Solved: AD User Search in PowerShell

Create Account

Active Directory

Questions

Followers

Top Experts

PowerEdgeTech🇺🇸

AD User Search in PowerShell

Trying to set the logon script field on users in a SUB OU.

I can change it for all users in the domain (including all OU's and sub-OU's) with this:

Import-Module ActiveDirectory
$users=Get-ADUser -Filter *
foreach($u in $users)
{
     Set-ADUser $u -ScriptPath "map.bat"
}

Open in new window

I obviously don't want to change ALL AD users (including built-in users), but I CAN'T seem to get any of the methods I've found for limiting it to a specific OU to work.

For example, doing this:

Import-Module ActiveDirectory
$OU = "OU=TopOU,OU=SubOU,DC=mydomain,DC=local"
$users=Get-ADUser -Filter * -SearchBase $OU
foreach($u in $users)
{
     Set-ADUser $u -ScriptPath "map.bat"
}

Open in new window

keeps giving me a ADIdentityNotFoundException error. I've also tried the -SearchScope SubTree and using the full string instead of a variable. This I need to be able to add a specific logon script path only to users in one OU. Anyone tell me why this isn't working? How can I limit this to a particular OU?

Zero AI Policy

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.

SubSun🇮🇳

I don't see an issue with script, if your account have sufficient permission on that OU then it should work. Are you able to manually add the script path for users in that OU? Is this a single domain environment?

Try with the -Server switch to specify the domain name or domain controller..

Get-ADUser -Filter * -SearchBase "OU=TopOU,OU=SubOU,DC=mydomain,DC=local" -Server DC.mydomain.local | Set-ADUser –scriptPath "map.bat" -Server DC.mydomain.local

Open in new window

PowerEdgeTech🇺🇸

ASKER

Yeah, I'm logged in with Administrator, and I can add it manually, AND my first script will add the path, but it adds it to EVERY user in the domain.

I got the same thing when adding -Server server.mydomain.local ... there is something it doesn't like about line 3 if I add anything besides the -Filter option.

SubSun🇮🇳

Hmm.. It work in my lab without any issue.. Can you post the exact error?

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.

PowerEdgeTech🇺🇸

ASKER

Get-ADUser : Directory object not found
At line:2 char:8
+ $users=Get-ADUser -Filter * -SearchBase "OU=TopOU,OU=SubOU,DC=mydomain,DC=local" ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (:) [Get-ADUser], ADIdentityNotFoundException
    + FullyQualifiedErrorId : ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException, 
   Microsoft.ActiveDirectory.Management.Commands.GetADUser

Open in new window

ASKER CERTIFIED SOLUTION

SubSun🇮🇳

membership

Signing up is free and takes 30 seconds. No credit card required.

Create Account

PowerEdgeTech🇺🇸

ASKER

Ha ha ... the DN has to be in this order:

OU=SubOU,OU=TopOU,DC=mydomain,DC=local

I had TopOU listed first ... switched it and it works like it should ... makes sense to follow the branch back up the chain, from sub-OU, to parent OU, to domain, to TLD.

I stabbed with about every variation I could think of ... I just hadn't thought it through logically :)

Thanks!

Active Directory

Questions

Followers

Top Experts

Active Directory (AD) is a Microsoft brand for identity-related capabilities. In the on-premises world, Windows Server AD provides a set of identity capabilities and services, and is hugely popular (88% of Fortune 1000 and 95% of enterprises use AD). This topic includes all things Active Directory including DNS, Group Policy, DFS, troubleshooting, ADFS, and all other topics under the Microsoft AD and identity umbrella.