asked on
one-liner getting accounts that are flagged "password never expires"
I'm trying to use Powershell to give me the user accounts of those accounts that have password set to not expire.
I have written this:
Second, after the list of users is complete it throws an error over and over for 10-15 seconds:
Search-ADAccount : The server has returned the following error: invalid enumeration context.
At line:1 char:1
+ Search-ADAccount -PasswordNeverExpires -usersonly |get-aduser -Filter 'name -lik ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Search-ADAccount], ADException
+ FullyQualifiedErrorId : The server has returned the following error: invalid enumeration context.,Microsoft.ActiveD
I have written this:
Search-ADAccount -PasswordNeverExpires -usersonly |get-aduser -Filter 'name -like "*wildcard*"' | FT Name, ObjectClass
Second, after the list of users is complete it throws an error over and over for 10-15 seconds:
Search-ADAccount : The server has returned the following error: invalid enumeration context.
At line:1 char:1
+ Search-ADAccount -PasswordNeverExpires -usersonly |get-aduser -Filter 'name -lik ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Search-ADAccount], ADException
+ FullyQualifiedErrorId : The server has returned the following error: invalid enumeration context.,Microsoft.ActiveD
PowershellWindows Server 2008Active Directory
Last Comment
SquigglyMonkey
Get-Aduser -properties * -filter "PasswordNeverExpires -eq 'True'" | ft Samaccountname, DisplayName,PasswordNeverE
The first part will indeed only return accounts where the password is set to not expire.
The issue is that in the next pipeline step, you're querying again for all users matching the wildcard. What you need instead of Get-ADUser is a simple Where-Clause.
The other error might be caused by the first, because you're pretty much spamming AD with queries.
How many user accounts are we talking about?
The issue is that in the next pipeline step, you're querying again for all users matching the wildcard. What you need instead of Get-ADUser is a simple Where-Clause.
The other error might be caused by the first, because you're pretty much spamming AD with queries.
How many user accounts are we talking about?
Search-ADAccount -PasswordNeverExpires -UsersOnly -ResultSetSize $Null | ? {$_.Name -like "*wildcard*"} | FT Name, ObjectClass
ASKER
FOXLUV,
That won't work, it just gives me all the accounts that are set to not expire. I am looking for a subset of those accounts that contain a specific set of characters.
odba,
I see, get-aduser doesn't care what is piped to it, it just looks at AD. I'll try what you sent and see what happens.
There are north of 50k users. thousands of which are legitimately non-expiring. But I ran into a few specific user names that were set to not expire, and should not be. They all contain something that I can filter on.
Thank you.
That won't work, it just gives me all the accounts that are set to not expire. I am looking for a subset of those accounts that contain a specific set of characters.
odba,
I see, get-aduser doesn't care what is piped to it, it just looks at AD. I'll try what you sent and see what happens.
There are north of 50k users. thousands of which are legitimately non-expiring. But I ran into a few specific user names that were set to not expire, and should not be. They all contain something that I can filter on.
Thank you.
Give me what you can filter on and I will attempt to send you the correct command. Are all the users in the same OU? We can target the OU if they are
ASKER
Foxluv, thanks, "priv-" or ADM- is what the accounts start with. Unfortunately, the way AD was setup in the first place, the accounts are in multiple OU's (from geographical dispersement of sites).
odba, Thanks that is super close, It's usable, just giving me a few extra names. I tried to change -like to -contains, but that does not work at all. I tried to add or to is since the accounts start with a couple of different things.
Thanks again.
odba, Thanks that is super close, It's usable, just giving me a few extra names. I tried to change -like to -contains, but that does not work at all. I tried to add or to is since the accounts start with a couple of different things.
Thanks again.
Maybe I'm not understanding by why not add your wildcard to the filter?
Get-ADUser -Properties * -Filter {PasswordNeverExpires -eq "True" -and name -like "*wildcard*"}
SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER CERTIFIED SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
Thank you both for helping out with this.