Export FortiGate Local and LDAP Users to CSV File

Introduction

FortiGate Firewalls provide comprehensive user authentication and identity management capabilities. However, unlike many management platforms, FortiGate does not provide a native GUI option to export local or LDAP user accounts directly into a CSV file.

For administrators performing audits, compliance checks, migration projects, or user reviews, exporting user information into a spreadsheet format can be extremely useful.

In this guide, we will use FortiGate CLI commands to extract the user database and then convert the output into a CSV file using a PowerShell script.

Step 1 - Export User Database from FortiGate

Log in to the FortiGate Firewall using either SSH or the CLI console.

Run the following command to display all local user configurations:

show user local

The command will display all configured local users, including users authenticated through LDAP configurations.

Copy the entire output and paste it into a text file.

Step 2 - Save the Output as a Text File

Open Notepad or any text editor and paste the CLI output.

Save the file as:

fortigate_output.txt

You may use any file name, but remember to update the PowerShell script accordingly.

Step 3 - Open PowerShell

Navigate to the folder where the text file is stored.

Right-click inside the folder and select:

• Open in Terminal
• Open PowerShell Window Here

This ensures PowerShell executes directly from the folder containing the FortiGate export file.

Step 4 - Run the PowerShell Script

Copy and execute the following PowerShell script:

# CHANGE "fortigate_output.txt" BELOW IF YOUR FILE NAME IS DIFFERENT

$configFile = ".\fortigate_output.txt"

$text = Get-Content $configFile -Raw

$pattern = '(?s)edit "(.*?)"(.*?)(?=next)'

$matches = [regex]::Matches($text, $pattern)

$userList = @()

foreach ($match in $matches) {

    $username = $match.Groups[1].Value

    $block = $match.Groups[2].Value

    $ldap = if ($block -match 'set ldap-server "(.*?)"') {
        $Matches[1]
    }
    else {
        "N/A"
    }

    $status = if ($block -match 'set status (\w+)') {
        $Matches[1]
    }
    else {
        "enabled"
    }

    $email = if ($block -match 'set email-to "(.*?)"') {
        $Matches[1]
    }
    else {
        "N/A"
    }

    $userList += [PSCustomObject]@{
        "Username"    = $username
        "LDAP Server" = $ldap
        "Status"      = $status
        "Email"       = $email
    }
}

$userList | Export-Csv `
-Path ".\FortiGate_LDAP_Users.csv" `
-NoTypeInformation `
-Encoding UTF8

Write-Host "Success! Created 'FortiGate_LDAP_Users.csv'." `
-ForegroundColor Green

How the Script Works

The script parses the FortiGate configuration output and extracts user-related information from each user block.

It automatically captures:

• Username
• LDAP Server Name
• User Status
• Email Address

The collected information is then exported into a CSV file that can be opened directly in Microsoft Excel.

Example CSV Output

Benefits of Exporting Users to CSV

• Simplifies user audits and compliance checks.
• Provides easy reporting for management teams.
• Helps during firewall migrations.
• Allows bulk review of LDAP-integrated users.
• Makes user documentation easier to maintain.
• Enables Excel-based filtering and analysis.

Troubleshooting Tips

• Ensure the FortiGate CLI output is copied completely.
• Verify the file name in the script matches your text file.
• Run PowerShell with appropriate permissions if required.
• Confirm the configuration contains local user definitions.
• Validate that PowerShell execution policies allow script execution.

Conclusion

Although FortiGate does not provide a built-in GUI option to export local or LDAP users to CSV format, administrators can easily achieve this using CLI commands and PowerShell automation. This method provides a quick and efficient way to generate user inventory reports, perform audits, and maintain documentation without manual data entry.