How to Get All Users and Their Managers in Active Directory

Changing user’s manager in Active Directory is a common administrative task that helps maintain accurate reporting structures and access management. Keeping this attribute up to date is crucial, especially during role changes, promotions, or department transfers. Whether you want to update the manager for a single user or multiple users, the following approaches will help.

Change user’s manager using Active Directory Users and Computers

• In the ADUC console, navigate to the OU or the saved query where the users whose manager you want to change is located.
• Select the desired user(s), right-click, and choose Properties. Go to the Organization tab and click Change in the Manager field.
• In the dialog box, enter the new manager’s name and click Check Names to verify it.
• Click OK to confirm, then hit Apply and OK to save the manager update.

Assign Active Directory user’s manager using PowerShell

Run the following cmdlet by replacing <UserSAMAccountName> and <ManagerSAMAccountName> to update a user’s manager in Active Directory.

Set-ADUser -Identity "<UserSAMAccountName>" -Manager (Get-ADUser -Identity "<ManagerSAMAccountName>").DistinguishedName

• If you want to bulk update manager attribute, create an input CSV file containing the users’ DisplayName and SAMAccountName as shown here.
• Run the PowerShell script below, replacing <ManagerSAM> with the new manager’s SAM account name and <FileLocation> with the path to your CSV file.

Import-Csv -Path “<FileLocation>” | ForEach-Object { Set-ADUser -Identity $_.SamAccountName -Manager (Get-ADUser -Identity “<ManagerSAM>”).DistinguishedName }

• Navigate to ‘Add Manager’ management action in the AdminDroid Active Directory Companion and click ‘Want to process bulk users with filters?’ to update the manager for multiple users.
• Apply a filter to quickly narrow down the required users and bulk select all the user accounts you want to update.
• Perform the management action by selecting the new manager for users and complete all the update in just a few clicks.

If a manager’s account is disabled or deleted, identifying their direct reports ensures none of those users are left with outdated manager attribute. This identification helps to prevent breaking of organizational chart lookups or disrupts in business processes. Thus, tracking direct reports in Active Directory helps to maintain an accurate organizational structure, keep reporting chains intact, and quickly update affected accounts.

List all users under a specific manager using ADUC

• Open Active Directory Users and Computers (ADUC).
• Navigate to the user account of the manager, right-click and select Properties.
• Switch to the Organization tab, and in the Direct Reports section, you can view all users who report to this manager.

Get all users under a manager in Active Directory Using PowerShell

Run the following cmdlet to get all direct reports of a manager in Active Directory using PowerShell. Make sure to replace <ManagerSAMAccountName> with the manager’s SAM account name before proceeding.

$ManagerDN = (Get-ADUser –Identity “<ManagerSAMAccountName>”).DistinguishedName 
Get-ADUser -Filter "Manager -eq '$ManagerDN'" -Properties Name, SAMAccountName, Department | 
         Select-Object Name, SAMAccountName, Department | 
         Sort-Object Name | Format-Table -AutoSize

In large organizations, understanding a user’s complete management chain is crucial for maintaining clear reporting structures and accountability. While identifying a user’s direct manager is simple, tracing the hierarchy from the employee all the way to the top-level executive can be tedious and prone to errors when done manually.

However, you can use PowerShell to retrieve all employees who directly or indirectly report to a manager. This method recursively retrieves the management chain, streamlines the process, and provides accurate data for full hierarchical visibility.

Run the following script by replacing <UserSAMAccountName> with the target user’s SAM account name to retrieve their full management hierarchy in Active Directory.

function Get-ManagementChainOptimized {
  param (
    [Parameter(Mandatory=$true)]
    [string]$UserName
  )
  $CurrentID=$UserName
  $Chain=@()
  $Level=0
  Write-Host "Retrieving management chain for user: $UserName" -ForegroundColor Yellow
  do {
    $Level++
    $User=Get-ADUser -Identity $CurrentID -Properties Name,SAMAccountName,Manager,Title,DistinguishedName
    $ManagerDN=$User.Manager
    if ([string]::IsNullOrEmpty($ManagerDN)) {
      Write-Host "Chain ended: $($User.Name) has no manager assigned." -ForegroundColor Cyan
      break
    }
    $Manager=Get-ADUser -Identity $ManagerDN -Properties Name,SAMAccountName,Title,DistinguishedName
    $OU=($Manager.DistinguishedName -split ',',2)[1]
    $Chain+=[PSCustomObject]@{
      Level=$Level
      Name=$Manager.Name
      SAMAccountName=$Manager.SAMAccountName
      DistinguishedName=$Manager.DistinguishedName
      OU=$OU 
      JobTitle=$Manager.Title
    }
    $CurrentID=$Manager.SAMAccountName
  } while ($true)
  Write-Host "`n--- Management Chain Result ---`n"
  return $Chain | Format-Table -AutoSize
}
Get-ManagementChainOptimized -UserName "<UserSAMAccountName>"

Assigning a manager in Active Directory is more than just an organizational detail, it plays a key role in reporting and access governance. While a missing manager attribute doesn’t immediately break core AD functions, but it severely affects dependent services that rely on accurate managerial details.

Limitations of accounts without a manager in Active Directory

Even though the manager attribute may seem like an informational attribute, it is a critical security and administrative pointer in some cases. Since the manager field is key for delegation, account lifecycle control, etc., assigning it to every user is essential to keep your directory structural and prevent operational failures.