================================

:: 0. Check for tools
where dsquery >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] RSAT tools not found.
    pause
    exit /b 1
)

set /p "USN=Enter Employee Username: "

if "!USN!"=="" (
    echo [ERROR] No username entered.
    pause
    exit /b 1
)

:: 1. Verify the user exists
set "USER_DN="
for /f "tokens=*" %%d in ('dsquery user -samid "!USN!" 2^>nul') do set "USER_DN=%%d"

if not defined USER_DN (
    echo [ERROR] User "!USN!" not found in Active Directory.
    pause
    exit /b 1
)

:: 2. Fetch Manager DN
echo.
echo [PROCESS] Fetching manager record for "!USN!"...

set "MDN="
for /f "tokens=*" %%m in ('dsquery user -samid "!USN!" ^| dsget user -mgr 2^>nul ^| findstr /v /i /c:"mgr" ^| findstr /v /c:"dsget succeeded"') do (
    set "LINE=%%m"
    if not "!LINE!"=="" if not "!LINE!"=="  " set "MDN=%%m"
)

:: 3. Report
if defined MDN (
    echo.
    echo [FOUND] "!USN!" reports to:
    echo   !MDN!
    echo.
    :: Try to get the manager's display name
    echo [INFO] Manager details:
    dsget user !MDN! -display -email 2>nul | findstr /v /i /c:"display" /c:"dsget succeeded"
) else (
    echo.
    echo [INFO] No supervisor record found for "!USN!".
    echo [NOTE] This may indicate an executive account or an
    echo        incomplete directory entry.
)

echo ============================================================
pause

Common Pitfalls and How to Avoid Them​

Blank Manager Fields​

In many companies, the "Manager" field is left empty for upper-level executives or in poorly maintained directories.

Solution: Always code your script to handle the "Not Found" state gracefully rather than crashing.

LDAP Format vs. Display Name​

Note that dsget -mgr returns the Distinguished Name (CN=John Smith,OU=...), not the simple name.

SEO and UX Tip

Advise your users that if they need the simple name (e.g., "John Smith"), they should pass the manager's DN back into another dsget command: dsget user "CN=John Smith..." -display. Or use Method 2 (PowerShell) which resolves the name automatically.

Best Practices for Organizational Auditing​

  1. Automate Notifications: Use a Batch script to monitor "Account Locked" events. When one occurs, find the user's manager and automatically generate a help desk ticket for them.
  2. Verify the Chain: Periodically run a script that audits an OU to find anyone who doesn't have a manager assigned, this is a common sign of a stale or incorrectly provisioned account.
  3. Cross-Reference Groups: If a user is added to a highly privileged group, have your script check their manager to ensure the move makes sense for their current role.
Management Loops

Be careful when building logic to "Email the Manager." Sometimes a user is their own manager in AD (a "Management Loop"), which can cause automated email systems to behave unexpectedly.

Conclusion​

Getting a user's manager from Active Directory via Batch script is a powerful way to add organizational context to your technical automation. By leveraging the dsquery and dsget utilities to programmatically extract these reporting lines, you can improve the efficiency of your help desk, automate security escalations, and maintain a higher standard of directory accuracy. This professional approach to system identification ensures that your organization's hierarchy is transparent and accessible, providing a reliable foundation for your enterprise-level identity management across the entire Windows network.

Table of Contents