I have the following PowerShell command which I run to show me all the numbers that have been assigned to users. However, I'd like to narrow it down to show me ONLY accounts which have been disabled BUT still have an number assigned, I've tried a few wildcards within 'enabled' but then it fails to run.
Get-ADUser -Properties "msRTCSIP-Line",mail,l,c,Enabled,CanonicalName -LDAPFilter "(msRTCSIP-Line=tel:+44*)" |
Select Name,CanonicalName,mail,l,c,Enabled,"msRTCSIP-Line" |
ft -AutoSize
The enabled/disabled status is encoded in the userAccountControl attribute. Try an LDAP filter like this:
(&
(objectclass=user)
(objectcategory=user)
(useraccountcontrol:1.2.840.113556.1.4.803:=2)
(msRTCSIP-Line=tel:*)
)
or collapsed:
(&(objectclass=user)(objectcategory=user)(useraccountcontrol:1.2.840.113556.1.4.803:=2)(msRTCSIP-Line=tel:*))
I think the best way is to get all disabled accounts then pipe it to your code :
Search-ADAccount -AccountDisabled -UsersOnly | %{
Get-ADUser $_ -Properties "msRTCSIP-Line",mail,l,c,Enabled,CanonicalName -LDAPFilter "(msRTCSIP-Line=tel:+44*)" |
Select Name,CanonicalName,mail,l,c,Enabled,"msRTCSIP-Line"
}
Related
I'm trying to get a list of all enabled users in a particular Security group. Seems simple but i cannot manage to get the correct output.
Thanks
If you are using Active Directory:
Get-ADGroupMember "PUT_HERE_ADGROUP_NAME" -Recursive | Get-ADUser | Where-Object {$_.Enabled -eq $True} | Select-Object -ExpandProperty Name
If you want to see local users use Get-LocalGroupMember and Get-LocalUser with same filter
I'm trying to get an AD Security Group down to a manageable size, but due to display limits in Powershell, this is proving difficult for me. The group is down to 47,720 now after removing all disabled AD accounts. Now I'm trying to filter it down to Enabled users that live in this particular OU. Below is what I've used with success in the console.
Get-ADGroup "very_large_secgroup" -properties Member | Select-Object -expandproperty member | get-aduser -Filter * -SearchBase "OU=PurgeStudents,OU=DisabledAccounts,DC=contoso,DC=com" | Select-Object SamAccountName,DistinguishedName
When I try to count this, or pipe it via Out-File though, I get:
get-aduser : The input object cannot be bound to any parameters for the command either because the command does not take pipeline input or the input and its properties do not match any of the parameters that
take pipeline input.
At line:1 char:92
+ ... ty member | get-aduser -Filter * -SearchBase "OU=PurgeStudents,OU=Dis ...
Any assistance would be greatly appreciated, as I am a novice in Powershell magic.
Instead of using -Filter *, you could filter for all previous retrieved users. And there is a cmdlet to get the members of a group:
Get-ADGroupMember -Identity "very_large_secgroup" -Recursive | Foreach-Object {Get-ADUser -Filter "Name -like $_.Name" -SearchBase "OU=PurgeStudents,OU=DisabledAccounts,DC=contoso,DC=com" | Select-Object -Properties SamAccountName, DistinguishedName}
I'm trying to retrieve only enabled users in the AD. When I run this code line it returns the error. I tried using a filter as well to filter only enabled users for the requested info but it returns ALL users from every domain instead of just the single id.
Get-ADUser : A positional parameter cannot be found that accepts argument 'enabled -eq 'true''.
This is my code that is throwing the error.
Get-ADGroupMember -Identity 'Animal Shop A' | Get-ADUser -Filter '*' | Get-ADUser Where "enabled -eq 'true'" | Get-ADUser -Properties ('Mail')
This one returns ALL users from every domain
Get-ADGroupMember -Identity 'Animal Shop A' | Get-ADUser -Filter "enabled -eq'true'" | Get-ADUser -Properties ('Mail')
Is my syntax wrong on both of them? If I just want to return values from say "Animal shop A" and then "Animal Shop B"
.. or a little bit shorter this way:
Get-ADUser -Filter 'enabled -eq $true' -Properties mail |
Select-Object -Property Name,samaccountname,mail
Besides this I would recommend to use a -SearchBase. That's less stressful for the AD. ;-)
Get-ADUser -Filter * -Properties mail | Where { $_.Enabled -eq $True} | Select Name,samaccountname,mail
That will get all enabled users in your target domain that are enabled and display the name, username, and mail properties
Important to know for both commands:
You must work with an elevated powershell process.
Otherwise the result may not be complete.
get-aduser -filter 'enabled -eq "true"' -ResultSetSize $Null
simply try below commands in powershell as administrator permission.
As a guide, the first part will filter users, second part filtered enabled users and last part will give you export of results.
Get-ADUser -Filter * -Property Enabled | Where-Object {$_.Enabled -like “false”} | Export-Csv -Path C:\eport.csv -Encoding ascii -NoTypeInformation
hope to be useful for you.
I'm in the process of cleaning up my inherited Domain Admins group and remove service accounts that are no longer needed. I'm trying to pull the group membership of the Domain Admins group and feed it into a Get-ADUser, with little success.
$name = Get-ADGroupMember "domain admins" | select -ExpandProperty Name
Foreach-Object {
Get-ADUser -Filter { Name -Like "$name"} -Properties * | FT Name, LastLogonDate
}
If I run the Get-ADGroupMember by itself it works. If I run the Get-ADUser with a name from the list (instead of the $name variable) it works. But when I attempt to tie them together it does not work.
I am glad you were able to make it work but I would like to offer some advice. First don't use -Properties * when all you really needed was LastLogonDate. You are pulling more data than you need to. Also you don't even need the ForEach loop since Get-Aduser will accept the pipeline input very nicely.
Get-ADGroupMember "domain admins" | Get-ADUser -Properties LastLogonDate |
Select Name,LastLogonDate
or if you really want console output, as supposed to standard output
Get-ADGroupMember "domain admins" | Get-ADUser -Properties LastLogonDate |
Format-Table Name,LastLogonDate -AutoSize
Thanks #EBGreen, your comment pointed me in the right direction. I am able to get what I need with the following:
Get-ADGroupMember "domain admins" | select -ExpandProperty SamAccountName | % {
$name=$_
Get-ADUser $_ -Properties *
} | FT Name, LastLogonDate -AutoSize
I've been tasked with finding service accounts (in our shop, that's user accounts starting with 'svc-' in the username) that have expiring passwords. Normally service accounts should not have expiring passwords, so I'm trying to find service accounts incorrectly created so they can be fixed.
I've been using Search-ADAccount and I'm having parameter issues. If I use this:
Search-ADAccount -PasswordNeverExpires | Where {$_.SamAccountName -like 'SVC-*'}
then I get long lists of results, none of which have expiring passwords. But if I'm including the -PasswordNeverExpires parameter, then I'm filtering out any accounts which do have expiring passwords, no?
I've also tried this:
Search-ADAccount | Where {$_.SamAccountName -like 'SVC-*' -and $_.PasswordNeverExpires -like 'FALSE' }
but I only get an error: "Parameter set cannot be resolved using the specified named parameters." That sounds like Search-ADAccount requires certain parameters, but I don't see in the help files which parameters are required.
It's counter-intuitive (to me) that Search-ADAccount has a parameter which can search for one Boolean condition (TRUE) but not the other.
Get-ADUser doesn't seem to have any password configuration info.
Yes, Trondh. That's it. I first looked at Get-ADUser, but the help files didn't mention anything about the PasswordNeverExpires parameter, and piping a single result into Get-Member didn't reveal any relevant property to search against.
In sum, this is the one-liner that worked:
Get-ADUser -filter {PasswordNeverExpires -eq $False} | Where {$_.SamAccountName -like 'SVC-*'}
Thanks again.
I would just use get-aduser (need to clean up the filter param, I just banged this together in my head):
$adusers = Get-ADUser -Filter * -Properties * | where {$_.PasswordNeverExpires -eq $false}
did you try $_.PasswordNeverExpires -eq $false?