Get Primary User And Email From Device

Overview

When something needs to happen at the device level — a reboot wave, a forced re-imaging, a security patch with a hard deadline — the question is always the same: who actually uses these machines, and how do we reach them? GPUED answers that question for a list of devices.

Give it a list of device names in any of three forms (file, paste, or SCCM device collection). For each device, it resolves the primary users via SMS_UserMachineRelationship and the email address via Active Directory. Results land in a sortable grid with a one-click "Copy Emails" button that produces a clipboard-ready list — paste straight into Outlook and send.

Sister tool — bidirectional lookup

GPUED has a mirror tool that walks the same SCCM affinity table in the opposite direction. The two are sold separately and licensed independently, but they share the same architecture and credentials.

See the Get Primary Device And Email From User documentation for the reverse direction. Mature SCCM teams license both for full coverage.

Prerequisites

Required SCCM and AD permissions

GPUED queries three SCCM WMI classes (read-only) and one Active Directory cmdlet. The signed-in Windows user must hold the following effective rights:

• SCCM — SMS_UserMachineRelationship Read. Typically granted via the built-in "Read-only Analyst" role in the SCCM administrative console, or by adding the user to the local "SMS Admins" group on the site server with a custom role that includes SMS_UserMachineRelationship read.
• SCCM — SMS_Collection (CollectionType = 2) Read. Same role covers it. Needed only for the "From SCCM Collection" tab.
• SCCM — SMS_FullCollectionMembership Read. Same role. Needed only for the "From SCCM Collection" tab to enumerate the devices in the chosen collection.
• Active Directory — Get-ADUser Standard read on user objects. Any authenticated AD account has this by default; explicit grants are only needed if your environment denies it for non-admin users.

Initial configuration

On first launch, GPUED verifies the license, then asks for the SCCM and AD credentials via the standard TontonTools credentials dialog. Credentials are shared across the suite — if you already configured them for another tool on the same workstation and user profile, GPUED picks them up automatically.

The credentials dialog asks for three things specific to GPUED:

The SCCM Auto-detect button in the credentials dialog scans the local registry and WMI for a previously-configured SCCM console; if found, it pre-fills both fields automatically. See the Delete Device Everywhere documentation for the full SCCM auto-detect cascade.

Main features

Tab 1 — Import from File

Browse to a CSV or TXT file with one device name per line. Plain hostnames are expected ("WS-MIL36-042"); FQDN suffixes are tolerated and stripped. Whitespace and blank lines are tolerated. Click Get and the tool processes the list sequentially. The result grid populates row by row — Device Name, Primary User, Email Address, Display Name, Department, Title, Manager, Office, Company, UPN, Mobile, City, Account, Source, Status. The grid scrolls horizontally to absorb the extra width; all three input tabs share the same column set.

Tab 2 — Paste Device List

For ad-hoc lookups: paste a list copied from an Excel column, a ticket comment, or the output of a previous PowerShell query. The text box accepts plain hostnames, one per line. Click Get to process. Results land in a separate grid from Tab 1 — both tabs keep their own results independently.

You can also paste rows copied straight from the SCCM console. Select the devices you need in the Assets and Compliance → Devices node, copy, and paste the selection as-is — no clean-up in Excel required. Each pasted row may still carry the trailing console columns (Client, Primary Users, Currently Logged-On User, Site Code, Client Activity); GPUED keeps only the device name (the first column) and ignores the rest, so the raw console paste works without any pre-processing.

Tab 3 — From SCCM Device Collection

Click "Pick collection..." to open the Device Collection picker. It queries SMS_Collection via WMI for collections with CollectionType = 2 (device collections), shows them in a searchable list, and returns the chosen collection. The tool then resolves the CollectionID and enumerates members via SMS_FullCollectionMembership — the Name column on this class returns the device hostname directly, which simplifies the workflow compared to user collections.

Tab 4 — Activity Log

A live coloured log of every operation: SteelBlue for informational steps, DarkOrange for warnings (e.g. "no affinity in SCCM"), Red for errors, DarkGreen for success summaries. The on-screen log mirrors the CMTrace file log; the on-screen version is shorter (last few hundred lines) for responsiveness.

Result grid columns and AD attributes

Every result grid (File, Paste, and Collection) shares the same fifteen data columns plus a row index. Beyond the primary user, email and display name, each row now carries a full Active Directory profile resolved from the user object. The grid scrolls horizontally to absorb the extra width. The optional AD columns can be shown or hidden per technician via the Columns ▾ menu, and centrally governed by administrators — see Column governance for administrators below.

Show or hide columns — the Columns ▾ menu

Below each result grid, a Columns ▾ button lets the technician show or hide the optional Active Directory columns (Department, Title, Manager, Office, Company, UPN, Mobile, City, Account) to keep the grid focused on the task at hand. The choice is saved per Windows user and kept across sessions, so each technician keeps their own preferred layout. If an administrator policy disallows every optional column, the button is hidden automatically.

The Copy Emails button — the killer feature

Below each result grid, a "📧 Copy Emails" button extracts every successfully resolved email address from the rows, joins them with the separator picked in the adjacent drop-down (semicolon by default, also comma or newline), and copies the result to the clipboard. Paste it directly into Outlook (To, Cc, Bcc) and you have a bulk announcement to every user whose devices match your criteria.

Common use case: "we need to reboot every workstation in the QA lab tonight at 22:00 — pick the SCCM collection 'QA-Workstations', Get, Copy Emails, paste in Outlook with the maintenance notice, send." Two minutes instead of two hours.

Rows where the email could not be resolved ("(not found)", "(empty)", or any string starting with parentheses) are automatically excluded from the copy.

CSV export

The Export CSV button writes the current tab's grid to a CSV or TXT file with configurable separator (semicolon, comma, or pipe), UTF-8 encoding with BOM for Excel compatibility, and a default file name reflecting the tab source. The export now includes all 16 columns — device name, primary user, email, display name and the full Active Directory attribute set (department, title, manager, office, company, UPN, mobile, city, account status) plus source and status. Export is per-tab — File, Paste, and Collection each have their own button.

Quick-Info strip and row selection

Below each result grid, a quick-info strip displays the currently selected row in large, copy-friendly text: Device, Primary User, Email, Display Name. Useful when you need to copy a single value (the email of one specific user) without scrolling through the whole grid.

Multi-user devices

A single device can have multiple primary users in SCCM (a workstation shared by morning and evening shifts, a manager's laptop also used by their assistant, etc.). GPUED emits one row per primary user — so a single device name in your input may produce two or three rows in the result grid. The Source column ("SCCM") and the row order make this explicit.

CMTrace logging

GPUED writes a CMTrace-compatible log to C:\TEMP\PrimaryUserEmailLookup.log. Every WMI query, AD lookup, and error is recorded with timestamp, executing Windows user, and severity. Open with CMTrace.exe (shipped with SCCM) for coloured real-time viewing. The log is cumulative across sessions — useful for an audit trail spanning multiple campaigns.

License & read-only mode

GPUED follows the TontonTools licensing model: 7-day cache + 7-day offline grace, then read-only mode. In read-only mode, the Get buttons (File, Paste, Collection) are disabled — no SCCM or AD query can be launched. Export CSV and Copy Emails remain active for any results already in the grid from a previous session.

For the full licensing model — Trial mechanics, machine and tenant binding, moving a license between workstations, subscription cancellation behavior — see the Licensing reference.

Typical workflow — a maintenance notification campaign

1. 1

   Configure credentials once

   Click ⚙ Credentials, fill in the SCCM Site Server FQDN and the Site Code. Use Auto-detect if you have the SCCM console installed locally. LDAP path can stay empty for current-domain queries.

2. 2

   Pick the right input tab

   For a one-off lookup (one or two devices mentioned in a ticket): Paste. For a recurring batch (devices flagged by a monitoring tool): Import from File. For a targeted campaign (notify everyone whose machine is in a specific business unit collection): From SCCM Device Collection.

3. 3

   Click Get

   The tool processes the list sequentially, populating the grid row by row. Watch the Activity Log for any "no affinity" or "AD lookup failed" warnings — these surface devices that have no assigned user (shared/kiosk devices, freshly imaged machines).

4. 4

   Review the grid

   Sort by any column. Click any row to see its full details in the Quick-Info strip below the grid. A single device may produce multiple rows if it has multiple primary users — review each one to decide who to contact.

5. 5

   Export CSV for the audit trail

   Click Export CSV and save the file. This is your record of who was contacted and which device they were associated with at the time of the campaign.

6. 6

   Click Copy Emails

   Pick the separator your mail client expects (semicolon for Outlook, comma for Gmail), click Copy Emails, and paste into the To/Cc/Bcc field of your draft. Compose your message and send.

7. 7

   Keep the CMTrace log

   The cumulative log at C:\TEMP\PrimaryUserEmailLookup.log captures every WMI and AD call. Attach it to your audit record if your governance process requires it.

Limitations and design choices

• Primary user data comes from SCCM only GPUED queries SMS_UserMachineRelationship — the SCCM user-device affinity table. Intune primary user data and Entra ID device ownership are not consulted. For a tenant that operates Intune without SCCM, GPUED is not the right tool.
• Email comes from on-premises Active Directory GPUED calls Get-ADUser, which reads the mail attribute on the user object in AD. If your authoritative email is in Entra ID without on-prem sync of the mail attribute, the lookup may return empty values. A future enhancement may add a Graph fallback for email resolution.
• Active affinities only The WMI query filters on IsActive = 1, so historical or stale affinities are excluded by design. A device that was reassigned six months ago will return only the current primary user, not the historical one.
• Sequential processing GPUED processes one device at a time. For a list of 500 devices, expect a few minutes of run-time depending on AD responsiveness. The sequential approach keeps the log readable and avoids overwhelming the AD controller with parallel queries.
• Devices with no primary user Shared, kiosk, conference-room, or freshly-imaged devices typically have no entry in SMS_UserMachineRelationship. They appear in the result grid with "(no affinity in SCCM)" in the Primary User column. For these, use Orphan Device Cleaner to investigate provenance.
• No deletion or mutation GPUED is strictly read-only on SCCM and AD. It does not delete, modify, reassign, or otherwise change any directory record. For cleanup operations, use the dedicated hygiene tools (DDM, ODC, ODM).

Technical notes

• SCCM query mechanism GPUED uses Get-WmiObject (PowerShell) rather than direct .NET ManagementObjectSearcher for the SMS_UserMachineRelationship query. Get-WmiObject handles Kerberos cross-domain authentication slightly more robustly in mixed-forest environments.
• AD query mechanism Get-ADUser is invoked via PowerShell. The tool first imports the ActiveDirectory module silently; if the RSAT module is missing, AD lookups fail gracefully and the rows show "(AD lookup failed)" in the Email column. SCCM resolution still completes. All AD attributes (email, display name, department, title, manager, office, company, UPN, mobile, city, account status) are fetched in a single batched Get-ADUser query per user instead of one query per attribute — noticeably faster on large lists; the manager attribute triggers one additional lookup to resolve its DN to a readable display name.
• WQL string escaping A subtle but critical detail: in WQL WHERE clauses, special characters inside string literals must be escaped (single quote doubled to two single quotes, etc.). GPUED handles this automatically — collection names containing apostrophes, parentheses, or spaces resolve correctly.
• Device name normalisation Plain hostnames are expected ("WS-MIL36-042"). If you paste FQDN values ("WS-MIL36-042.corp.contoso.com"), the tool strips the DNS suffix automatically before querying. Case is preserved as-is for the display; WQL comparison is case-insensitive at the SQL Server backend.
• Credential storage DPAPI-encrypted under the current Windows user profile at %AppData%\TontonTools\credentials.dat — shared across all TontonTools products on the same user account on the same workstation.
• No telemetry, no agent GPUED runs entirely from the administrator workstation. The only outbound connections are RPC to the SCCM site server, LDAP to the AD domain controllers, and api.lemonsqueezy.com for license validation (at most weekly).

Column governance for administrators

The nine optional Active Directory columns are convenient for technicians but expose directory data (job title, manager, mobile, city, account status). GPUED lets an IT department decide centrally which of these columns are available — and a disabled column is never even read from Active Directory. This is opt-in restriction: by default everything is open, and an administrator only acts when they want to narrow the surface.

The policy is read once at application startup from the machine hive (HKLM), in read-only mode. The tool never writes to HKLM, so running GPUED requires no elevation. A column disabled by policy is locked for every technician on that machine: they cannot re-enable it from the Columns ▾ menu, and it is not requested from AD, not displayed, not exported, and not listed in the menu.

Registry schema

• Admin policy — HKLM\SOFTWARE\TontonPro\GPUED\Policy One DWORD per column, named Show<Column>. Absent or 1 = column available (default); 0 = column disabled for every user on the machine. Read in the 64-bit registry view, read-only.
• Technician preference — HKCU\SOFTWARE\TontonPro\GPUED\Columns One DWORD per column, named Vis<Column>. 1 = visible (default), 0 = hidden. Managed automatically by the Columns ▾ menu and bounded to the admin-allowed set — you do not normally edit these by hand.

Disable columns with a .reg file

To hide the Mobile and City columns for everyone on a machine, import the following .reg file (or push it via GPO). Set a value back to 1, or delete it, to re-enable the column.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\TontonPro\GPUED\Policy]
"ShowMobile"=dword:00000000
"ShowCity"=dword:00000000

For a script-based rollout (GPO startup script, Intune device-context script, or an SCCM package), the same effect is achieved with reg.exe, writing explicitly to the 64-bit view:

reg add "HKLM\SOFTWARE\TontonPro\GPUED\Policy" /v ShowMobile /t REG_DWORD /d 0 /f /reg:64
reg add "HKLM\SOFTWARE\TontonPro\GPUED\Policy" /v ShowCity /t REG_DWORD /d 0 /f /reg:64

# Re-enable City for everyone again:
reg add "HKLM\SOFTWARE\TontonPro\GPUED\Policy" /v ShowCity /t REG_DWORD /d 1 /f /reg:64

Deploy via GPO, Intune or SCCM

• Group Policy Computer Configuration → Preferences → Windows Settings → Registry to create the Show<Column> values, or a computer startup script that imports the .reg file.
• Microsoft Intune Devices → Scripts and remediations: a PowerShell script run in system context that sets the values in the 64-bit view. A remediation can re-assert the policy on a schedule.
• Configuration Manager (SCCM) A package/program or a Configuration Item baseline that writes the Show<Column> values to the 64-bit view on the targeted device collections.